Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1583479
MD5:	7e33585d157419e39fb4d232c9f0c5dc
SHA1:	1cf4864a9b009e12534cc299c14466f2b2c9cea3
SHA256:	027a4baf9864a23fe09d99be3a6f83d1841e47aac2f94d313d2580e84d1b1b39
Tags:	exeuser-jstrosch
Infos:

Detection

XRed

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected XRed

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Document contains an embedded VBA macro with suspicious strings

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Document contains an embedded VBA with functions possibly related to HTTP operations

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Drops PE files to the document folder of the user

Machine Learning detection for dropped file

Machine Learning detection for sample

Uses dynamic DNS services

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Document contains an embedded VBA macro which executes code when the document is opened / closed

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the installation date of Windows

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Classification

Process Tree

System is w10x64

file.exe (PID: 4456 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 7E33585D157419E39FB4D232C9F0C5DC)

._cache_file.exe (PID: 2312 cmdline: "C:\Users\user\Desktop\._cache_file.exe" MD5: F0248D477E74687C5619AE16498B13D4)

._cache_file.exe (PID: 1608 cmdline: "C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe" -burn.clean.room="C:\Users\user\Desktop\._cache_file.exe" -burn.filehandle.attached=544 -burn.filehandle.self=648 MD5: 843288FD72A1152B50B4E4B7344BB592)

Synaptics.exe (PID: 7024 cmdline: "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate MD5: B753207B14C635F29B2ABF64F603570A)

WerFault.exe (PID: 7944 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7024 -s 3880 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7968 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7024 -s 3928 MD5: C31336C1EFC2CCB44B4326EA793040F2)

EXCEL.EXE (PID: 6784 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding MD5: 4A871771235598812032C822E6F68F19)

Synaptics.exe (PID: 7300 cmdline: "C:\ProgramData\Synaptics\Synaptics.exe" MD5: B753207B14C635F29B2ABF64F603570A)

cleanup

Malware Configuration

Threatname: XRed

{"C2 url": "xred.mooo.com", "Email": "xredline1@gmail.com", "Payload urls": ["http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download", "https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1", "http://xred.site50.net/syn/SUpdate.ini", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download", "https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1", "http://xred.site50.net/syn/Synaptics.rar", "https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download", "https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1", "http://xred.site50.net/syn/SSLLibrary.dll"]}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
file.exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
file.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\ProgramData\Synaptics\RCXF921.tmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\ProgramData\Synaptics\RCXF921.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\Documents\DVWHKMNFNN\~$cache1	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\Users\user\Documents\DVWHKMNFNN\~$cache1	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\ProgramData\Synaptics\Synaptics.exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\ProgramData\Synaptics\Synaptics.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author
00000003.00000003.1828103351.00000000006C8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
00000000.00000000.1717369613.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
00000000.00000000.1717369613.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Process Memory Space: file.exe PID: 4456	JoeSecurity_XRed	Yara detected XRed	Joe Security
Process Memory Space: Synaptics.exe PID: 7024	JoeSecurity_XRed	Yara detected XRed	Joe Security

Sigma Signatures

System Summary

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\ProgramData\Synaptics\Synaptics.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\file.exe, ProcessId: 4456, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\ProgramData\Synaptics\Synaptics.exe, ProcessId: 7024, TargetFilename: C:\Users\user\AppData\Local\Temp\GYA7zi3n.xlsm

Suricata Signatures

ET MALWARE Snake Keylogger Payload Request (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T20:31:46.328562+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49735	142.250.185.110	443	TCP
2025-01-02T20:31:46.392653+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49736	142.250.185.110	443	TCP
2025-01-02T20:31:47.456664+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49743	142.250.185.110	443	TCP
2025-01-02T20:31:47.476921+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49740	142.250.185.110	443	TCP
2025-01-02T20:31:48.537935+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49746	142.250.185.110	443	TCP
2025-01-02T20:31:48.597163+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49745	142.250.185.110	443	TCP
2025-01-02T20:31:49.610571+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49751	142.250.185.110	443	TCP
2025-01-02T20:31:49.731228+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49754	142.250.185.110	443	TCP
2025-01-02T20:31:51.609795+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49766	142.250.185.110	443	TCP
2025-01-02T20:31:51.610243+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49765	142.250.185.110	443	TCP
2025-01-02T20:31:52.653553+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49770	142.250.185.110	443	TCP
2025-01-02T20:31:52.667440+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49772	142.250.185.110	443	TCP

ETPRO MALWARE W32.Bloat-A Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T20:31:47.265511+0100	2832617	1	Malware Command and Control Activity Detected	192.168.2.4	49739	69.42.215.252	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe	Avira: detected
Source: file.exe	Avira: detected

Antivirus detection for URL or domain

Source: http://xred.site50.net/syn/Synaptics.rarZ	Avira URL Cloud: Label: malware
Source: http://xred.site50.net/syn/SSLLibrary.dll6	Avira URL Cloud: Label: malware
Source: http://xred.site50.net/syn/SSLLibrary.dlp	Avira URL Cloud: Label: malware
Source: http://xred.site50.net/syn/SUpdate.iniZ	Avira URL Cloud: Label: malware
Source: http://xred.site50.net/syn/SUpdate.iniH)	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\ProgramData\Synaptics\RCXF921.tmp	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\ProgramData\Synaptics\RCXF921.tmp	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\ProgramData\Synaptics\Synaptics.exe	Avira: detection malicious, Label: WORM/Delphi.Gen
Source: C:\ProgramData\Synaptics\Synaptics.exe	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\Users\user\Documents\DVWHKMNFNN\~$cache1	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\Users\user\Documents\DVWHKMNFNN\~$cache1	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006

Found malware configuration

Source: file.exe

Malware Configuration Extractor: XRed {"C2 url": "xred.mooo.com", "Email": "xredline1@gmail.com", "Payload urls": ["http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download", "https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1", "http://xred.site50.net/syn/SUpdate.ini", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download", "https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1", "http://xred.site50.net/syn/Synaptics.rar", "https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download", "https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1", "http://xred.site50.net/syn/SSLLibrary.dll"]}

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\Synaptics\RCXF921.tmp	ReversingLabs: Detection: 91%
Source: C:\ProgramData\Synaptics\Synaptics.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\Documents\DVWHKMNFNN\~$cache1	ReversingLabs: Detection: 91%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 86%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 94.8% probability

Machine Learning detection for dropped file

Source: C:\ProgramData\Synaptics\RCXF921.tmp	Joe Sandbox ML: detected
Source: C:\ProgramData\Synaptics\Synaptics.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Documents\DVWHKMNFNN\~$cache1	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 1_2_00919EB7 DecryptFileW,	1_2_00919EB7
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 1_2_0093F961 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,	1_2_0093F961
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 1_2_00919C99 DecryptFileW,DecryptFileW,	1_2_00919C99
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_00CF9EB7 DecryptFileW,	2_2_00CF9EB7
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_00D1F961 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,	2_2_00D1F961
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_00CF9C99 DecryptFileW,DecryptFileW,	2_2_00CF9C99

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe

Window detected: MICROSOFT SOFTWARE LICENSE TERMSMICROSOFT VISUAL C++ 2019 RUNTIME These license terms are an agreement between Microsoft Corporation (or based on where you live one of its affiliates) and you. They apply to the software named above. The terms also apply to any Microsoft services or updates for the software except to the extent those have different terms.IF YOU COMPLY WITH THESE LICENSE TERMS YOU HAVE THE RIGHTS BELOW.INSTALLATION AND USE RIGHTS. You may install and use any number of copies of the software.TERMS FOR SPECIFIC COMPONENTS.Microsoft Platforms. The software may include components from Microsoft Windows; Microsoft Windows Server; Microsoft SQL Server; Microsoft Exchange; Microsoft Office; and Microsoft SharePoint. These components are governed by separate agreements and their own product support policies as described in the Microsoft Licenses folder accompanying the software except that if license terms for those components are also included in the associated installation directory those license terms control.Third Party Components. The software may include third party components with separate legal notices or governed by other agreements as may be described in the ThirdPartyNotices file(s) accompanying the software. SCOPE OF LICENSE. The software is licensed not sold. This agreement only gives you some rights to use the software. Microsoft reserves all other rights. Unless applicable law gives you more rights despite this limitation you may use the software only as expressly permitted in this agreement. In doing so you must comply with any technical limitations in the software that only allow you to use it in certain ways. You may notwork around any technical limitations in the software;reverse engineer decompile or disassemble the software or otherwise attempt to derive the source code for the software except and only to the extent required by third party licensing terms governing the use of certain open source components that may be included in the software;remove minimize block or modify any notices of Microsoft or its suppliers in the software; use the software in any way that is against the law; orshare publish rent or lease the software or provide the software as a stand-alone offering for others to use or transfer the software or this agreement to any third party.EXPORT RESTRICTIONS. You must comply with all domestic and international export laws and regulations that apply to the software which include restrictions on destinations end users and end use. For further information on export restrictions visit www.microsoft.com/exporting <http://www.microsoft.com/exporting>. SUPPORT SERVICES. Because this software is as is we may not provide support services for it.ENTIRE AGREEMENT. This agreement and the terms for supplements updates Internet-based services and support services that you use are the entire agreement for the software and support services.APPLICABLE LAW. If you acquired the software in the United States Washing

Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	File created: C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	File created: C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1028\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	File created: C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1029\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	File created: C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1031\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	File created: C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1036\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	File created: C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1040\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	File created: C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1041\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	File created: C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1042\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	File created: C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1045\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	File created: C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1046\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	File created: C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1049\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	File created: C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1055\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	File created: C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\2052\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	File created: C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\3082\license.rtf	Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 142.250.185.110:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.110:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.161:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.161:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.110:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.110:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.110:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.110:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.161:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.110:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.110:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.161:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.110:443 -> 192.168.2.4:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.110:443 -> 192.168.2.4:49777 version: TLS 1.2

Source:	Binary string: C:\agent\_work\8\s\build\ship\x86\burn.pdb source: file.exe, ._cache_file.exe.0.dr, ._cache_file.exe.1.dr, Synaptics.exe.0.dr
Source:	Binary string: C:\agent\_work\8\s\build\ship\x86\WixStdBA.pdb source: ._cache_file.exe, 00000002.00000002.2976693645.000000006CF7F000.00000002.00000001.01000000.00000008.sdmp, wixstdba.dll.2.dr

Source: file.exe, 00000000.00000000.1717369613.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: file.exe, 00000000.00000000.1717369613.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: file.exe, 00000000.00000000.1717369613.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: autorun.inf
Source: Synaptics.exe, 00000003.00000003.1828103351.00000000006C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 00000003.00000003.1828103351.00000000006C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 00000003.00000003.1828103351.00000000006C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: file.exe	Binary or memory string: [autorun]
Source: file.exe	Binary or memory string: [autorun]
Source: file.exe	Binary or memory string: autorun.inf
Source: RCXF921.tmp.0.dr	Binary or memory string: [autorun]
Source: RCXF921.tmp.0.dr	Binary or memory string: [autorun]
Source: RCXF921.tmp.0.dr	Binary or memory string: autorun.inf
Source: Synaptics.exe.0.dr	Binary or memory string: [autorun]
Source: Synaptics.exe.0.dr	Binary or memory string: [autorun]
Source: Synaptics.exe.0.dr	Binary or memory string: autorun.inf
Source: ~$cache1.3.dr	Binary or memory string: [autorun]
Source: ~$cache1.3.dr	Binary or memory string: [autorun]
Source: ~$cache1.3.dr	Binary or memory string: autorun.inf

Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 1_2_00944315 FindFirstFileW,FindClose,	1_2_00944315
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 1_2_0091993E FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	1_2_0091993E
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 1_2_00903BC3 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	1_2_00903BC3
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_00D24315 FindFirstFileW,FindClose,	2_2_00D24315
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_00CF993E FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	2_2_00CF993E
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_00CE3BC3 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	2_2_00CE3BC3
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_6CF665CB FindFirstFileW,FindClose,	2_2_6CF665CB

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: excel.exe

Memory has grown: Private usage: 2MB later: 67MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2832617 - Severity 1 - ETPRO MALWARE W32.Bloat-A Checkin : 192.168.2.4:49739 -> 69.42.215.252:80
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49735 -> 142.250.185.110:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49736 -> 142.250.185.110:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49746 -> 142.250.185.110:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49751 -> 142.250.185.110:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49743 -> 142.250.185.110:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49745 -> 142.250.185.110:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49754 -> 142.250.185.110:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49770 -> 142.250.185.110:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49765 -> 142.250.185.110:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49772 -> 142.250.185.110:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49766 -> 142.250.185.110:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49740 -> 142.250.185.110:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: xred.mooo.com

Uses dynamic DNS services

Source: unknown

DNS query: name: freedns.afraid.org

Source: Joe Sandbox View

IP Address: 69.42.215.252 69.42.215.252

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=E7Kva_2TXV9tU-xhvFNe3uEsFnvrgAUBbz94lavT56wPDEdOg99fhPQrIFGN0EPu9_D4_0v4flfeNu6t16tIJsA01yw1M0WzBI-9ZX2NrQCrJNrrG5BZ1i8drDoxDvYiN-hVXYJUV4hAQ_cIJoF0oPglLhYD2E9hfK-DCZM9BxCd3s1cmWvsJos
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=jmjpy8C-HwaB0pXfxJynkCpW6IdEUtEUh4BQ9_4nTYV5czewC58-QHaMcyru7AgJavblhbUSa4K_67HMj0wx0A2I6ZDtkSnFt10V3ntT7UNMJkYD5ovgxXytk3nV3j5tLH56FjM8bCnYQB2jwzZ_WJswb9HqvG8moQB-OoWrfqg2m5Jx1jNQrnw
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=LgUFhhPBqawLki2Ox4f0k8nktyVgTqfUiaMqHVYdMpb4jdttmjxK0GVQBWkzGRlG42lzGmyTgtP8GvLZ2BbgnLnua-cwIa2jb9WO5DMea-FYHyAjlBUQir_CR2L37YBxEyJdazkhnjZDE6BtJeBO-qUpnSfbH_gL-fzQRrORgUnQqqVtQ2eBfms
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=LgUFhhPBqawLki2Ox4f0k8nktyVgTqfUiaMqHVYdMpb4jdttmjxK0GVQBWkzGRlG42lzGmyTgtP8GvLZ2BbgnLnua-cwIa2jb9WO5DMea-FYHyAjlBUQir_CR2L37YBxEyJdazkhnjZDE6BtJeBO-qUpnSfbH_gL-fzQRrORgUnQqqVtQ2eBfms
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=LgUFhhPBqawLki2Ox4f0k8nktyVgTqfUiaMqHVYdMpb4jdttmjxK0GVQBWkzGRlG42lzGmyTgtP8GvLZ2BbgnLnua-cwIa2jb9WO5DMea-FYHyAjlBUQir_CR2L37YBxEyJdazkhnjZDE6BtJeBO-qUpnSfbH_gL-fzQRrORgUnQqqVtQ2eBfms
Source: global traffic	HTTP traffic detected: GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1User-Agent: MyAppHost: freedns.afraid.orgCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: docs.google.com
Source: global traffic	DNS traffic detected: DNS query: xred.mooo.com
Source: global traffic	DNS traffic detected: DNS query: freedns.afraid.org
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4tOl-29wS6k84qHxToX2WixVZgIj661ISdsnkA1BoERt0HQM-ia29C_cUjG83Y5H29Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:31:47 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce--anNo_bVNguTJidWHyS_Wg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1652Server: UploadServerSet-Cookie: NID=520=E7Kva_2TXV9tU-xhvFNe3uEsFnvrgAUBbz94lavT56wPDEdOg99fhPQrIFGN0EPu9_D4_0v4flfeNu6t16tIJsA01yw1M0WzBI-9ZX2NrQCrJNrrG5BZ1i8drDoxDvYiN-hVXYJUV4hAQ_cIJoF0oPglLhYD2E9hfK-DCZM9BxCd3s1cmWvsJos; expires=Fri, 04-Jul-2025 19:31:47 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4xUtMlCqwILzEGcwIjMltxP_tFmwT-fUuLxRDb2IS_71-H3pr6Jpf9KTFRHLeqPO0AContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:31:47 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-7osYibLeB_LCvr6be3hkRw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerSet-Cookie: NID=520=jmjpy8C-HwaB0pXfxJynkCpW6IdEUtEUh4BQ9_4nTYV5czewC58-QHaMcyru7AgJavblhbUSa4K_67HMj0wx0A2I6ZDtkSnFt10V3ntT7UNMJkYD5ovgxXytk3nV3j5tLH56FjM8bCnYQB2jwzZ_WJswb9HqvG8moQB-OoWrfqg2m5Jx1jNQrnw; expires=Fri, 04-Jul-2025 19:31:47 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5gCrnj20n6xOM87ocXMo2e4FNCH_1hPqKE4JbaSTTvZccVScRew-TuDBRqt46nb44lContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:31:48 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-7oZ7VjXZJp8uPk4htv1g2Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerSet-Cookie: NID=520=LgUFhhPBqawLki2Ox4f0k8nktyVgTqfUiaMqHVYdMpb4jdttmjxK0GVQBWkzGRlG42lzGmyTgtP8GvLZ2BbgnLnua-cwIa2jb9WO5DMea-FYHyAjlBUQir_CR2L37YBxEyJdazkhnjZDE6BtJeBO-qUpnSfbH_gL-fzQRrORgUnQqqVtQ2eBfms; expires=Fri, 04-Jul-2025 19:31:48 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5KzMMeBV1JtD4F3VGvqo7VOsgvrb-buJO_jtAiH_jHhM1d177YjYa4Iz6yvkMP8pN5BgAYG-8Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:31:48 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-b3xTyg5CgVNyYpUJ2ftxRA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4IpPwBg9i8leVa8-u1U-lHauAkfvQvkrnrhkj19QeLLRfaTfPbYUwnMeBW3n-ZeeLJContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:31:49 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-vuaB6E5mB1t7SdM5BnPpjw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC55aAmwFiLfgCqnVxAJU3o8cTYJ_NJzqVSAR7VEucoGRyhjN-4tlTODCaP2W0mv_S6pContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:31:49 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-1kniKR0S_lOpjzjjJOR9bQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7uLwpxtdXvp5lnUWwXNeO_16aLHSE7ULAc-ZO6-nLSoa8rh8Gb1MOIVaN42E4SLY97Y1sbtPUContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:31:52 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-GPF_J_uQOgm8zHUi_8y0Gg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6jVyUz9JVphhW8f05i69uFWscCnbCw7Iw8WKsiDwsh8xCuNB28RU2zSbnOjSyWj4upexFp5gcContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:31:52 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-4fsXioiz3Huv1uK1EhXi5g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close

Source: ._cache_file.exe	String found in binary or memory: http://appsyndication.org/2006/appsyn
Source: file.exe, ._cache_file.exe.0.dr, ._cache_file.exe.1.dr, Synaptics.exe.0.dr	String found in binary or memory: http://appsyndication.org/2006/appsynapplicationapuputil.cppupgradeexclusivetrueenclosuredigestalgor
Source: Synaptics.exe, 00000003.00000003.1881197729.0000000005132000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://freedns.afrai
Source: ~$cache1.3.dr	String found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
Source: Synaptics.exe, 00000003.00000002.2035183860.000000000069A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978U
Source: Synaptics.exe, 00000003.00000002.2035183860.000000000069A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978b
Source: Amcache.hve.13.dr	String found in binary or memory: http://upx.sf.net
Source: ._cache_file.exe, 00000002.00000002.2976196154.0000000003140000.00000004.00000800.00020000.00000000.sdmp, thm.xml.2.dr	String found in binary or memory: http://wixtoolset.org/schemas/thmutil/2010
Source: ~$cache1.3.dr	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dll
Source: Synaptics.exe, 00000003.00000002.2037044913.00000000021D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dll6
Source: file.exe, 00000000.00000003.1754800483.0000000002F70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dlp
Source: ~$cache1.3.dr	String found in binary or memory: http://xred.site50.net/syn/SUpdate.ini
Source: file.exe, 00000000.00000003.1754800483.0000000002F70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SUpdate.iniH)
Source: Synaptics.exe, 00000003.00000002.2037044913.00000000021D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SUpdate.iniZ
Source: ~$cache1.3.dr	String found in binary or memory: http://xred.site50.net/syn/Synaptics.rar
Source: Synaptics.exe, 00000003.00000002.2037044913.00000000021D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/Synaptics.rarZ
Source: Synaptics.exe, 00000003.00000002.2039969716.000000000517C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.00000000006AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: Synaptics.exe, 00000003.00000002.2039969716.00000000051BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/8W(c
Source: Synaptics.exe, 00000003.00000003.1876533097.00000000051A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/8if
Source: Synaptics.exe, 00000003.00000003.1876533097.00000000051A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/a
Source: Synaptics.exe, 00000003.00000002.2039969716.00000000051BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/d
Source: Synaptics.exe, 00000003.00000002.2039969716.00000000051BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/der
Source: Synaptics.exe, 00000003.00000002.2039969716.000000000517C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/gleapis-cn.com
Source: Synaptics.exe, 00000003.00000003.1876533097.00000000051A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/google.com/
Source: Synaptics.exe, 00000003.00000002.2039969716.000000000517C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/google.com/load?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Source: Synaptics.exe, 00000003.00000003.1876533097.00000000051A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/is-cn.com
Source: Synaptics.exe, 00000003.00000002.2035183860.00000000006DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/ject.org.cn
Source: Synaptics.exe, 00000003.00000003.1876533097.00000000051A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/recaptcha.net.cn
Source: file.exe, 00000000.00000003.1754800483.0000000002F70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=downlo
Source: ~$cache1.3.dr	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
Source: Synaptics.exe, 00000003.00000002.2037044913.00000000021D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=downloadN
Source: Synaptics.exe, 00000003.00000002.2039969716.000000000517A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsO
Source: file.exe, 00000000.00000003.1754800483.0000000002F70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downlo
Source: ~$cache1.3.dr	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Source: Synaptics.exe, 00000003.00000002.2035183860.0000000000703000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&
Source: Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&(J
Source: Synaptics.exe, 00000003.00000003.1876533097.000000000517A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.1881197729.0000000005132000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2039969716.000000000517C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2039969716.0000000005120000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)
Source: Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.
Source: Synaptics.exe, 00000003.00000002.2035183860.0000000000703000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.W
Source: Synaptics.exe, 00000003.00000003.1876533097.000000000517A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.c
Source: Synaptics.exe, 00000003.00000003.1876533097.000000000517A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.g
Source: Synaptics.exe, 00000003.00000003.1876533097.000000000517A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.g__
Source: Synaptics.exe, 00000003.00000003.1876533097.000000000517A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2039969716.000000000517C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/Q
Source: Synaptics.exe, 00000003.00000002.2035183860.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2039969716.000000000517C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2043983015.0000000007937000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0
Source: Synaptics.exe, 00000003.00000002.2039969716.000000000514B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.1881197729.0000000005132000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2039969716.0000000005120000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1
Source: Synaptics.exe, 00000003.00000003.1881197729.0000000005132000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2039969716.0000000005120000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download2
Source: Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download2(v
Source: Synaptics.exe, 00000003.00000002.2043983015.0000000007937000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3
Source: Synaptics.exe, 00000003.00000002.2035183860.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3Z
Source: Synaptics.exe, 00000003.00000002.2039969716.000000000514B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.1881197729.0000000005132000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4
Source: Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download6
Source: Synaptics.exe, 00000003.00000003.1880797307.000000000073C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download7
Source: Synaptics.exe, 00000003.00000002.2035183860.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2043983015.0000000007937000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download8
Source: Synaptics.exe, 00000003.00000002.2035183860.00000000006AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download8$;
Source: Synaptics.exe, 00000003.00000003.1881197729.0000000005132000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2039969716.0000000005120000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download85839Z
Source: Synaptics.exe, 00000003.00000002.2035183860.00000000006AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9;;
Source: Synaptics.exe, 00000003.00000003.1880797307.000000000073C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:
Source: Synaptics.exe, 00000003.00000003.1876533097.000000000517A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2039969716.000000000517C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2043983015.0000000007937000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;
Source: Synaptics.exe, 00000003.00000003.1881197729.0000000005132000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2039969716.0000000005120000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadA
Source: Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadB
Source: Synaptics.exe, 00000003.00000003.1876533097.000000000517A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.0000000000703000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadC
Source: Synaptics.exe, 00000003.00000003.1876533097.000000000517A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2039969716.000000000517C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadCo
Source: Synaptics.exe, 00000003.00000002.2035183860.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2043983015.0000000007937000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadE
Source: Synaptics.exe, 00000003.00000002.2035183860.0000000000703000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.1880797307.000000000073C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadF
Source: Synaptics.exe, 00000003.00000003.1876533097.000000000517A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadFrw_
Source: Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2043983015.0000000007937000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadH
Source: Synaptics.exe, 00000003.00000003.1880797307.000000000073C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadH.
Source: Synaptics.exe, 00000003.00000002.2035183860.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadHZS
Source: Synaptics.exe, 00000003.00000002.2039969716.000000000514B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.1881197729.0000000005132000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadI
Source: Synaptics.exe, 00000003.00000002.2037044913.00000000021D0000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.1880797307.000000000073C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJ
Source: Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJ-n
Source: Synaptics.exe, 00000003.00000002.2043983015.0000000007937000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadK
Source: Synaptics.exe, 00000003.00000003.1880797307.000000000073C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadL
Source: Synaptics.exe, 00000003.00000002.2043983015.00000000078F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadLJ
Source: Synaptics.exe, 00000003.00000002.2035183860.0000000000703000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadN
Source: Synaptics.exe, 00000003.00000002.2039969716.00000000051BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadO_d0
Source: Synaptics.exe, 00000003.00000002.2035183860.0000000000703000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2039969716.000000000514B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.1881197729.0000000005132000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadP
Source: Synaptics.exe, 00000003.00000003.1880797307.000000000073C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadPerU/
Source: Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadR
Source: Synaptics.exe, 00000003.00000002.2035183860.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadRZ
Source: Synaptics.exe, 00000003.00000003.1876533097.000000000517A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2039969716.000000000517C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadSQ
Source: Synaptics.exe, 00000003.00000003.1880797307.000000000073C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadSec-C
Source: Synaptics.exe, 00000003.00000003.1876533097.000000000517A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2043983015.0000000007937000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadU
Source: Synaptics.exe, 00000003.00000003.1880797307.000000000073C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadV
Source: Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadV-
Source: Synaptics.exe, 00000003.00000002.2043983015.0000000007937000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadW
Source: Synaptics.exe, 00000003.00000002.2035183860.0000000000703000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadX
Source: Synaptics.exe, 00000003.00000003.1880797307.000000000073C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadX-t
Source: Synaptics.exe, 00000003.00000002.2035183860.0000000000703000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2043983015.0000000007937000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadZ
Source: Synaptics.exe, 00000003.00000002.2043983015.0000000007937000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloada
Source: Synaptics.exe, 00000003.00000002.2035183860.0000000000703000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2039969716.000000000514B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.1880797307.000000000073C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.1881197729.0000000005132000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadb
Source: Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadb-
Source: Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadc
Source: Synaptics.exe, 00000003.00000003.1876533097.000000000517A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcn
Source: Synaptics.exe, 00000003.00000002.2035183860.0000000000703000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2043983015.0000000007937000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadd
Source: Synaptics.exe, 00000003.00000003.1880797307.000000000073C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddate
Source: Synaptics.exe, 00000003.00000003.1876533097.000000000517A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2039969716.000000000514B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.1881197729.0000000005132000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2039969716.000000000517C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloade
Source: Synaptics.exe, 00000003.00000003.1880797307.000000000073C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadec-CH6/
Source: Synaptics.exe, 00000003.00000002.2041574972.000000000626E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2043168667.0000000006FFE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2042953832.0000000006D7E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2041134078.00000000059AE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.0000000000703000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2041960228.00000000069BE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2041323537.0000000005D6E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.1880797307.000000000073C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2041653452.00000000063AE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2041900699.000000000687E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2041386698.0000000005EAE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2042314781.0000000006AFE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2042688185.0000000006C3E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2041513890.000000000612E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2043102865.0000000006EBE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2041193145.0000000005AEE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2038170026.00000000042AD000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2041717397.00000000064EE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2039273360.00000000046AE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2041839036.000000000673E000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadf
Source: Synaptics.exe, 00000003.00000002.2035183860.0000000000703000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadf$
Source: Synaptics.exe, 00000003.00000003.1876533097.000000000517A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2043983015.0000000007937000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadg
Source: Synaptics.exe, 00000003.00000003.1880797307.000000000073C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadg.X
Source: Synaptics.exe, 00000003.00000002.2035183860.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgZr
Source: Synaptics.exe, 00000003.00000003.1876533097.000000000517A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgo
Source: Synaptics.exe, 00000003.00000003.1876533097.000000000517A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgo3_
Source: Synaptics.exe, 00000003.00000003.1881197729.0000000005132000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2039969716.0000000005120000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadh
Source: Synaptics.exe, 00000003.00000002.2043983015.00000000078F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadha-cn.net
Source: Synaptics.exe, 00000003.00000003.1880797307.000000000073C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadion-l
Source: Synaptics.exe, 00000003.00000003.1876533097.000000000517A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlo
Source: Synaptics.exe, 00000003.00000003.1876533097.000000000517A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.0000000000703000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2043983015.00000000078F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadm
Source: Synaptics.exe, 00000003.00000002.2035183860.0000000000703000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadm8
Source: Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn
Source: Synaptics.exe, 00000003.00000003.1876533097.000000000517A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2043983015.0000000007937000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloado
Source: Synaptics.exe, 00000003.00000002.2035183860.0000000000703000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoE
Source: Synaptics.exe, 00000003.00000002.2043983015.00000000078F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoJ
Source: Synaptics.exe, 00000003.00000003.1880797307.000000000073C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadocati
Source: Synaptics.exe, 00000003.00000003.1876533097.000000000517A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2039969716.000000000517C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadom
Source: Synaptics.exe, 00000003.00000003.1880797307.000000000073C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadplatfK/
Source: Synaptics.exe, 00000003.00000003.1876533097.000000000517A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadpr
Source: Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.1881197729.0000000005132000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2039969716.0000000005120000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadq
Source: Synaptics.exe, 00000003.00000003.1880797307.000000000073C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrigin
Source: Synaptics.exe, 00000003.00000003.1880797307.000000000073C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrt-sa
Source: Synaptics.exe, 00000003.00000003.1880797307.000000000073C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrt-uj/
Source: Synaptics.exe, 00000003.00000003.1880797307.000000000073C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrt=d
Source: Synaptics.exe, 00000003.00000002.2035183860.0000000000703000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloads.goo
Source: Synaptics.exe, 00000003.00000003.1880797307.000000000073C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt
Source: Synaptics.exe, 00000003.00000003.1876533097.000000000517A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadts
Source: Synaptics.exe, 00000003.00000002.2035183860.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadu
Source: Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadv(:
Source: Synaptics.exe, 00000003.00000002.2035183860.0000000000703000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadw
Source: Synaptics.exe, 00000003.00000002.2035183860.0000000000703000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2043983015.0000000007937000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloady
Source: Synaptics.exe, 00000003.00000002.2039969716.000000000514B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.000000000072A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.1881197729.0000000005132000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadz
Source: file.exe, 00000000.00000003.1754800483.0000000002F70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloX
Source: file.exe, 00000000.00000003.1754800483.0000000002F70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloXO
Source: ~$cache1.3.dr	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
Source: Synaptics.exe, 00000003.00000002.2037044913.00000000021D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloadN
Source: Synaptics.exe, 00000003.00000002.2035183860.0000000000703000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: Synaptics.exe, 00000003.00000002.2035183860.0000000000703000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.1876533097.000000000516E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2039969716.0000000005212000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.1876533097.00000000051E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2039969716.00000000051E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.00000000006AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Source: Synaptics.exe, 00000003.00000002.2035183860.00000000006AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9
Source: Synaptics.exe, 00000003.00000002.2035183860.0000000000703000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadfms
Source: Synaptics.exe, 00000003.00000002.2035183860.0000000000703000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadfms:
Source: Synaptics.exe, 00000003.00000002.2035183860.0000000000703000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadfmsG
Source: Synaptics.exe, 00000003.00000002.2035183860.0000000000703000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadfmsu
Source: Synaptics.exe, 00000003.00000002.2043983015.00000000078F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiZ=u
Source: ~$cache1.3.dr	String found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
Source: Synaptics.exe, 00000003.00000002.2037044913.00000000021D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1:
Source: file.exe, 00000000.00000003.1754800483.0000000002F70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=8
Source: file.exe, 00000000.00000003.1754800483.0000000002F70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl
Source: ~$cache1.3.dr	String found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
Source: Synaptics.exe, 00000003.00000002.2037044913.00000000021D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=16
Source: ~$cache1.3.dr	String found in binary or memory: https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
Source: Synaptics.exe, 00000003.00000002.2037044913.00000000021D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1:

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 142.250.185.110:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.110:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.161:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.161:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.110:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.110:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.110:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.110:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.161:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.110:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.110:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.161:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.110:443 -> 192.168.2.4:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.110:443 -> 192.168.2.4:49777 version: TLS 1.2

System Summary

Document contains an embedded VBA macro with suspicious strings

Source: GYA7zi3n.xlsm.3.dr	OLE, VBA macro line: FN = Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe"
Source: GYA7zi3n.xlsm.3.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: GYA7zi3n.xlsm.3.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: GYA7zi3n.xlsm.3.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: GYA7zi3n.xlsm.3.dr	OLE, VBA macro line: TMP = Environ("Temp") & "\~$cache1.exe"
Source: GYA7zi3n.xlsm.3.dr	OLE, VBA macro line: If FSO.FileExists(Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe") Then
Source: GYA7zi3n.xlsm.3.dr	OLE, VBA macro line: Shell Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe", vbHide
Source: GYA7zi3n.xlsm.3.dr	OLE, VBA macro line: ElseIf FSO.FileExists(Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe") Then
Source: GYA7zi3n.xlsm.3.dr	OLE, VBA macro line: Shell Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe", vbHide
Source: GYA7zi3n.xlsm.3.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
Source: GYA7zi3n.xlsm.3.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5")
Source: WUTJSCBCFX.xlsm.3.dr	OLE, VBA macro line: FN = Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe"
Source: WUTJSCBCFX.xlsm.3.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: WUTJSCBCFX.xlsm.3.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: WUTJSCBCFX.xlsm.3.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: WUTJSCBCFX.xlsm.3.dr	OLE, VBA macro line: TMP = Environ("Temp") & "\~$cache1.exe"
Source: WUTJSCBCFX.xlsm.3.dr	OLE, VBA macro line: If FSO.FileExists(Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe") Then
Source: WUTJSCBCFX.xlsm.3.dr	OLE, VBA macro line: Shell Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe", vbHide
Source: WUTJSCBCFX.xlsm.3.dr	OLE, VBA macro line: ElseIf FSO.FileExists(Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe") Then
Source: WUTJSCBCFX.xlsm.3.dr	OLE, VBA macro line: Shell Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe", vbHide
Source: WUTJSCBCFX.xlsm.3.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
Source: WUTJSCBCFX.xlsm.3.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5")

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Source: GYA7zi3n.xlsm.3.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'ADODB.Stream' functions open, read, savetofile, write
Source: WUTJSCBCFX.xlsm.3.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'ADODB.Stream' functions open, read, savetofile, write

Document contains an embedded VBA with functions possibly related to HTTP operations

Source: GYA7zi3n.xlsm.3.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'XMLHttpRequest' functions response, responsebody, responsetext, status, open, send
Source: WUTJSCBCFX.xlsm.3.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'XMLHttpRequest' functions response, responsebody, responsetext, status, open, send

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Source: GYA7zi3n.xlsm.3.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'WScript.Shell' functions regread, regwrite, environ
Source: WUTJSCBCFX.xlsm.3.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'WScript.Shell' functions regread, regwrite, environ

Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 1_2_0092C0FA	1_2_0092C0FA
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 1_2_00906184	1_2_00906184
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 1_2_0093022D	1_2_0093022D
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 1_2_0093A3B0	1_2_0093A3B0
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 1_2_00930662	1_2_00930662
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 1_2_0090A7EF	1_2_0090A7EF
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 1_2_0093A85E	1_2_0093A85E
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 1_2_009169CC	1_2_009169CC
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 1_2_0092F919	1_2_0092F919
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 1_2_00930A97	1_2_00930A97
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 1_2_00932B21	1_2_00932B21
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 1_2_00932D50	1_2_00932D50
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 1_2_0093ED4C	1_2_0093ED4C
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 1_2_0092FE15	1_2_0092FE15
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_00D0C0FA	2_2_00D0C0FA
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_00CE6184	2_2_00CE6184
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_00D1022D	2_2_00D1022D
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_00D1A3B0	2_2_00D1A3B0
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_00D10662	2_2_00D10662
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_00CEA7EF	2_2_00CEA7EF
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_00D1A85E	2_2_00D1A85E
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_00CF69CC	2_2_00CF69CC
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_00D0F919	2_2_00D0F919
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_00D10A97	2_2_00D10A97
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_00D12B21	2_2_00D12B21
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_00D12D50	2_2_00D12D50
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_00D1ED4C	2_2_00D1ED4C
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_00D0FE15	2_2_00D0FE15
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_6CF623E7	2_2_6CF623E7
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_6CF71CFF	2_2_6CF71CFF
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_6CF78500	2_2_6CF78500
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_6CF7D628	2_2_6CF7D628
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_6CF71F2E	2_2_6CF71F2E
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_6CF789AE	2_2_6CF789AE
Source: C:\ProgramData\Synaptics\Synaptics.exe	Code function: 3_2_051C136A	3_2_051C136A

Source: GYA7zi3n.xlsm.3.dr	OLE, VBA macro line: Private Sub Workbook_Open()
Source: GYA7zi3n.xlsm.3.dr	OLE, VBA macro line: Private Sub Workbook_BeforeClose(Cancel As Boolean)
Source: WUTJSCBCFX.xlsm.3.dr	OLE, VBA macro line: Private Sub Workbook_Open()
Source: WUTJSCBCFX.xlsm.3.dr	OLE, VBA macro line: Private Sub Workbook_BeforeClose(Cancel As Boolean)

Source: Joe Sandbox View	Dropped File: C:\ProgramData\Synaptics\RCXF921.tmp 7F16106F3354A65FC749737905B77DF7BBEFA28BF8BBC966DC1F8C53FA4660F2
Source: Joe Sandbox View	Dropped File: C:\Users\user\Documents\DVWHKMNFNN\~$cache1 7F16106F3354A65FC749737905B77DF7BBEFA28BF8BBC966DC1F8C53FA4660F2

Source: C:\Users\user\Desktop\._cache_file.exe	Code function: String function: 009037D3 appears 496 times
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: String function: 0094012F appears 678 times
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: String function: 009431C7 appears 83 times
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: String function: 00901F20 appears 54 times
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: String function: 0094061A appears 34 times
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: String function: 6CF6D536 appears 38 times
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: String function: 6CF63D10 appears 82 times
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: String function: 00D2061A appears 34 times
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: String function: 00CE37D3 appears 496 times
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: String function: 00D231C7 appears 83 times
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: String function: 00CE1F20 appears 54 times
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: String function: 00D2012F appears 678 times

Source: C:\ProgramData\Synaptics\Synaptics.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7024 -s 3880

Source: file.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: file.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: Synaptics.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: Synaptics.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: RCXF921.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: ~$cache1.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Source: file.exe, 00000000.00000000.1717369613.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs file.exe
Source: file.exe, 00000000.00000003.1754974521.00000000015D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs file.exe
Source: file.exe, 00000000.00000003.1754800483.0000000002F70000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb! vs file.exe
Source: ._cache_file.exe	Binary or memory string: OriginalFilename vs file.exe
Source: ._cache_file.exe, 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: tLegalCopyrightCopyright (c) Microsoft Corporation. All rights reserved.L$OriginalFilenameVC_redist.x64.exe vs file.exe
Source: ._cache_file.exe	Binary or memory string: OriginalFilename vs file.exe
Source: ._cache_file.exe, 00000002.00000000.1732027597.0000000000D4E000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: tLegalCopyrightCopyright (c) Microsoft Corporation. All rights reserved.L$OriginalFilenameVC_redist.x64.exe vs file.exe
Source: ._cache_file.exe, 00000002.00000002.2976814931.000000006CF8C000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamewixstdba.dll\ vs file.exe
Source: file.exe	Binary or memory string: OriginalFileName vs file.exe
Source: file.exe	Binary or memory string: tLegalCopyrightCopyright (c) Microsoft Corporation. All rights reserved.L$OriginalFilenameVC_redist.x64.exe vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameb! vs file.exe
Source: ._cache_file.exe.0.dr	Binary or memory string: tLegalCopyrightCopyright (c) Microsoft Corporation. All rights reserved.L$OriginalFilenameVC_redist.x64.exe vs file.exe
Source: ._cache_file.exe.1.dr	Binary or memory string: tLegalCopyrightCopyright (c) Microsoft Corporation. All rights reserved.L$OriginalFilenameVC_redist.x64.exe vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal72.troj.expl.evad.winEXE@11/58@5/3

Source: C:\Users\user\Desktop\._cache_file.exe

Code function: 1_2_0093FD20 FormatMessageW,GetLastError,LocalFree,

1_2_0093FD20

Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 1_2_009044E9 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,		1_2_009044E9
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_00CE44E9 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,		2_2_00CE44E9

Source: C:\Users\user\Desktop\._cache_file.exe

Code function: 1_2_00942F23 GetModuleHandleA,GetLastError,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CoCreateInstance,ExitProcess,

1_2_00942F23

Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe

Code function: 2_2_6CF6CEBD FindResourceExA,GetLastError,LoadResource,GetLastError,SizeofResource,GetLastError,LockResource,GetLastError,

2_2_6CF6CEBD

Source: C:\Users\user\Desktop\._cache_file.exe

Code function: 1_2_00926945 ChangeServiceConfigW,GetLastError,

1_2_00926945

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\Desktop\._cache_file.exe

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7024
Source: C:\ProgramData\Synaptics\Synaptics.exe	Mutant created: \Sessions\1\BaseNamedObjects\Synaptics2X

Source: C:\Users\user\Desktop\._cache_file.exe

File created: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\

Jump to behavior

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 00000000.00000000.1717369613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\ProgramData\Synaptics\RCXF921.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\DVWHKMNFNN\~$cache1, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED

Source: C:\Users\user\Desktop\._cache_file.exe	Command line argument: cabinet.dll	1_2_00901070
Source: C:\Users\user\Desktop\._cache_file.exe	Command line argument: msi.dll	1_2_00901070
Source: C:\Users\user\Desktop\._cache_file.exe	Command line argument: version.dll	1_2_00901070
Source: C:\Users\user\Desktop\._cache_file.exe	Command line argument: wininet.dll	1_2_00901070
Source: C:\Users\user\Desktop\._cache_file.exe	Command line argument: comres.dll	1_2_00901070
Source: C:\Users\user\Desktop\._cache_file.exe	Command line argument: clbcatq.dll	1_2_00901070
Source: C:\Users\user\Desktop\._cache_file.exe	Command line argument: msasn1.dll	1_2_00901070
Source: C:\Users\user\Desktop\._cache_file.exe	Command line argument: crypt32.dll	1_2_00901070
Source: C:\Users\user\Desktop\._cache_file.exe	Command line argument: feclient.dll	1_2_00901070
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Command line argument: cabinet.dll	2_2_00CE1070
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Command line argument: msi.dll	2_2_00CE1070
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Command line argument: version.dll	2_2_00CE1070
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Command line argument: wininet.dll	2_2_00CE1070
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Command line argument: comres.dll	2_2_00CE1070
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Command line argument: clbcatq.dll	2_2_00CE1070
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Command line argument: msasn1.dll	2_2_00CE1070
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Command line argument: crypt32.dll	2_2_00CE1070
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Command line argument: feclient.dll	2_2_00CE1070

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 86%

Source: ._cache_file.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: ._cache_file.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: file.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\._cache_file.exe "C:\Users\user\Desktop\._cache_file.exe"
Source: C:\Users\user\Desktop\._cache_file.exe	Process created: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe "C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe" -burn.clean.room="C:\Users\user\Desktop\._cache_file.exe" -burn.filehandle.attached=544 -burn.filehandle.self=648
Source: C:\Users\user\Desktop\file.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Source: unknown	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe"
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7024 -s 3880
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7024 -s 3928
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\._cache_file.exe "C:\Users\user\Desktop\._cache_file.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Process created: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe "C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe" -burn.clean.room="C:\Users\user\Desktop\._cache_file.exe" -burn.filehandle.attached=544 -burn.filehandle.self=648	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: shacct.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: idstore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wlidprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: provsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: textshaping.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\ProgramData\Synaptics\Synaptics.exe

File written: C:\Users\user\AppData\Local\Temp\p57BtvQ.ini

Jump to behavior

Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Automated click: I agree to the license terms and conditions
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Automated click: Install

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe

Window detected: Number of UI elements: 23

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: file.exe

Static file information: File size 15745536 > 1048576

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: file.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0xe59a00

Source:	Binary string: C:\agent\_work\8\s\build\ship\x86\burn.pdb source: file.exe, ._cache_file.exe.0.dr, ._cache_file.exe.1.dr, Synaptics.exe.0.dr
Source:	Binary string: C:\agent\_work\8\s\build\ship\x86\WixStdBA.pdb source: ._cache_file.exe, 00000002.00000002.2976693645.000000006CF7F000.00000002.00000001.01000000.00000008.sdmp, wixstdba.dll.2.dr

Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe

Code function: 2_2_6CF61C04 LoadLibraryW,GetProcAddress,GetLastError,FreeLibrary,

2_2_6CF61C04

Source: ._cache_file.exe.0.dr	Static PE information: section name: .wixburn
Source: ._cache_file.exe.1.dr	Static PE information: section name: .wixburn

Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 1_2_0092E876 push ecx; ret	1_2_0092E889
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_00D0E876 push ecx; ret	2_2_00D0E889
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_6CF6EE46 push ecx; ret	2_2_6CF6EE59
Source: C:\ProgramData\Synaptics\Synaptics.exe	Code function: 3_2_051BDF0D push edi; ret	3_2_051BDF0E
Source: C:\ProgramData\Synaptics\Synaptics.exe	Code function: 3_2_051C14B3 push ss; iretd	3_2_051C14BC
Source: C:\ProgramData\Synaptics\Synaptics.exe	Code function: 3_2_051BCE73 push ss; iretd	3_2_051BCE84

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\ProgramData\Synaptics\Synaptics.exe

File created: C:\Users\user\Documents\DVWHKMNFNN\~$cache1

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\Desktop\._cache_file.exe	Jump to dropped file
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	File created: C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\wixstdba.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\Synaptics\RCXF921.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\Synaptics\Synaptics.exe	Jump to dropped file
Source: C:\Users\user\Desktop\._cache_file.exe	File created: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	File created: C:\Users\user\Documents\DVWHKMNFNN\~$cache1	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\Synaptics\RCXF921.tmp			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\Synaptics\Synaptics.exe			Jump to dropped file

Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	File created: C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\wixstdba.dll			Jump to dropped file
Source: C:\Users\user\Desktop\._cache_file.exe	File created: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe			Jump to dropped file

Source: C:\ProgramData\Synaptics\Synaptics.exe

File created: C:\Users\user\Documents\DVWHKMNFNN\~$cache1

Jump to dropped file

Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	File created: C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	File created: C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1028\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	File created: C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1029\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	File created: C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1031\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	File created: C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1036\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	File created: C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1040\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	File created: C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1041\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	File created: C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1042\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	File created: C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1045\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	File created: C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1046\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	File created: C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1049\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	File created: C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1055\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	File created: C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\2052\license.rtf	Jump to behavior
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	File created: C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\3082\license.rtf	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver			Jump to behavior

Source: C:\ProgramData\Synaptics\Synaptics.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX

Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe

Dropped PE file which has not been started: C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\wixstdba.dll

Jump to dropped file

Source: C:\Users\user\Desktop\._cache_file.exe

Evaded block: after key decision

Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Users\user\Desktop\._cache_file.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes

Source: C:\Users\user\Desktop\._cache_file.exe

API coverage: 9.1 %

Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 7244	Thread sleep time: -720000s >= -30000s			Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 7920	Thread sleep time: -60000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 1_2_0093FDC2 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 0093FE5Dh	1_2_0093FDC2
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 1_2_0093FDC2 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 0093FE56h	1_2_0093FDC2
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_00D1FDC2 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 00D1FE5Dh	2_2_00D1FDC2
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_00D1FDC2 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 00D1FE56h	2_2_00D1FDC2

Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 1_2_00944315 FindFirstFileW,FindClose,	1_2_00944315
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 1_2_0091993E FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	1_2_0091993E
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 1_2_00903BC3 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	1_2_00903BC3
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_00D24315 FindFirstFileW,FindClose,	2_2_00D24315
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_00CF993E FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	2_2_00CF993E
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_00CE3BC3 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	2_2_00CE3BC3
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_6CF665CB FindFirstFileW,FindClose,	2_2_6CF665CB

Source: C:\Users\user\Desktop\._cache_file.exe

Code function: 1_2_0094962D VirtualQuery,GetSystemInfo,

1_2_0094962D

Source: C:\ProgramData\Synaptics\Synaptics.exe	Thread delayed: delay time: 60000			Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Thread delayed: delay time: 60000			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: Amcache.hve.13.dr	Binary or memory string: VMware
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.13.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.13.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.13.dr	Binary or memory string: VMware20,1hbin@
Source: Synaptics.exe, 00000003.00000002.2035183860.00000000006AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: Amcache.hve.13.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.13.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Synaptics.exe, 00000003.00000002.2035183860.0000000000703000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.13.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.13.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.13.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.13.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.13.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.13.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.13.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.13.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.13.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.13.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.13.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.13.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.13.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.13.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.13.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: file.exe, 00000000.00000003.1754974521.00000000015D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\>
Source: Amcache.hve.13.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\._cache_file.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	API call chain: ExitProcess graph end node

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\ProgramData\Synaptics\Synaptics.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\._cache_file.exe

Code function: 1_2_0092E625 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_0092E625

Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe

Code function: 2_2_6CF61C04 LoadLibraryW,GetProcAddress,GetLastError,FreeLibrary,

2_2_6CF61C04

Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 1_2_00934812 mov eax, dword ptr fs:[00000030h]	1_2_00934812
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_00D14812 mov eax, dword ptr fs:[00000030h]	2_2_00D14812
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_6CF73C07 mov eax, dword ptr fs:[00000030h]	2_2_6CF73C07

Source: C:\Users\user\Desktop\._cache_file.exe

Code function: 1_2_009038D4 GetProcessHeap,RtlAllocateHeap,

1_2_009038D4

Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 1_2_0092E188 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_0092E188
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 1_2_0092E625 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_0092E625
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 1_2_0092E773 SetUnhandledExceptionFilter,	1_2_0092E773
Source: C:\Users\user\Desktop\._cache_file.exe	Code function: 1_2_00933BB0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00933BB0
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_00D0E188 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00D0E188
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_00D0E625 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00D0E625
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_00D0E773 SetUnhandledExceptionFilter,	2_2_00D0E773
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_00D13BB0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00D13BB0
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_6CF6EC77 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6CF6EC77
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_6CF6E730 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_6CF6E730
Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	Code function: 2_2_6CF709E7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6CF709E7

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\._cache_file.exe "C:\Users\user\Desktop\._cache_file.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate	Jump to behavior
Source: C:\Users\user\Desktop\._cache_file.exe	Process created: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe "C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe" -burn.clean.room="C:\Users\user\Desktop\._cache_file.exe" -burn.filehandle.attached=544 -burn.filehandle.self=648	Jump to behavior

Source: C:\Users\user\Desktop\._cache_file.exe

Code function: 1_2_009415CB InitializeSecurityDescriptor,GetLastError,CreateWellKnownSid,CreateWellKnownSid,GetLastError,CreateWellKnownSid,CreateWellKnownSid,GetLastError,CreateWellKnownSid,CreateWellKnownSid,GetLastError,CreateWellKnownSid,CreateWellKnownSid,GetLastError,CreateWellKnownSid,CreateWellKnownSid,GetLastError,CreateWellKnownSid,SetEntriesInAclA,SetSecurityDescriptorOwner,GetLastError,SetSecurityDescriptorGroup,GetLastError,SetSecurityDescriptorDacl,GetLastError,CoInitializeSecurity,LocalFree,

1_2_009415CB

Source: C:\Users\user\Desktop\._cache_file.exe

Code function: 1_2_0094393B AllocateAndInitializeSid,CheckTokenMembership,

1_2_0094393B

Source: C:\Users\user\Desktop\._cache_file.exe

Code function: 1_2_0092E9A7 cpuid

1_2_0092E9A7

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe

Queries volume information: C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\logo.png VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\._cache_file.exe

Code function: 1_2_00914CE8 ConvertStringSecurityDescriptorToSecurityDescriptorW,GetLastError,CreateNamedPipeW,GetLastError,CreateNamedPipeW,GetLastError,CloseHandle,LocalFree,

1_2_00914CE8

Source: C:\Users\user\Desktop\._cache_file.exe

Code function: 1_2_0094858F GetSystemTime,

1_2_0094858F

Source: C:\Users\user\Desktop\._cache_file.exe

Code function: 1_2_009060BA GetUserNameW,GetLastError,

1_2_009060BA

Source: C:\Users\user\Desktop\._cache_file.exe

Code function: 1_2_00948733 GetTimeZoneInformation,SystemTimeToTzSpecificLocalTime,

1_2_00948733

Source: C:\Users\user\Desktop\._cache_file.exe

Code function: 1_2_0090508D GetModuleHandleW,CoInitializeEx,GetVersionExW,GetLastError,CoUninitialize,

1_2_0090508D

Source: Amcache.hve.13.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.13.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected XRed

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 00000003.00000003.1828103351.00000000006C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1717369613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4456, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Synaptics.exe PID: 7024, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\Synaptics\RCXF921.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\DVWHKMNFNN\~$cache1, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED

Remote Access Functionality

Yara detected XRed

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 00000003.00000003.1828103351.00000000006C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1717369613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4456, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Synaptics.exe PID: 7024, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\Synaptics\RCXF921.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\DVWHKMNFNN\~$cache1, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	41 Scripting	1 Replication Through Removable Media	3 Native API	41 Scripting	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 Command and Scripting Interpreter	1 DLL Side-Loading	1 Extra Window Memory Injection	2 Obfuscated Files or Information	LSASS Memory	1 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	1 Windows Service	1 Access Token Manipulation	1 DLL Side-Loading	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Registry Run Keys / Startup Folder	1 Windows Service	1 Extra Window Memory Injection	NTDS	4 File and Directory Discovery	Distributed Component Object Model	Input Capture	34 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	22 Masquerading	LSA Secrets	35 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Query Registry	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	141 Security Software Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Process Injection	Proc Filesystem	1 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	21 Virtualization/Sandbox Evasion	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	87%	ReversingLabs	Win32.Worm.Zorex
file.exe	100%	Avira	WORM/Delphi.Gen
file.exe	100%	Avira	W2000M/Dldr.Agent.17651006
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\Synaptics\RCXF921.tmp	100%	Avira	TR/Dldr.Agent.SH
C:\ProgramData\Synaptics\RCXF921.tmp	100%	Avira	W2000M/Dldr.Agent.17651006
C:\ProgramData\Synaptics\Synaptics.exe	100%	Avira	WORM/Delphi.Gen
C:\ProgramData\Synaptics\Synaptics.exe	100%	Avira	W2000M/Dldr.Agent.17651006
C:\Users\user\Documents\DVWHKMNFNN\~$cache1	100%	Avira	TR/Dldr.Agent.SH
C:\Users\user\Documents\DVWHKMNFNN\~$cache1	100%	Avira	W2000M/Dldr.Agent.17651006
C:\ProgramData\Synaptics\RCXF921.tmp	100%	Joe Sandbox ML
C:\ProgramData\Synaptics\Synaptics.exe	100%	Joe Sandbox ML
C:\Users\user\Documents\DVWHKMNFNN\~$cache1	100%	Joe Sandbox ML
C:\ProgramData\Synaptics\RCXF921.tmp	92%	ReversingLabs	Win32.Worm.Zorex
C:\ProgramData\Synaptics\Synaptics.exe	87%	ReversingLabs	Win32.Worm.Zorex
C:\Users\user\Desktop\._cache_file.exe	0%	ReversingLabs
C:\Users\user\Documents\DVWHKMNFNN\~$cache1	92%	ReversingLabs	Win32.Worm.Zorex
C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\wixstdba.dll	0%	ReversingLabs
C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
http://xred.site50.net/syn/Synaptics.rarZ	100%	Avira URL Cloud	malware
http://xred.site50.net/syn/SSLLibrary.dll6	100%	Avira URL Cloud	malware
http://freedns.afrai	0%	Avira URL Cloud	safe
http://xred.site50.net/syn/SSLLibrary.dlp	100%	Avira URL Cloud	malware
http://xred.site50.net/syn/SUpdate.iniZ	100%	Avira URL Cloud	malware
http://xred.site50.net/syn/SUpdate.iniH)	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
freedns.afraid.org	69.42.215.252	true	false	high
docs.google.com	142.250.185.110	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
drive.usercontent.google.com	142.250.186.161	true	false	high
xred.mooo.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
xred.mooo.com	false		high
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978b	Synaptics.exe, 00000003.00000002.2035183860.000000000069A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/Synaptics.rarZ	Synaptics.exe, 00000003.00000002.2037044913.00000000021D0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1	~$cache1.3.dr	false		high
http://wixtoolset.org/schemas/thmutil/2010	._cache_file.exe, 00000002.00000002.2976196154.0000000003140000.00000004.00000800.00020000.00000000.sdmp, thm.xml.2.dr	false		high
http://freedns.afrai	Synaptics.exe, 00000003.00000003.1881197729.0000000005132000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1:	Synaptics.exe, 00000003.00000002.2037044913.00000000021D0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/	Synaptics.exe, 00000003.00000002.2035183860.0000000000703000.00000004.00000020.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.13.dr	false		high
http://xred.site50.net/syn/Synaptics.rar	~$cache1.3.dr	false		high
https://docs.google.com/is-cn.com	Synaptics.exe, 00000003.00000003.1876533097.00000000051A5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://appsyndication.org/2006/appsynapplicationapuputil.cppupgradeexclusivetrueenclosuredigestalgor	file.exe, ._cache_file.exe.0.dr, ._cache_file.exe.1.dr, Synaptics.exe.0.dr	false		high
https://docs.google.com/d	Synaptics.exe, 00000003.00000002.2039969716.00000000051BA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.google.com/	Synaptics.exe, 00000003.00000002.2039969716.000000000517C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.2035183860.00000000006AF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.google.com/a	Synaptics.exe, 00000003.00000003.1876533097.00000000051A5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.google.com/google.com/	Synaptics.exe, 00000003.00000003.1876533097.00000000051A5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978U	Synaptics.exe, 00000003.00000002.2035183860.000000000069A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/SSLLibrary.dll6	Synaptics.exe, 00000003.00000002.2037044913.00000000021D0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1:	Synaptics.exe, 00000003.00000002.2037044913.00000000021D0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1	~$cache1.3.dr	false		high
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1	~$cache1.3.dr	false		high
https://docs.google.com/8W(c	Synaptics.exe, 00000003.00000002.2039969716.00000000051BA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.google.com/8if	Synaptics.exe, 00000003.00000003.1876533097.00000000051A5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.google.com/ject.org.cn	Synaptics.exe, 00000003.00000002.2035183860.00000000006DE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/SUpdate.iniZ	Synaptics.exe, 00000003.00000002.2037044913.00000000021D0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://docs.google.com/recaptcha.net.cn	Synaptics.exe, 00000003.00000003.1876533097.00000000051A5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=8	file.exe, 00000000.00000003.1754800483.0000000002F70000.00000004.00001000.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/SUpdate.ini	~$cache1.3.dr	false		high
https://docs.google.com/der	Synaptics.exe, 00000003.00000002.2039969716.00000000051BA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.google.com/gleapis-cn.com	Synaptics.exe, 00000003.00000002.2039969716.000000000517C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/SSLLibrary.dlp	file.exe, 00000000.00000003.1754800483.0000000002F70000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=16	Synaptics.exe, 00000003.00000002.2037044913.00000000021D0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsO	Synaptics.exe, 00000003.00000002.2039969716.000000000517A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/SUpdate.iniH)	file.exe, 00000000.00000003.1754800483.0000000002F70000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://xred.site50.net/syn/SSLLibrary.dll	~$cache1.3.dr	false		high
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl	file.exe, 00000000.00000003.1754800483.0000000002F70000.00000004.00001000.00020000.00000000.sdmp	false		high
http://appsyndication.org/2006/appsyn	._cache_file.exe	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.161	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
142.250.185.110	docs.google.com	United States	15169	GOOGLEUS	false
69.42.215.252	freedns.afraid.org	United States	17048	AWKNET-LLCUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583479
Start date and time:	2025-01-02 20:30:37 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal72.troj.expl.evad.winEXE@11/58@5/3
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 141 Number of non-executed functions: 256
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.109.28.46, 184.28.90.27, 52.113.194.132, 20.189.173.24, 20.189.173.21, 40.126.32.72, 4.245.163.56, 13.107.246.45
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.afd.azureedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, ecs-office.s-0005.s-msedge.net, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, onedsblobprdwus16.westus.cloudapp.azure.com, officeclient.microsoft.com, prod.fs.microsoft.com.akadns.net, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, otelrules.azureedge.net, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, s-0005-office.config.skype.com, fe3cr.delivery.mp.microsoft.com, s-0005.s-msedge.net, config.officeapps.live.com, blobcollector.events.data.trafficmanager.net, azureedge-t-prod.trafficmanager.net, onedscolprdwus23.westus.cloudapp.azure.com, umwatson.events.data.microsoft.com, ecs.office.trafficmanager.net, europe.configsvc1.live.com.akadns.net, uks-azsc-config.officeapps.live.com
Execution Graph export aborted for target Synaptics.exe, PID 7024 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
14:31:43	API Interceptor	73x Sleep call for process: Synaptics.exe modified
14:32:04	API Interceptor	1x Sleep call for process: WerFault.exe modified
19:31:36	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver C:\ProgramData\Synaptics\Synaptics.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
69.42.215.252	file.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	file.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	file.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	file.exe	Get hash	malicious	AsyncRAT, XRed, XWorm	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	Open Purchase Order Summary Details-16-12-2024.vbs	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	Open Purchase Order Summary Sheet.vbs	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	Purchase Order Summary Details.vbs	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	Purchase Order Summary Details.vbs	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	xyxmml.msi	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	valyzt.msi	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	file.exe	Get hash	malicious	XRed	Browse	13.107.246.45
	file.exe	Get hash	malicious	XRed	Browse	13.107.246.45
	file.exe	Get hash	malicious	XRed	Browse	13.107.246.45
	file.exe	Get hash	malicious	Xmrig	Browse	13.107.246.45
	file.exe	Get hash	malicious	AsyncRAT, XRed, XWorm	Browse	13.107.246.45
	https://gldkzr-lpqw.buzz/script/ut.js?cb%5C=1735764124690	Get hash	malicious	Unknown	Browse	13.107.246.45
	Bootxr.exe	Get hash	malicious	Xmrig	Browse	13.107.246.45
	cici.exe	Get hash	malicious	RedLine	Browse	13.107.246.45
	intro.avi.exe	Get hash	malicious	Quasar	Browse	13.107.246.45
	random(6).exe	Get hash	malicious	Stealc	Browse	13.107.246.45
freedns.afraid.org	file.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	file.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	file.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	file.exe	Get hash	malicious	AsyncRAT, XRed, XWorm	Browse	69.42.215.252
	Open Purchase Order Summary Details-16-12-2024.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	Open Purchase Order Summary Sheet.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	Purchase Order Summary Details.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	Purchase Order Summary Details.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	xyxmml.msi	Get hash	malicious	XRed	Browse	69.42.215.252
	valyzt.msi	Get hash	malicious	XRed	Browse	69.42.215.252

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AWKNET-LLCUS	file.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	file.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	file.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	file.exe	Get hash	malicious	AsyncRAT, XRed, XWorm	Browse	69.42.215.252
	Open Purchase Order Summary Details-16-12-2024.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	Open Purchase Order Summary Sheet.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	Purchase Order Summary Details.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	Purchase Order Summary Details.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	xyxmml.msi	Get hash	malicious	XRed	Browse	69.42.215.252
	valyzt.msi	Get hash	malicious	XRed	Browse	69.42.215.252

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	XRed	Browse	142.250.186.161 142.250.185.110
	file.exe	Get hash	malicious	XRed	Browse	142.250.186.161 142.250.185.110
	file.exe	Get hash	malicious	XRed	Browse	142.250.186.161 142.250.185.110
	file.exe	Get hash	malicious	AsyncRAT, XRed, XWorm	Browse	142.250.186.161 142.250.185.110
	MDE_File_Sample_017466bb6ff6d1b5b887f00b4b0a959ffc026bdb.zip	Get hash	malicious	Unknown	Browse	142.250.186.161 142.250.185.110
	MDE_File_Sample_017466bb6ff6d1b5b887f00b4b0a959ffc026bdb.zip	Get hash	malicious	Unknown	Browse	142.250.186.161 142.250.185.110
	Setup.exe.7z	Get hash	malicious	Unknown	Browse	142.250.186.161 142.250.185.110
	45631.exe	Get hash	malicious	Nitol	Browse	142.250.186.161 142.250.185.110
	45631.exe	Get hash	malicious	Unknown	Browse	142.250.186.161 142.250.185.110

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\Synaptics\RCXF921.tmp	LisectAVT_2403002A_282.exe	Get hash	malicious	XRed	Browse
C:\ProgramData\Synaptics\RCXF921.tmp	LisectAVT_2403002A_282.exe	Get hash	malicious	XRed	Browse
C:\Users\user\Documents\DVWHKMNFNN\~$cache1	LisectAVT_2403002A_282.exe	Get hash	malicious	XRed	Browse
C:\Users\user\Documents\DVWHKMNFNN\~$cache1	LisectAVT_2403002A_282.exe	Get hash	malicious	XRed	Browse

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Synaptics.exe_e414f81240f997f5a80d55495c221b9a78d76_455b7b6e_3401f65f-614f-49a0-a45f-984c9017e37e\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1337305327688885
Encrypted:	false
SSDEEP:	192:gVFlB3Vps3ImZ0NVEHYDzJDzqjG7A/ytzxwzuiF4OZ24IO8EKDzy:Oy3QNVEHYJqjMKzuiF4OY4IO8zy
MD5:	8F1E5AE0C7CB756895FDAF5441520367
SHA1:	A9FDD830EC9319A8595E4082FEF5CBE17597C9ED
SHA-256:	3C43A0CCFD6F78FE2FB692FFACDC5E90AB08E52FF5EC17C6AFD2F59B0BB5383E
SHA-512:	7EBE5F674EBC7020E7F8E1FA9129E4EA6AFD30F0254A3BE8D66AD6DA00A7B2DEE3C7F09D36A2A7482C226DA59CBB627FD37A613DCD08DCC2DF266745FC5B3006
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.0.3.1.9.9.1.2.3.9.0.4.3.9.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.0.3.1.9.9.1.5.3.5.9.1.8.9.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.4.0.1.f.6.5.f.-.6.1.4.f.-.4.9.a.0.-.a.4.5.f.-.9.8.4.c.9.0.1.7.e.3.7.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.c.6.2.c.e.8.9.-.5.a.f.c.-.4.6.c.b.-.b.3.4.5.-.7.9.f.6.c.b.8.2.8.f.0.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.y.n.a.p.t.i.c.s...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.7.0.-.0.0.0.1.-.0.0.1.4.-.8.9.d.3.-.2.5.f.0.4.c.5.d.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.9.9.a.1.3.7.d.5.9.3.d.d.a.9.d.1.5.8.d.c.8.b.6.b.7.7.2.0.d.e.b.0.0.0.0.1.f.0.4.!.0.0.0.0.8.a.4.0.e.8.2.8.2.2.4.f.2.2.3.6.1.b.0.9.4.9.4.a.5.5.6.a.2.0.d.b.8.2.f.c.9.7.b.9.!.S.y.n.a.p.t.i.c.s...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER37A1.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Jan 2 19:31:52 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	1785880
Entropy (8bit):	1.7172558685985042
Encrypted:	false
SSDEEP:	3072:GwD+ljXKtTC6gYsef5UiO6gjqKdhhgmKF+NgJwIGJHPp+wwP0Wqs4yBSqMv1mm:Gw00gYsSUj6gj7g7qYI+2h
MD5:	4810CF8C960B650EC7B124C094EEE0F9
SHA1:	E62FA66C6E240DED44FF6505B8257AEEF2142929
SHA-256:	255233F4925CBA0B940B95E432EC3B8FB84C04BAD7EF6FE75421B4B9209767DB
SHA-512:	6F7229D355E54E02B433810519BE56196CA58F6A05CE3DCA1C052B29D7E2CA78D74AF90DB2D861851DE24FB238C7853BE844FB18ADFEC85372BEB2511A5B33C9
Malicious:	false
Preview:	MDMP..a..... .........vg....................................$....6......t(.../..........`.......8...........T...........h................6...........8..............................................................................eJ......(9......GenuineIntel............T.......p.....vg.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER427F.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6316
Entropy (8bit):	3.7118540049421243
Encrypted:	false
SSDEEP:	192:R6l7wVeJUxz6pYiS5xqlpr+89bOtsfC6m:R6lXJs6pYRxqvOmfm
MD5:	64819414E0D5E05EADB4FB0F3E182585
SHA1:	23A28ED79CFB3F729D604CF0A902CD3535EB4DB1
SHA-256:	97F2C0B939EB42A1A21D7B57A2FBA3FE1F90953A9B894559369E3D53C91A1B6C
SHA-512:	0DB3335D38A8C9CDECD451AF2EE8CB7990A015AEC89F7C3188E2EC43D1F641C50E9904F778BDBC4D4B0E5DBCA77A77DA595EF8F1EE4F3D2411407478ADF85C44
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.0.2.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER42A0.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4572
Entropy (8bit):	4.440966399597392
Encrypted:	false
SSDEEP:	48:cvIwWl8zs3Jg77aI91yWpW8VYmkYm8M4JFo6FHo+q84kz+5CQNZAd:uIjfZI73T7VNRJBotCQNZAd
MD5:	7B4356588B197CCDA5D0725F40E6DE64
SHA1:	9380094470BF098C303080DA60123ED76EB749BF
SHA-256:	C16345CB828EBC3C802CEA17E320CFCD9A12C3FA8083DB04E47C9064309EED49
SHA-512:	88FD3F190A0462512BEDA1890987DF41D2A18C92C85BFAC966F869BFBD95D14948F3AFDBEEC386DE2951A6D08B0FA1D5965587BBD934DF0AB782B5BE3E2D6FE3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="658714" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Synaptics\RCXF921.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	771584
Entropy (8bit):	6.636362882247521
Encrypted:	false
SSDEEP:	12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9IFr:ansJ39LyjbJkQFMhmC+6GD92
MD5:	B753207B14C635F29B2ABF64F603570A
SHA1:	8A40E828224F22361B09494A556A20DB82FC97B9
SHA-256:	7F16106F3354A65FC749737905B77DF7BBEFA28BF8BBC966DC1F8C53FA4660F2
SHA-512:	0DD32803B95D53BADD33C0C84DF1002451090FF5F74736680E3A53A0BFC0E723EEE7D795626BC10A1FB431DE7E6E276C5A66349EF385A8B92B48425B0BDD036F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\RCXF921.tmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\RCXF921.tmp, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Joe Sandbox View:	Filename: LisectAVT_2403002A_282.exe, Detection: malicious, Browse Filename: LisectAVT_2403002A_282.exe, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................&....................@.......................... ...................@..............................B...........................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Synaptics\Synaptics.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15745536
Entropy (8bit):	7.978966950180418
Encrypted:	false
SSDEEP:	393216:EU5lptVYmfr7yBG/4WoI+j6LTinXKSf0fzTDvD:v7pttD7yBG/uljIinXj0fX
MD5:	7E33585D157419E39FB4D232C9F0C5DC
SHA1:	1CF4864A9B009E12534CC299C14466F2B2C9CEA3
SHA-256:	027A4BAF9864A23FE09D99BE3A6F83D1841E47AAC2F94D313D2580E84D1B1B39
SHA-512:	3ABCB07CDDE6D8014149E5AD9C07F1AFAA88D4A8FB85A67E6F0514EC613ADA145DDA81713DD96BA0A91F056D65919820B24C6BF2232D59E7FDC6D27F86B01036
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B..........................................@..............................................@..............................B......x....................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...x...........................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Synaptics\Synaptics.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\GYA7zi3n.xlsm

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	18387
Entropy (8bit):	7.523057953697544
Encrypted:	false
SSDEEP:	384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5:	E566FC53051035E1E6FD0ED1823DE0F9
SHA1:	00BC96C48B98676ECD67E81A6F1D7754E4156044
SHA-256:	8E574B4AE6502230C0829E2319A6C146AEBD51B7008BF5BBFB731424D7952C15
SHA-512:	A12F56FF30EA35381C2B8F8AF2446CF1DAA21EE872E98CAD4B863DB060ACD4C33C5760918C277DADB7A490CB4CA2F925D59C70DC5171E16601A11BC4A6542B04
Malicious:	false
Preview:	PK..........!...5Qr...?.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-..@.5.....(..8...-.[.g.......M^..s.5.4.I..P;..!....r....}._.G.`....Y....M.7....&.m1cU..I.T.....`.t...^.Bx..r..~0x....6...`....reb2m.s.$.%...-c.{...dT.m.kL]Yj.\|..Yp..".G.......r...).#b.=.QN'...i..w.s..$3..)).....2wn..ls.F..X.D^K.......Cj.sx..E..n._ ....pjUS.9.....j..L...>".....w.... ....l{.sd...G.....wC.F... D..1<..=...z.As.]...#l..........PK..........!..U0#....L......._rels/.rels ...(...............

C:\Users\user\AppData\Local\Temp\Lmzx6kR.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.262459030514838
Encrypted:	false
SSDEEP:	24:GgsF+0uSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+l+pAZewRDK4mW
MD5:	941D070DA5BA8DA69FC9ACEE8D7AF8F9
SHA1:	AD2B444C40D23BE03219F17085B8761F5F59F7E4
SHA-256:	29C789E8E749264A10DB7B99F3A877C3C39C22E41D9C01F0E6ED9F8FB58E6394
SHA-512:	E3F4A45B13767C633A1DD8A475BF1776D486410E28679AE6E69C879D7D71D5BE90E68FDAF45AA0BD3C85B1EA811109718C71D1214FD6005D2DCB6BE0C5215D30
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="lE8ZJ4T3Oc4qLuzobzesOQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\VY7C4oG.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.255110895874364
Encrypted:	false
SSDEEP:	24:GgsF+0sSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+L+pAZewRDK4mW
MD5:	89F6C1A5F1B4C48AA4CF172A497B7139
SHA1:	E6DA1A49D5B7A327EBB9BDE5D95E54AA466D1F46
SHA-256:	DA556D7C65BE76CA307C03855B369225B9FF73EFBDDB5B93B97D523EE1E10B44
SHA-512:	104609CC864E07531A86E6CC78A78130E80A359F745FF1234632490A97681478ADAE8DC27AFC6012B6408C1F9CAEA180EB13E4230D4D42A909022FB8D290958B
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="uquv7Wqx3wxQ4n0FxFU2tQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\VjDzw1d.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.265477198411406
Encrypted:	false
SSDEEP:	24:GgsF+0atSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+7t+pAZewRDK4mW
MD5:	82D3362F6E3EADA9FDF97E159501239F
SHA1:	ACC2B12957E2764666AF0C377D8EE4084FFA79A1
SHA-256:	29EC25CB6B931945DDB6CE6BC7F7F7BBC8A421061A7E0ED7305815F37BAF09DB
SHA-512:	C4268539086C313DB6BFE1E27412FDCEC9EF5A54BD6492B303729650EA982A3DE44632D92CE6B5DF8F9347AE8A831E958F60171F354CA7237895939D57D6A36F
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="MBuBCUi1V99eQA98aqed5Q">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20250102143135.log

Download File

Process:	C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4959
Entropy (8bit):	5.446924955308084
Encrypted:	false
SSDEEP:	96:BdyhuMD2+aXnotf1n1F1C1q1x1f1E1m0zg+qbFZbU0bAYZSBKn/:PVRXnA1n1F1C1q1x1f1E1m7/
MD5:	8F2D0632D7DF2F5ED39AEF9001DAF98F
SHA1:	BDAB334BA5805F1EA784B53B9B5B97DDA27E3B05
SHA-256:	ACFF88DD426C16C1D9B8CF9D8D1E6508F4B2D2E93DAD7BCB4866F9E930E4BC17
SHA-512:	9BB5B7C557901D53B7556A6C0B3E443979221B68C609DF89C3B584425A7738B68B483BE2B18E42B029A8A8B3CC4DD4F66239E8FDF0E0DA6ADC19D7EEEDB3DD3E
Malicious:	false
Preview:	[0648:143C][2025-01-02T14:31:34]i001: Burn v3.10.4.4718, Windows v10.0 (Build 19045: Service Pack 0), path: C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe..[0648:143C][2025-01-02T14:31:34]i009: Command Line: '-burn.clean.room=C:\Users\user\Desktop\._cache_file.exe -burn.filehandle.attached=544 -burn.filehandle.self=648'..[0648:143C][2025-01-02T14:31:34]i000: Setting string variable 'WixBundleOriginalSource' to value 'C:\Users\user\Desktop\._cache_file.exe'..[0648:143C][2025-01-02T14:31:34]i000: Setting string variable 'WixBundleOriginalSourceFolder' to value 'C:\Users\user\Desktop\'..[0648:143C][2025-01-02T14:31:35]i000: Setting string variable 'WixBundleLog' to value 'C:\Users\user\AppData\Local\Temp\dd_vcredist_amd64_20250102143135.log'..[0648:143C][2025-01-02T14:31:35]i000: Setting string variable 'WixBundleName' to value 'Microsoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508'..[0648:143C][2025-01-02T14:31:35]i000: Setting string variabl

C:\Users\user\AppData\Local\Temp\gp9YKtp.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.262397097663536
Encrypted:	false
SSDEEP:	24:GgsF+0QGSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+tG+pAZewRDK4mW
MD5:	0FCD188185F27E439141F0A6A640AA6B
SHA1:	5E7DE80450CA22BE223BA84FDC5A0BF30A82B6F4
SHA-256:	3DED1B6FB60DC49358D14762A679F7D1C5BEE80218D58704266FE990D7B61CD9
SHA-512:	E6E482670696A6E19BF9F1E38B2B3C41A98FDF32EF2F041C6C902AD26E8B308A10F0F863FE838E06E9D1FD200988E50F33ED45FA340981B183CCFC2847B8CB1A
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="JrK0lrb4CRWwYanu6y37QA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\nuBx2Yl.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.270114392047408
Encrypted:	false
SSDEEP:	24:GgsF+0kKSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+PK+pAZewRDK4mW
MD5:	8E5CD64A2B14464B62B268B49AB4AEFE
SHA1:	F75DC952FC7FE2B4C32F54018B250D85A1FB6036
SHA-256:	98239662949080E5D845EAE7166C28D91379C3E86D8CEF4173AE6BFEAF6445E9
SHA-512:	50194DE6EF9B04169016B15ECD29A1D10D08BB86B5D16BED309D283DA269FB512EB83456FF91D0A33F6B1AFE26C05C119DCE55CDCAC6B0440C460FA354600F36
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="EETm-UK1SyJ2pD0AXzaZzA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\p57BtvQ.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.259014296237943
Encrypted:	false
SSDEEP:	24:GgsF+0EESU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+fE+pAZewRDK4mW
MD5:	FB291A0C944FEBE233B6058A2801F7E9
SHA1:	A4FA8CA3A71A5CC096D99B53E00FBD8A909E57C3
SHA-256:	7596696999A2BDC993EF86EC42FA3F9FB1C15AB9ABA3095265597D9AB43C79A2
SHA-512:	F952E30CF740494F3D94D67D03D5AF48DA720A89EBC63F16C5F947319353A2B232FA51E0666CA15BC01435696BE5172F9CFE0711A64B256EAB8622E2C5BF418F
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="TYBr8imabdDZCYiGy5xaNQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\qZpYAFw.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.259141145558352
Encrypted:	false
SSDEEP:	24:GgsF+0FSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+C+pAZewRDK4mW
MD5:	CCB3428048FB86402A49BAC1E1ECC98F
SHA1:	8E1117A86F28D2A2013951030CFC6EF0443E48B7
SHA-256:	C7B261FCF63A995233A76B1DD9A8C6109386D44B1448866A8EF2E2EC638661DA
SHA-512:	7E549B1807E528C670A67E428747C9C7985B51778FD34EAC76D80E5AB4DDC9F78F5E3316A763AE9332B403CBFDEF49550AC7801BF8BA79A9B992C38F42C7A570
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="15yVPXfb1EEv690p0WmLhg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\xxTzGTd.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.257241010036757
Encrypted:	false
SSDEEP:	24:GgsF+0HTSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+U+pAZewRDK4mW
MD5:	E20669107055AAB31B0BCB5A738CA2E7
SHA1:	A92C29DBA59B5CC8C34FE0F2B58958CAB4E53AFD
SHA-256:	B76519BCC03CAAD9F72FCD0837C5B11E6906B369C6B345BF1F2594F903E46527
SHA-512:	1344FDD851A259930434FC5154D6B07357FF3055C4ABDDD7C60A74256D591297A42395692DD554FE9B8D82916ED8DAF4C50CCB523D9AC59153B17A1B4CF27228
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="wsehkqP3VvLB1t8Z4irLoA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\~$GYA7zi3n.xlsm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:KVC+cAmltV:KVC+cR
MD5:	9C7132B2A8CABF27097749F4D8447635
SHA1:	71D7F78718A7AFC3EAB22ED395321F6CBE2F9899
SHA-256:	7029AE5479F0CD98D892F570A22B2AE8302747DCFF3465B2DE64D974AE815A83
SHA-512:	333AC8A4987CC7DF5981AE81238A77D123996DB2C4C97053E8BD2048A64FDCF33E1245DEE6839358161F6B5EEA6BFD8D2358BC4A9188D786295C22F79E2D635E
Malicious:	false
Preview:	.user ..j.o.n.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\~DF14B36B4C80923270.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.746897789531007
Encrypted:	false
SSDEEP:	192:QuY+pHkfpPr76TWiu0FPZK3rcd5kM7f+ihdCF3EiRcx+NSt0ckBCecUSaFUH:ZZpEhSTWi/ekfzaVNg0c4gU
MD5:	7426F318A20A187D88A6EC88BBB53BAF
SHA1:	4F2C80834F4B5C9FCF6F4B1D4BF82C9F7CCB92CA
SHA-256:	9AF85C0291203D0F536AA3F4CB7D5FBD4554B331BF4254A6ECD99FE419217830
SHA-512:	EC7BAA93D8E3ACC738883BAA5AEDF22137C26330179164C8FCE7D7F578C552119F58573D941B7BEFC4E6848C0ADEEF358B929A733867923EE31CD2717BE20B80
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\._cache_file.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14974024
Entropy (8bit):	7.995870107606645
Encrypted:	true
SSDEEP:	393216:q5lptVYmfr7yBG/4WoI+j6LTinXKSf0fzTDv8:q7pttD7yBG/uljIinXj0fQ
MD5:	F0248D477E74687C5619AE16498B13D4
SHA1:	9ED4B091148C9B53F66B3F2C69BE7E60E74C486A
SHA-256:	B6C82087A2C443DB859FDBEAAE7F46244D06C3F2A7F71C35E50358066253DE52
SHA-512:	0C373B06FFE84F3E803831E90F22D7D73304E47A47839DB614F63399FF1B7FCF33153BF3D23998877C96D2A75E316291A219FDD12358CA48928526284B802591
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c...'.u.'.u.'.u.......u.....[.u.....?.u...v.4.u...q.4.u...p...u.....".u....6.u.'.t.v.u...p.l.u....&.u.'..%.u...w.&.u.Rich'.u.........................PE..L......Z.....................v......m.............@..........................p............@..............................................;..........@:...B...0...=.. t..T...................tt......@n..@...................$........................text.............................. ..`.rdata..............................@..@.data...@...........................@....wixburn8...........................@..@.tls................................@....gfids..............................@..@.rsrc....;.......<..................@..@.reloc...=...0...>..................@..B........................................................................................................................................................

C:\Users\user\Documents\DVWHKMNFNN\WUTJSCBCFX.xlsm

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	18387
Entropy (8bit):	7.523057953697544
Encrypted:	false
SSDEEP:	384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5:	E566FC53051035E1E6FD0ED1823DE0F9
SHA1:	00BC96C48B98676ECD67E81A6F1D7754E4156044
SHA-256:	8E574B4AE6502230C0829E2319A6C146AEBD51B7008BF5BBFB731424D7952C15
SHA-512:	A12F56FF30EA35381C2B8F8AF2446CF1DAA21EE872E98CAD4B863DB060ACD4C33C5760918C277DADB7A490CB4CA2F925D59C70DC5171E16601A11BC4A6542B04
Malicious:	false
Preview:	PK..........!...5Qr...?.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-..@.5.....(..8...-.[.g.......M^..s.5.4.I..P;..!....r....}._.G.`....Y....M.7....&.m1cU..I.T.....`.t...^.Bx..r..~0x....6...`....reb2m.s.$.%...-c.{...dT.m.kL]Yj.\|..Yp..".G.......r...).#b.=.QN'...i..w.s..$3..)).....2wn..ls.F..X.D^K.......Cj.sx..E..n._ ....pjUS.9.....j..L...>".....w.... ....l{.sd...G.....wC.F... D..1<..=...z.As.]...#l..........PK..........!..U0#....L......._rels/.rels ...(...............

C:\Users\user\Documents\DVWHKMNFNN\~$WUTJSCBCFX.xlsx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:KVC+cAmltV:KVC+cR
MD5:	9C7132B2A8CABF27097749F4D8447635
SHA1:	71D7F78718A7AFC3EAB22ED395321F6CBE2F9899
SHA-256:	7029AE5479F0CD98D892F570A22B2AE8302747DCFF3465B2DE64D974AE815A83
SHA-512:	333AC8A4987CC7DF5981AE81238A77D123996DB2C4C97053E8BD2048A64FDCF33E1245DEE6839358161F6B5EEA6BFD8D2358BC4A9188D786295C22F79E2D635E
Malicious:	false
Preview:	.user ..j.o.n.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\Documents\DVWHKMNFNN\~$cache1

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	771584
Entropy (8bit):	6.636362882247521
Encrypted:	false
SSDEEP:	12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9IFr:ansJ39LyjbJkQFMhmC+6GD92
MD5:	B753207B14C635F29B2ABF64F603570A
SHA1:	8A40E828224F22361B09494A556A20DB82FC97B9
SHA-256:	7F16106F3354A65FC749737905B77DF7BBEFA28BF8BBC966DC1F8C53FA4660F2
SHA-512:	0DD32803B95D53BADD33C0C84DF1002451090FF5F74736680E3A53A0BFC0E723EEE7D795626BC10A1FB431DE7E6E276C5A66349EF385A8B92B48425B0BDD036F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Users\user\Documents\DVWHKMNFNN\~$cache1, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\Documents\DVWHKMNFNN\~$cache1, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Joe Sandbox View:	Filename: LisectAVT_2403002A_282.exe, Detection: malicious, Browse Filename: LisectAVT_2403002A_282.exe, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................&....................@.......................... ...................@..............................B...........................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1028\license.rtf

Download File

Process:	C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	18127
Entropy (8bit):	4.036737741619669
Encrypted:	false
SSDEEP:	192:xaz+aCQbjdBCLCgfvtfLEmmVxJzLKLIW7cBFCoSM0fvJ93eyryH1MqG1xcRY/c5f:seh/IMHexG4q2
MD5:	B7F65A3A169484D21FA075CCA79083ED
SHA1:	5DBFA18928529A798FF84C14FD333CB08B3377C0
SHA-256:	32585B93E69272B6D42DAC718E04D954769FE31AC9217C6431510E9EEAD78C49
SHA-512:	EDA2F946C2E35464E4272B1C3E4A8DC5F17093C05DAB9A685DBEFD5A870B9D872D8A1645ED6F5B9A72BBB2A59D22DFA58FBF420F6440278CCBE07B6D0555C283
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset134 SimSun;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 MICROSOFT \f1\'dc\'9b\'f3\'77\'ca\'da\'99\'e0\'97\'6c\'bf\'ee\f0\par..MICROSOFT VISUAL C++ 2019 RUNTIME \par..\b0\f1\'b1\'be\'ca\'da\'99\'e0\'97\'6c\'bf\'ee\'ca\'c7\'d9\'46\'d3\'c3\'91\'f4\'c5\'63\f0 Microsoft Corporation (\f1\'bb\'f2\'c6\'e4\'ea\'50\'82\'53\'c6\'f3\'98\'49\'a3\'ac\'d2\'95\'d9\'46\'d3\'c3\'91\'f4\'cb\'f9\'be\'d3\'d7\'a1\'b5\'c4\'b5\'d8\'fc\'63\'b6\'f8\'b6\'a8\f0 ) \f1\'d6\'ae\'e9\'67\'b3\'c9\'c1\'a2\'b5\'c4\'ba\'cf\'bc\'73\'a1\'a3\'cb\'fb\'82\'83\'df\'6d\'d3\'c3\'ec\'b6\'c9\'cf\'ca\'f6\'dc\'9b\'f3\'77\'a3\'ac\'b1\'be\'ca\'da\'99\'e0\'97\'6c\'bf\'ee\'d2\'e0\'df\'6d\'d3\'c3\'ec\'b6\'c8\'ce\'ba\'ce\f0 Microsoft \f1\'b7\'fe\'84\'d5\'bb\'f2\'b1\'be\'dc\'9b\'f3\'77\'d6\'ae\'b8\'fc\'d0\'c2\'a3

C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1028\thm.wxl

Download File

Process:	C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	6.163758160900388
Encrypted:	false
SSDEEP:	48:c5DiTlOtMes9T/JhDXsA9EHSniarRFeOrw8N3mZNNTN2N08CEjMUWFPmDlTKJKy2:uDiTlFrDDsA9tfHP8+8nhM0WamzqDFqD
MD5:	472ABBEDCBAD24DBA5B5F5E8D02C340F
SHA1:	974F62B5C2E149C3879DD16E5A9DBB9406C3DB85
SHA-256:	8E2E660DFB66CB453E17F1B6991799678B1C8B350A55F9EBE2BA0028018A15AD
SHA-512:	676E29378AAED25DE6008D213EFA10D1F5AAD107833E218D71F697E728B7B5B57DE42E7A910F121948D7B1B47AB4F7AE63F71196C747E8AE2B4827F754FC2699
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] ....</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">....</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - ................. ......................../passive \| /quiet - .... UI ........... UI.... ........... UI ........../norestart - ................UI ............./log log.txt - .........

C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1029\license.rtf

Download File

Process:	C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	13053
Entropy (8bit):	5.125552901367032
Encrypted:	false
SSDEEP:	192:TKwfs7OUpXLa5HEXQwNCNvZSjotXxiwH++3kamdEj6ZDbugDHgbGNlv6NbrYGY9x:Lfs7c5DRH0aHmJGpafU0AliwGra2
MD5:	B408556A89FCE3B47CD61302ECA64AC9
SHA1:	AAC1CDAF085162EFF5EAABF562452C93B73370CB
SHA-256:	21DDCBB0B0860E15FF9294CBB3C4E25B1FE48619210B8A1FDEC90BDCDC8C04BC
SHA-512:	BDE33918E68388C60750C964CDC213EC069CE1F6430C2AA7CF1626E6785C7C865094E59420D00026918E04B9B8D19FA22AC440F851ADC360759977676F8891E7
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset238 Tahoma;}{\f2\fnil\fcharset0 Garamond;}{\f3\fnil Tahoma;}{\f4\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\*\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 LICEN\f1\'c8N\f0\'cd PODM\'cdNKY PRO SOFTWARE SPOLE\f1\'c8NOSTI MICROSOFT\par..\f0 MICROSOFT VISUAL C++ 2019 RUNTIME \par..\b0 Tyto licen\f1\'e8n\f0\'ed podm\'ednky p\f1\'f8edstavuj\f0\'ed smlouvu mezi spole\f1\'e8nost\f0\'ed Microsoft Corporation (nebo n\f1\'eckterou z\~jej\f0\'edch afilac\'ed v\~z\'e1vislosti na tom, kde bydl\'edte) a\~v\'e1mi. Vztahuj\'ed se na v\'fd\f1\'9ae uveden\f0\'fd software. Podm\'ednky se rovn\f1\'ec\'9e vztahuj\f0\'ed na jak\'e9koli slu\f1\'9eby Microsoft nebo aktualizace pro software, pokud se na slu\'9eby nebo aktualizace nevztahuj\f0\'ed odli\f1\'9an\f0\'e9 podm\'ednky.\par..\b DODR\f1\'8e\f0\'cdTE-LI TYTO

C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1029\thm.wxl

Download File

Process:	C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3333
Entropy (8bit):	5.370651462060085
Encrypted:	false
SSDEEP:	48:c5DiTlOtesM6H2hDdxHOjZxsaIIy3Iy5sDMN3mkNFN7NwcfiPc3hKPnWZLF0hKqZ:uDiTlVxxHOy/9xXfpZJYnL8xK2S
MD5:	16343005D29EC431891B02F048C7F581
SHA1:	85A14C40C482D9351271F6119D272D19407C3CE9
SHA-256:	07FB3EC174F25DFBE532D9D739234D9DFDA8E9D34F01FE660C5B4D56989FA779
SHA-512:	FF1AE9C21DCFB018DD4EC82A6D43362CB8C591E21F45DD1C25955D83D328B57C8D454BBE33FBC73A70DADF1DFB3AE27502C9B3A8A3FF2DA97085CA0D9A68AB03
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Instala.n. program [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Opravdu chcete akci zru.it?</String>.. <String Id="HelpHeader">N.pov.da nastaven.</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [adres..] . Nainstaluje, oprav., odinstaluje nebo.. vytvo.. .plnou m.stn. kopii svazku v adres..i. V.choz. mo.nost. je instalace...../passive \| /quiet . Zobraz. minim.ln. u.ivatelsk. rozhran. bez v.zev nebo nezobraz. ..dn. u.ivatelsk. rozhran. a.. ..dn. v.zvy. V.choz. mo.nost. je zobrazen. u.ivatelsk.ho rozhran. a v.ech v.zev...../noresta

C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1031\license.rtf

Download File

Process:	C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	11936
Entropy (8bit):	5.194264396634094
Encrypted:	false
SSDEEP:	192:+XkOmRUOl6WBsl4kA+sn+mvtI0qHl4qj+iPqk6kVV9iX9GzYNvQ8yOejIpRMrhC2:DDHMFPCeV3i4zOHyOejIpkC2
MD5:	C2CFA4CE43DFF1FCD200EDD2B1212F0A
SHA1:	E8286E843192802E5EBF1BE67AE30BCAD75AC4BB
SHA-256:	F861DB23B972FAAA54520558810387D742878947057CF853DC74E5F6432E6A1B
SHA-512:	6FDF02A2DC9EF10DD52404F19C300429E7EA40469F00A43CA627F3B7F3868D1724450F99C65B70B9B7B1F2E1FA9D62B8BE1833A8C5AA3CD31C940459F359F30B
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil Tahoma;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 MICROSOFT-SOFTWARE-LIZENZBESTIMMUNGEN\par..MICROSOFT VISUAL C++ 2019 RUNTIME \par..\b0 Diese Lizenzbestimmungen sind ein Vertrag zwischen Ihnen und der Microsoft Corporation (bzw. abh\'e4ngig von Ihrem Wohnsitz einem mit Microsoft verbundenen Unternehmen). Sie gelten f\'fcr die oben angef\'fchrte Software. Die Bestimmungen gelten ebenso f\'fcr jegliche von Microsoft angebotenen Dienste oder Updates f\'fcr die Software, sofern diesen keine anderen Bestimmungen beiliegen.\par..\b SOFERN SIE DIESE LIZENZBESTIMMUNGEN EINHALTEN, SIND SIE ZU FOLGENDEM BERECHTIGT:\par....\pard{\pntext\f2\'B7\tab}{\\pn\pnlvlblt\pnf2\pnindent360{\pntxtb\'B7}}\fi-357\li357\sb120\sa120\sl240\slmult1\tx360 RECHTE ZUR INSTALLATION UND NUTZUNG. \

C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1031\thm.wxl

Download File

Process:	C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3379
Entropy (8bit):	5.094097800535488
Encrypted:	false
SSDEEP:	48:c5DiTlOZuesXJhDEVTORNxSMoZN3mteNSiNGNsZuiAXEqicMwhPXbhu9KwKlK8Kq:uDiTl3N7xSbu0N8+AhSNnm
MD5:	561F3F32DB2453647D1992D4D932E872
SHA1:	109548642FB7C5CC0159BEDDBCF7752B12B264C0
SHA-256:	8E0DCA6E085744BFCBFF46F7DCBCFA6FBD722DFA52013EE8CEEAF682D7509581
SHA-512:	CEF8C80BEF8F88208E0751305DF519C3D2F1C84351A71098DC73392EC06CB61A4ACA35182A0822CF6934E8EE42196E2BCFE810CC859965A9F6F393858A1242DF
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] - Setup</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">M.chten Sie den Vorgang wirklich abbrechen?</String>.. <String Id="HelpHeader">Setup-Hilfe</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [Verzeichnis] - installiert, repariert, deinstalliert oder.. erstellt eine vollst.ndige lokale Kopie des Bundles im Verzeichnis. Installieren ist die Standardeinstellung...../passive \| /quiet - zeigt eine minimale Benutzeroberfl.che ohne Eingabeaufforderungen oder keine.. Benutzeroberfl.che und keine Eingabeaufforderungen an. Standardm..ig werden die Benutzeroberfl.che und alle Eingab

C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1036\license.rtf

Download File

Process:	C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	11593
Entropy (8bit):	5.106817099949188
Encrypted:	false
SSDEEP:	192:aRAbNYjVk+z5GUSLse5GgALEXmAWL+/3FEShP9sJgi8+Ra8woh+89EQdhwQPely6:K4yrPqm9LcVEg9sVp2ohHVdKoXJXci9a
MD5:	F0FF747B85B1088A317399B0E11D2101
SHA1:	F13902A39CEAE703A4713AC883D55CFEE5F1876C
SHA-256:	4D9B7F06BE847E9E135AB3373F381ED7A841E51631E3C2D16E5C40B535DA3BCF
SHA-512:	AA850F05571FFC361A764A14CA9C1A465E2646A8307DEEE0589852E6ACC61AF145AEF26B502835724D7245900F9F0D441451DD8C055404788CE64415F5B79506
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 TERMES DU CONTRAT DE LICENCE LOGICIEL MICROSOFT\par..MICROSOFT VISUAL C++ 2019 RUNTIME \par..\b0 Les pr\'e9sents termes du contrat de licence constituent un contrat entre Microsoft Corporation (ou, en fonction de votre lieu de r\'e9sidence, l\rquote un de ses affili\'e9s) et vous. Ils s\rquote appliquent au logiciel vis\'e9 ci-dessus. Les termes s\rquote appliquent \'e9galement \'e0 tout service et \'e0 toute mise \'e0 jour Microsoft pour ce logiciel, \'e0 moins que d\rquote autres termes n\rquote accompagnent ces \'e9l\'e9ments.\par..\b SI VOUS VOUS CONFORMEZ AUX PR\'c9SENTS TERMES DU CONTRAT DE LICENCE, VOUS AVEZ LES DROITS CI-DESSOUS.\par....\pard{\pntext\f1\'B7\tab}{\\pn\pnlvlblt\pnf1\pnindent360{\pntxtb\'B7}}\fi-357\li357\sb120\s

C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1036\thm.wxl

Download File

Process:	C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3366
Entropy (8bit):	5.0912204406356905
Encrypted:	false
SSDEEP:	48:c5DiTlO1BesgKLhD1K8cocDSN3m4NlN2ZfNmXL8ePZFcZkLPqUf9fQKRLKeKqZfj:uDiTlABzH1/qt4qgcXY
MD5:	7B46AE8698459830A0F9116BC27DE7DF
SHA1:	D9BB14D483B88996A591392AE03E245CAE19C6C3
SHA-256:	704DDF2E60C1F292BE95C7C79EE48FE8BA8534CEB7CCF9A9EA68B1AD788AE9D4
SHA-512:	FC536DFADBCD81B42F611AC996059A6264E36ECF72A4AEE7D1E37B87AEFED290CC5251C09B68ED0C8719F655B163AD0782ACD8CE6332ED4AB4046C12D8E6DBF6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Installation de [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Voulez-vous vraiment annuler.?</String>.. <String Id="HelpHeader">Aide du programme d'installation</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - installe, r.pare, d.sinstalle ou.. cr.e une copie locale compl.te du groupe dans le r.pertoire. Install est l'option par d.faut...../passive \| /quiet - affiche une interface minimale, sans invite, ou n'affiche ni interface.. ni invite. Par d.faut, l'interface et toutes les invites sont affich.es...../norestart - supprime toutes les tentatives de red.

C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1040\license.rtf

Download File

Process:	C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	11281
Entropy (8bit):	5.046489958240229
Encrypted:	false
SSDEEP:	192:WBGNX6UXR2+5SmgS/ChMErYkQvowHVw6zdgkycEGCDLQ+n3YJ2d8XSiej+T4Ma8f:gAzSVARBR5jEPLQY3YJpSjTP2
MD5:	9D98044BAC59684489C4CF66C3B34C85
SHA1:	36AAE7F10A19D336C725CAFC8583B26D1F5E2325
SHA-256:	A3F745C01DEA84CE746BA630814E68C7C592B965B048DDC4B1BBE1D6E533BE22
SHA-512:	D849BBB6C87C182CC98C4E2314C0829BB48BAD483D0CD97BF409E75457C3695049C3A8ADFE865E1ECBC989A910096D2C1CDF333705AAC4D22025DF91B355278E
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset0 Garamond;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 CONTRATTO DI LICENZA PER IL SOFTWARE MICROSOFT\par..MICROSOFT VISUAL C++ 2019 RUNTIME \par..\b0 Le presenti condizioni di licenza costituiscono il contratto tra Microsoft Corporation (o, in base al luogo di residenza del licenziatario, una delle sue consociate) e il licenziatario, Tali condizioni si applicano al software Microsoft di cui sopra. Le condizioni si applicano inoltre a qualsiasi servizio o aggiornamento di Microsoft relativo al software, a meno che questo non sia accompagnato da condizioni differenti.\par..\b QUALORA IL LICENZIATARIO SI ATTENGA ALLE PRESENTI CONDIZIONI DI LICENZA, DISPORR\'c0 DEI DIRITTI INDICATI DI SEGUITO.\par....\pard{\pntext\f2\'B7\tab}{\\pn\pnlvlblt\p

C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1040\thm.wxl

Download File

Process:	C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3319
Entropy (8bit):	5.019774955491369
Encrypted:	false
SSDEEP:	48:c5DiTlO1eesy+hD9BOtBFv5Vo8BbQhMNDJN3msNlNohNNz+wcPclM+PAoYKp+K/u:uDiTlfQvo8WutJ/s9FHNOJp
MD5:	D90BC60FA15299925986A52861B8E5D5
SHA1:	FADFCA9AB91B1AB4BD7F76132F712357BD6DB760
SHA-256:	0C57F40CC2091554307AA8A7C35DD38E4596E9513E9EFAE00AC30498EF4E9BC2
SHA-512:	11764D0E9F286B5AA7B1A9601170833E462A93A1E569A032FCBA9879174305582BD42794D4131B83FBCFBF1CF868A8D5382B11A4BD21F0F7D9B2E87E3C708C3F
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Installazione di [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Annullare?</String>.. <String Id="HelpHeader">Guida alla configurazione</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - installa, ripara, disinstalla o.. crea una copia locale completa del bundle nella directory. L'opzione predefinita . Install...../passive \| /quiet - visualizza un'interfaccia utente minima senza prompt oppure non visualizza alcuna interfaccia utente.. n. prompt. Per impostazione predefinita viene visualizzata l'intera interfaccia utente e tutti i prompt...../norestart - annulla quals

C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1041\license.rtf

Download File

Process:	C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	28232
Entropy (8bit):	3.7669201853275722
Encrypted:	false
SSDEEP:	192:Qkb65jNkzrUJVbpEiTskXHH1AZWoJxfnVnkDYUqfQFXBue6hX2JSfR7q05kWZxhY:epCD3y/ybox2yrk2
MD5:	8C49936EC4CF0F64CA2398191C462698
SHA1:	CC069FE8F8BC3B6EE2085A4EACF40DB26C842BAC
SHA-256:	7355367B7C48F1BBACC66DFFE1D4BF016C16156D020D4156F288C2B2207ED1C2
SHA-512:	4381147FF6707C3D31C5AE591F68BC61897811112CB507831EFF5E71DD281009400EDA3300E7D3EFDE3545B89BCB71F2036F776C6FDFC73B6B2B2B8FBC084499
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset128 MS Gothic;}{\f1\fnil\fcharset0 MS Gothic;}{\f2\fnil\fcharset134 SimSun;}{\f3\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9\'83\'7d\'83\'43\'83\'4e\'83\'8d\'83\'5c\'83\'74\'83\'67 \'83\'5c\'83\'74\'83\'67\'83\'45\'83\'46\'83\'41 \'83\'89\'83\'43\'83\'5a\'83\'93\'83\'58\'8f\'f0\'8d\'80\par..\f1 MICROSOFT VISUAL C++ 2019 RUNTIME \par..\b0\f0\'96\'7b\'83\'89\'83\'43\'83\'5a\'83\'93\'83\'58\'8f\'f0\'8d\'80\'82\'cd\f2\'a1\'a2\f1 Microsoft Corporation (\f0\'82\'dc\'82\'bd\'82\'cd\'82\'a8\'8b\'71\'97\'6c\'82\'cc\'8f\'8a\'8d\'dd\'92\'6e\'82\'c9\'89\'9e\'82\'b6\'82\'c4\'82\'cd\'82\'bb\'82\'cc\'8a\'d6\'98\'41\'89\'ef\'8e\'d0) \'82\'c6\'82\'a8\'8b\'71\'97\'6c\'82\'c6\'82\'cc\'8c\'5f\'96\'f1\'82\'f0\'8d\'5c\'90\'ac\'82\'b5\'82\'dc\'82\'b7\'81\'42\'96\'7b\'83\'89\'83\'43\'83\'5a\'83\'93\'83\'58\'8f\'f0\'8

C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1041\thm.wxl

Download File

Process:	C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3959
Entropy (8bit):	5.955167044943003
Encrypted:	false
SSDEEP:	96:uDiTlDuB1n+RNmvFo6bnpojeTPk0R/vueX5OA17IHdGWz:5uB1+gD1DU4EdGE
MD5:	DC81ED54FD28FC6DB6F139C8DA1BDED6
SHA1:	9C719C32844F78AAE523ADB8EE42A54D019C2B05
SHA-256:	6B9BBF90D75CFA7D943F036C01602945FE2FA786C6173E22ACB7AFE18375C7EA
SHA-512:	FD759C42C7740EE9B42EA910D66B0FA3F813600FD29D074BB592E5E12F5EC09DB6B529680E54F7943821CEFE84CE155A151B89A355D99C25A920BF8F254AA008
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.. <Control Control="InstallButton" X="275" Y="237" Width="110" Height="23"/>.. <Control Control="UninstallButton" X="270" Y="237" Width="120" Height="23"/>.. <Control Control="RepairButton" X="187" Y="237" Width="80" Height="23"/>.. .. <String Id="Caption">[WixBundleName] .......</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">..........</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - ............ ......... .........................

C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1042\license.rtf

Download File

Process:	C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	27936
Entropy (8bit):	3.871317037004171
Encrypted:	false
SSDEEP:	384:kKIgbA2uBsarNG/HxPvCL1ewjxsXmEw4C7C7R4jAeqCBO968y7yNRylBSFfQv9yH:d3ar8Xa/XAeqoc0wfBB4qN
MD5:	184D94082717E684EAF081CEC3CBA4B1
SHA1:	960B9DA48F4CDDF29E78BBAE995B52204B26D51B
SHA-256:	A4C25DA9E3FBCED47464152C10538F16EE06D8E06BC62E1CF4808D293AA1AFA2
SHA-512:	E4016C0CA348299B5EF761F456E3B5AD9B99E5E100C07ACAB1369DFEC214E75AA88E9AD2A0952C0CC1B707E2732779E6E3810B3DA6C839F0181DC81E3560CBDA
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset129 Malgun Gothic;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 Microsoft \f1\'bc\'d2\'c7\'c1\'c6\'ae\'bf\'fe\'be\'ee\f0 \f1\'bb\'e7\'bf\'eb\'b1\'c7\f0 \f1\'b0\'e8\'be\'e0\'bc\'ad\f0\par..MICROSOFT VISUAL C++ 2019 RUNTIME \par..\b0\f1\'ba\'bb\f0 \f1\'bb\'e7\'bf\'eb\'b1\'c7\f0 \f1\'b0\'e8\'be\'e0\'c0\'ba\f0 Microsoft Corporation(\f1\'b6\'c7\'b4\'c2\f0 \f1\'b0\'c5\'c1\'d6\f0 \f1\'c1\'f6\'bf\'aa\'bf\'a1\f0 \f1\'b5\'fb\'b6\'f3\f0 \f1\'b0\'e8\'bf\'ad\'bb\'e7\f0 \f1\'c1\'df\f0 \f1\'c7\'cf\'b3\'aa\f0 )\f1\'b0\'fa\f0 \f1\'b1\'cd\'c7\'cf\f0 \f1\'b0\'a3\'bf\'a1\f0 \f1\'c3\'bc\'b0\'e1\'b5\'c7\'b4\'c2\f0 \f1\'b0\'e8\'be\'e0\'c0\'d4\'b4\'cf\'b4\'d9\f0 . \f1\'ba\'bb\f0 \f1\'c1\'b6\'b0\'c7\'c0\'ba\f0 \f1\'c0\'a7\'bf\'a1\f0 \f1\'b8\'ed\'bd\'c3\'b5\'c8\f0 \f1

C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1042\thm.wxl

Download File

Process:	C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3249
Entropy (8bit):	5.985100495461761
Encrypted:	false
SSDEEP:	48:c5DiTlO4TesKOwhDNJCkt1NhEN3m/NFNkbKNdExpVgUnqx6IPaRc0KoUK9TKz0KR:uDiTlUJJCsgqf6YVoz4uU5vI54U5TY
MD5:	B3399648C2F30930487F20B50378CEC1
SHA1:	CA7BDAB3BFEF89F6FA3C4AAF39A165D14069FC3D
SHA-256:	AD7608B87A7135F408ABF54A897A0F0920080F76013314B00D301D6264AE90B2
SHA-512:	C5B0ECF11F6DADF2E68BC3AA29CC8B24C0158DAE61FE488042D1105341773166C9EBABE43B2AF691AD4D4B458BF4A4BF9689C5722C536439CA3CDC84C0825965
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] .. ....</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">........?</String>.. <String Id="HelpHeader">.. ...</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - ..... ... .. .. .... .., .., .. .... ...... ... .........../passive \| /quiet - .... .. .. UI. ..... UI ... ..... .... ..... ..... UI. .. ..... ........../norestart - .. .... .. .... ...

C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1045\license.rtf

Download File

Process:	C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	13265
Entropy (8bit):	5.358483628484379
Encrypted:	false
SSDEEP:	192:TKpWRd0NE41Y/od7V/sHFos7YLQY9DbLM5D+Vw1VAOb0P4/sHLS7VHwHMPw95a+Q:uy0CG9KZ7qQCw1VAOZ/sHOJfcY2wf6p2
MD5:	5B9DF97FC98938BF2936437430E31ECA
SHA1:	AB1DA8FECDF85CF487709774033F5B4B79DFF8DE
SHA-256:	8CB5EB330AA07ACCD6D1C8961F715F66A4F3D69FB291765F8D9F1850105AF617
SHA-512:	4EF61A484DF85C487BE326AB4F95870813B9D0644DF788CE22D3BEB6E062CDF80732CB0B77FCDA5D4C951A0D67AECF8F5DCD94EA6FA028CFCA11D85AA97714E3
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset238 Tahoma;}{\f2\fnil\fcharset0 Garamond;}{\f3\fnil Tahoma;}{\f4\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\*\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 POSTANOWIENIA LICENCYJNE DOTYCZ\f1\'a5CE OPROGRAMOWANIA\par..\f0 MICROSOFT VISUAL C++ 2019 RUNTIME \par..\b0 Niniejsze postanowienia licencyjne stanowi\f1\'b9 umow\'ea mi\'eadzy Microsoft Corporation (lub, w\~zale\'bfno\'9cci od miejsca zamieszkania Licencjobiorcy, jednym z\~podmiot\f0\'f3w stowarzyszonych Microsoft Corporation) a\~Licencjobiorc\f1\'b9. Maj\'b9 one zastosowanie do wskazanego powy\'bfej oprogramowania. Niniejsze postanowienia maj\'b9 r\f0\'f3wnie\f1\'bf zastosowanie do wszelkich us\'b3ug i aktualizacji Microsoft dla niniejszego oprogramowania, z wyj\'b9tkiem tych, kt\f0\'f3rym towarzysz\f1\'b9 inne postanowienia.\par..\b\

C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1045\thm.wxl

Download File

Process:	C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3212
Entropy (8bit):	5.268378763359481
Encrypted:	false
SSDEEP:	48:c5DiTlOPesar4hDo7zGriQjDCN3mDNN0NrsNGl3vxkIP2hUdKLK0KbK4n6W0sfNM:uDiTlusPGriQw8n2rOij4JsU
MD5:	15172EAF5C2C2E2B008DE04A250A62A1
SHA1:	ED60F870C473EE87DF39D1584880D964796E6888
SHA-256:	440B309FCDF61FFC03B269FE3815C60CB52C6AE3FC6ACAD14EAC04D057B6D6EA
SHA-512:	48AA89CF4A0B64FF4DCB82E372A01DFF423C12111D35A4D27B6D8DD793FFDE130E0037AB5E4477818A0939F61F7DB25295E4271B8B03F209D8F498169B1F9BAE
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Instalator [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Czy na pewno chcesz anulowa.?</String>.. <String Id="HelpHeader">Instalator . Pomoc</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [katalog] - Instaluje, naprawia, odinstalowuje.. lub tworzy pe.n. lokaln. kopi. pakietu w katalogu. Domy.lnie jest u.ywany prze..cznik install...../passive \| /quiet - Wy.wietla ograniczony interfejs u.ytkownika bez monit.w albo nie wy.wietla ani interfejsu u.ytkownika,.. ani monit.w. Domy.lnie jest wy.wietlany interfejs u.ytkownika oraz wszystkie monity...../norestart - Pom

C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1046\license.rtf

Download File

Process:	C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	10656
Entropy (8bit):	5.092962528947159
Encrypted:	false
SSDEEP:	192:WIPAufWXXF0+YkR6E0/CiTS0CsGlHIMqf29H7KxLY/aYzApT3anawLXCBX2:VPAufb+YSSCYrCb5BmW4UDaTqzLwX2
MD5:	360FC4A7FFCDB915A7CF440221AFAD36
SHA1:	009F36BBDAD5B9972E8069E53855FC656EA05800
SHA-256:	9BF79B54F4D62BE501FF53EEDEB18683052A4AE38FF411750A764B3A59077F52
SHA-512:	9550A99641F194BB504A76DE011D07C1183EE1D83371EE49782FC3D05BF779415630450174DD0C03CB182A5575F6515012337B899E2D084203717D9F110A6FFE
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset0 Garamond;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 TERMOS DE LICEN\'c7A PARA SOFTWARE MICROSOFT\par..MICROSOFT VISUAL C++ 2019 RUNTIME \par..\b0 Estes termos de licen\'e7a formam um contrato firmado entre a Microsoft Corporation (ou com base no seu pa\'eds de resid\'eancia, uma de suas afiliadas) e voc\'ea. Eles se aplicam ao software indicado acima. Os termos tamb\'e9m se aplicam a quaisquer servi\'e7os ou atualiza\'e7\'f5es da Microsoft para o software, exceto at\'e9 a extens\'e3o de que eles tenham termos diferentes.\par..\b SE VOC\'ca CONCORDAR COM ESTES TERMOS DE LICEN\'c7A, TER\'c1 OS DIREITOS INDICADOS ABAIXO.\par....\pard{\pntext\f2\'B7\tab}{\\pn\pnlvlblt\pnf2\pnindent360{\pntxtb\'B7}}\fi-357\li357\sb120\sa120\sl240\slmult1\t

C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1046\thm.wxl

Download File

Process:	C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3095
Entropy (8bit):	5.150868216959352
Encrypted:	false
SSDEEP:	48:c5DiTlO5es/4ThDzmU6lDj4N3mBl0N+NWNP4hHCc9skPDXeKKeK9KfKt4eJ2RQdg:uDiTlJhJGl2UsZMLe6
MD5:	BE27B98E086D2B8068B16DBF43E18D50
SHA1:	6FAF34A36C8D9DE55650D0466563852552927603
SHA-256:	F52B54A0E0D0E8F12CBA9823D88E9FD6822B669074DD1DC69DAD6553F7CB8913
SHA-512:	3B7C773EF72D40A8B123FDB8FC11C4F354A3B152CF6D247F02E494B0770C28483392C76F3C222E3719CF500FE98F535014192ACDDD2ED9EF971718EA3EC0A73E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] Instala..o</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Tem certeza de que deseja cancelar?</String>.. <String Id="HelpHeader">Ajuda da Instala..o</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [diret.rio - instala, repara, desinstala ou.. cria uma c.pia local completa do pacote no diret.rio. Install . o padr.o..../passive \| /quiet - exibe a IU m.nima sem nenhum prompt ou n.o exibe nenhuma IU e.. nenhum prompt. Por padr.o, a IU e todos os prompts s.o exibidos...../norestart - suprime qualquer tentativa de reiniciar. Por padr.o, a IU perguntar. antes de reiniciar

C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1049\license.rtf

Download File

Process:	C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	31915
Entropy (8bit):	3.6440775919653996
Encrypted:	false
SSDEEP:	384:ntaMxngQEqQUaAEJxkSjjujcme51oVwuZOFsrnkGxunWxGc9wtvVYgCzkSxN1S2:npgnmWWNEvVYgCzxD
MD5:	A59C893E2C2B4063AE821E42519F9812
SHA1:	C00D0B11F6B25246357053F6620E57D990EFC698
SHA-256:	0EC8368E87B3DFC92141885A2930BDD99371526E09FC52B84B764C91C5FC47B8
SHA-512:	B9AD8223DDA2208EC2068DBB85742A03BE0291942E60D4498E3DAB4DDF559AA6DCF9879952F5819223CFC5F4CB71D4E06E4103E129727AACFB8EFE48403A04FA
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset204 Tahoma;}{\f1\fnil\fcharset0 Tahoma;}{\f2\fnil\fcharset204 Garamond;}{\f3\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\*\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang1049\'d3\'d1\'cb\'ce\'c2\'c8\'df \'cb\'c8\'d6\'c5\'cd\'c7\'c8\'c8 \'cd\'c0 \'cf\'d0\'ce\'c3\'d0\'c0\'cc\'cc\'cd\'ce\'c5 \'ce\'c1\'c5\'d1\'cf\'c5\'d7\'c5\'cd\'c8\'c5 MICROSOFT\par..\f1\lang9 MICROSOFT VISUAL C++ 2019 RUNTIME\par..\b0\f0\lang1049\'cd\'e0\'f1\'f2\'ee\'ff\'f9\'e8\'e5 \'f3\'f1\'eb\'ee\'e2\'e8\'ff \'eb\'e8\'f6\'e5\'ed\'e7\'e8\'e8 \'ff\'e2\'eb\'ff\'fe\'f2\'f1\'ff \'f1\'ee\'e3\'eb\'e0\'f8\'e5\'ed\'e8\'e5\'ec \'ec\'e5\'e6\'e4\'f3 \'ea\'ee\'f0\'ef\'ee\'f0\'e0\'f6\'e8\'e5\'e9 Microsoft (\'e8\'eb\'e8, \'e2 \'e7\'e0\'e2\'e8\'f1\'e8\'ec\'ee\'f1\'f2\'e8 \'ee\'f2 \'ec\'e5\'f1\'f2\'e0 \'e2\'e0\'f8\'e5\'e3\'ee \'ef\'f0\'ee\'e6\'e8\'e2\'e0\'ed\'e8\'ff, \'ee\

C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1049\thm.wxl

Download File

Process:	C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	5.444436038992627
Encrypted:	false
SSDEEP:	48:c5DiTlDhQt9esbrohDTWJt49kAr7DHN3m5GNDCNvNLIkflhrWncPingGdZwK1Kqp:uDiTlDYVgmt4xJ88k193ipzjvL
MD5:	17C652452E5EE930A7F1E5E312C17324
SHA1:	59F3308B87143D8EA0EA319A1F1A1F5DA5759DD3
SHA-256:	7333BC8E52548821D82B53DBD7D7C4AA1703C85155480CB83CEFD78380C95661
SHA-512:	53FD207B96D6BCF0A442E2D90B92E26CBB3ECC6ED71B753A416730E8067E831E9EB32981A9E9368C4CCA16AFBCB2051483FDCFC474EA8F0D652FCA934634FBE8
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.. <Control Control="InstallButton" X="275" Y="237" Width="110" Height="23"/>.... <String Id="Caption">......... ......... [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">........?</String>.. <String Id="HelpHeader">....... .. .........</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [.......] - ........., .............., ........ ..... ........ ...... ......... ..... ...... . ......... .. ......... - ............../passive \| /quiet - ........... ....

C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1055\license.rtf

Download File

Process:	C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	13379
Entropy (8bit):	5.214715951393874
Encrypted:	false
SSDEEP:	192:1fGkc01jIjZTUDUTvXt2QpfC5VAlCPpDwuOfH7df3YwnnbZIWG2XjQeoO9uBO8CA:Iiqx4Uh2QpMVA8haDdv9nbZzG6oQR2
MD5:	BD2DC15DFEE66076BBA6D15A527089E7
SHA1:	8768518F2318F1B8A3F8908A056213042A377CC4
SHA-256:	62A07232017702A32F4B6E43E9C6F063B67098A1483EEDDB31D7C73EAF80A6AF
SHA-512:	9C9467A2F2D0886FF4302A44AEA89734FCEFBD3CBE04D895BCEACBA1586AB746E62391800E07B6228E054014BE51F14FF63BA71237268F94019063C8C8B7EF74
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset238 Tahoma;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 MICROSOFT YAZILIMI L\f1\u304?SANS KO\'aaULLARI\par..\f0 MICROSOFT VISUAL C++ 2019 RUNTIME \par..\b0 Bu lisans ko\f1\'baullar\u305?, Microsoft Corporation (veya ya\'baad\u305?\u287?\u305?n\u305?z yere g\f0\'f6re bir ba\f1\u287?l\u305? \'bairketi) ile sizin aran\u305?zda yap\u305?lan anla\'bamay\u305? olu\'baturur. Bu ko\'baullar, yukar\u305?da ad\u305? ge\f0\'e7en yaz\f1\u305?l\u305?m i\f0\'e7in ge\'e7erlidir. \f1\'aaartlar, yaz\u305?l\u305?m i\f0\'e7in t\'fcm Microsoft hizmetleri veya g\'fcncelle\f1\'batirmeleri i\f0\'e7in, beraberlerinde farkl\f1\u305? \'baartlar bulunmad\u305?\u287?\u305? s\f0\'fcrece ge\'e7erlidir.\par..\b BU L\f1\u304?SANS \'aaARTLARINA UYDU\u286?UNUZ TAKD\u304?RDE A\'aaA\u286?IDAK\u3

C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\1055\thm.wxl

Download File

Process:	C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3221
Entropy (8bit):	5.280530692056262
Encrypted:	false
SSDEEP:	48:c5DiTlOaesHEqhDTHV4zVy6oBzdp0DYK2GP2ZmN3majyNXNoNKQXVvChcPc+WKb0:uDiTl3PHcIflKNTPgdi12xgg
MD5:	DEFBEA001DC4EB66553630AC7CE47CCA
SHA1:	90CED64EC7C861F03484B5D5616FDBCDA8F64788
SHA-256:	E5ABE3CB3BF84207DAC4E6F5BBA1E693341D01AEA076DD2D91EAA21C6A6CB925
SHA-512:	B3B7A22D0CDADA21A977F1DCEAF2D73212A4CDDBD298532B1AC97575F36113D45E8D71C60A6D8F8CC2E9DBF18EE1000167CFBF0B2E7ED6F05462D77E0BCA0E90
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] Kurulumu</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.ptal etmek istedi.inizden emin misiniz?</String>.. <String Id="HelpHeader">Kurulum Yard.m.</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [dizin] - y.kler, onar.r, kald.r.r ya da.. dizindeki paketin tam bir yerel kopyas.n. olu.turur. Varsay.lan install de.eridir...../passive \| /quiet - en az d.zeyde istemsiz UI g.sterir ya da hi. UI g.stermez ve.. istem yoktur. Varsay.lan olarak UI ve t.m istemler g.r.nt.lenir...../norestart - yeniden ba.lama denemelerini engeller. Varsay.lan olarak UI yeniden ba.l

C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\2052\license.rtf

Download File

Process:	C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	17863
Entropy (8bit):	3.9617786349452775
Encrypted:	false
SSDEEP:	192:BxoqPyOj+/8Tk5VigWgijAlk5xWvSCI5lgios0EhGXxGMLVGW+uUoqyLZDvAJxMx:vbIeaE7q3KGgzD2
MD5:	3CF16377C0D1B2E16FFD6E32BF139AC5
SHA1:	D1A8C3730231D51C7BB85A7A15B948794E99BDCE
SHA-256:	E95CA64C326A0EF7EF3CED6CDAB072509096356C15D1761646E3C7FDA744D0E0
SHA-512:	E9862FD0E8EC2B2C2180183D06535A16A527756F6907E6A1D2DB85092636F72C497508E793EE8F2CC8E0D1A5E090C6CCF465F78BC1FA8E68DAF7C68815A0EE16
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset134 SimSun;}{\f1\fnil\fcharset0 Tahoma;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9\'ce\'a2\'c8\'ed\'c8\'ed\'bc\'fe\'d0\'ed\'bf\'c9\'cc\'f5\'bf\'ee\f1\par..MICROSOFT VISUAL C++ 2019 RUNTIME \par..\b0\f0\'d5\'e2\'d0\'a9\'d0\'ed\'bf\'c9\'cc\'f5\'bf\'ee\'ca\'c7\f1 Microsoft Corporation\f0\'a3\'a8\'bb\'f2\'c4\'fa\'cb\'f9\'d4\'da\'b5\'d8\'b5\'c4\f1 Microsoft \f0\'b9\'d8\'c1\'aa\'b9\'ab\'cb\'be\'a3\'a9\'d3\'eb\'c4\'fa\'d6\'ae\'bc\'e4\'b4\'ef\'b3\'c9\'b5\'c4\'d0\'ad\'d2\'e9\'a1\'a3\'d5\'e2\'d0\'a9\'cc\'f5\'bf\'ee\'ca\'ca\'d3\'c3\'d3\'da\'c9\'cf\'ca\'f6\'c8\'ed\'bc\'fe\'a1\'a3\'d5\'e2\'d0\'a9\'cc\'f5\'bf\'ee\'d2\'b2\'ca\'ca\'d3\'c3\'d3\'da\'d5\'eb\'b6\'d4\'b8\'c3\'c8\'ed\'bc\'fe\'b5\'c4\'c8\'ce\'ba\'ce\'ce\'a2\'c8\'ed\'b7\'fe\'ce\'f1\'bb\'f2\'b8\'fc\'d0\'c2\'a3\'ac\'b5\'ab\'d3\'d0\'b2\'bb\'cd\

C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\2052\thm.wxl

Download File

Process:	C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2978
Entropy (8bit):	6.135205733555905
Encrypted:	false
SSDEEP:	48:c5DiTlOtKesi+hDtkQf7lz+W0gopN3m5+3cNONeN1ra8vWqPtlTKxKUTKlKXRoR+:uDiTlV5kQR9GLeE0ZxV6gIV
MD5:	3D1E15DEEACE801322E222969A574F17
SHA1:	58074C83775E1A884FED6679ACF9AC78ABB8A169
SHA-256:	2AC8B7C19A5189662DE36A0581C90DBAD96DF259EC00A28F609B644C3F39F9CA
SHA-512:	10797919845C57C5831234E866D730EBD13255E5BF8BA8087D53F1D0FC5D72DC6D5F6945DBEBEE69ACC6A2E20378750C4B78083AE0390632743C184532358E10
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] ....</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">......</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [..] - .......... ..................Install ........../passive \| /quiet - ..... UI ......... UI ... ........ UI ........../norestart - ..................... UI.../log log.txt - ............. %TEMP% ...

C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\3082\license.rtf

Download File

Process:	C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	10714
Entropy (8bit):	5.122578090102117
Encrypted:	false
SSDEEP:	192:WthGE/9wd8eQF/hJOmQeNrXT77uOlQ+v3AqHqc3wpXGYdjvsk2cwBb2:mhGuhj+ed388Bb2
MD5:	FBF293EE95AFEF818EAF07BB088A1596
SHA1:	BBA1991BA6459C9F19B235C43A9B781A24324606
SHA-256:	1FEC058E374C20CB213F53EB3C44392DDFB2CAA1E04B7120FFD3FA7A296C83E2
SHA-512:	6971F20964EF74B19077EE81F953342DC6D2895A8640EC84855CECCEA5AEB581E6A628BCD3BA97A5D3ACB6CBE7971FDF84EF670BDDF901857C3CD28855212019
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset0 Garamond;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 T\'c9RMINOS DE LA LICENCIA DE SOFTWARE DE MICROSOFT\par..MICROSOFT VISUAL C++ 2019 RUNTIME\par..\b0 Estos t\'e9rminos de licencia constituyen un contrato entre Microsoft Corporation (o, en funci\'f3n de donde resida, una de sus filiales) y usted. Se aplican al software antes mencionado. Los t\'e9rminos tambi\'e9n se aplican a cualquier servicio o actualizaci\'f3n de Microsoft para el software, excepto en la medida que tengan t\'e9rminos diferentes.\par..\b SI USTED CUMPLE CON LOS PRESENTES T\'c9RMINOS DE ESTA LICENCIA, DISPONDR\'c1 DE LOS DERECHOS QUE SE DESCRIBEN A CONTINUACI\'d3N.\par....\pard{\pntext\f2\'B7\tab}{\\pn\pnlvlblt\pnf2\pnindent360{\pntxtb\'B7}}\fi-357\li357\sb120\sa120\

C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\3082\thm.wxl

Download File

Process:	C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3265
Entropy (8bit):	5.0491645049584655
Encrypted:	false
SSDEEP:	48:c5DiTlO/esS6VGhDv4tiUiyRUqzC4U+aD6N3m7xNh1NWNGbPz+9o3PWeKK9K9KfT:uDiTlxouUTiySqyIwz9sgxqvjIk8
MD5:	47F9F8D342C9C22D0C9636BC7362FA8F
SHA1:	3922D1589E284CE76AB39800E2B064F71123C1C5
SHA-256:	9CBB2B312C100B309A1B1495E84E2228B937612885F7A642FBBD67969B632C3A
SHA-512:	E458DF875E9B0622AEBE3C1449868AA6A2826A1F851DB71165A872B2897CF870CCF85046944FF51FFC13BB15E54E9D9424EC36CAF5A2F38CE8B7D6DC0E9B2363
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Instalaci.n de [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.Est. seguro de que desea cancelar la operaci.n?</String>.. <String Id="HelpHeader">Ayuda de configuraci.n</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - instala, repara, desinstala o.. crea una copia local completa del paquete en el directorio. La opci.n predeterminada es la instalaci.n...../passive \| /quiet - muestra una IU m.nima sin solicitudes o no muestra ninguna IU ni.. solicitud. De forma predeterminada, se muestran la IU y todas las solicitudes...../norestart - elimina cualquier intento

C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\BootstrapperApplicationData.xml

Download File

Process:	C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (591), with CRLF line terminators
Category:	dropped
Size (bytes):	13188
Entropy (8bit):	3.7269622731111123
Encrypted:	false
SSDEEP:	192:X0s1HBDnH5zHqQHG0Hd8Hz7HE06HA0rH3pEpzcxLU76zLG0LICrcBx7z8NkzzkvL:X0s19dLbmnoNAQkmJJruVEpJEo
MD5:	947CA1888D6B3E455B0C2481F85895E6
SHA1:	7FAD486E7D0BE3DB6252E07CA83A3C177D5D05BB
SHA-256:	F8E9CF237EB91588A02B0A77D6512AD0CF2ECCB18B54C375D6073B4C6133EFCF
SHA-512:	1498DE4C5BA1787C4AC57044677DCD04EB60AB341896DA6D5F13EE08CD07F4A26D01BB2EC7B2A2B0749A61DC3A2D6E4DA5E769F744A754A2FAA33795068DDC03
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.x./.2.0.1.0./.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a.".>..... . .<.W.i.x.B.a.l.C.o.n.d.i.t.i.o.n. .C.o.n.d.i.t.i.o.n.=.".V.e.r.s.i.o.n.N.T.6.4. .&.g.t.;.=. .v.6...0. .O.R. .(.V.e.r.s.i.o.n.N.T.6.4. .=. .v.5...2. .A.N.D. .S.e.r.v.i.c.e.P.a.c.k.L.e.v.e.l. .&.g.t.;.=. .1.).". .M.e.s.s.a.g.e.=.".[.W.i.x.B.u.n.d.l.e.N.a.m.e.]. .c.a.n. .o.n.l.y. .b.e. .i.n.s.t.a.l.l.e.d. .o.n. .W.i.n.d.o.w.s. .X.P. .S.P.1. .(.x.6.4.). .a.n.d. .n.e.w.e.r. .p.l.a.t.f.o.r.m.s...". ./.>..... . .<.W.i.x.B.u.n.d.l.e.P.r.o.p.e.r.t.i.e.s. .D.i.s.p.l.a.y.N.a.m.e.=.".M.i.c.r.o.s.o.f.t. .V.i.s.u.a.l. .C.+.+. .2.0.1.5.-.2.0.1.9. .R.e.d.i.s.t.r.i.b.u.t.a.b.l.e. .(.x.6.4.). .-. .1.4...2.5...2.8.5.0.8.". .L.o.g.P.a.t.h.V.a.r.i.a.b.l.e.=.".W.i.x.B.u.n.d.l.e.L.o.g.". .C.o.m.p.r.e.s.s.e.d.=.".y.e.

C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\license.rtf

Download File

Process:	C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
Category:	dropped
Size (bytes):	9046
Entropy (8bit):	5.157073875669985
Encrypted:	false
SSDEEP:	192:W8lZ1UVDWkgWZTIsvPhghtQ1Qf4lCfnEtHixEGx736wHqItfSpOy2:9T15WZMgAYlOnjt5HLoL2
MD5:	2EABBB391ACB89942396DF5C1CA2BAD8
SHA1:	182A6F93703549290BCDE92920D37BC1DEC712BB
SHA-256:	E3156D170014CED8D17A02B3C4FF63237615E5C2A8983B100A78CB1F881D6F38
SHA-512:	20D656A123A220CD3CA3CCBF61CC58E924B44F1F0A74E70D6850F39CECD101A69BCE73C5ED14018456E022E85B62958F046AA4BD1398AA27303C2E86407C3899
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset0 Garamond;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 MICROSOFT SOFTWARE LICENSE TERMS\par..MICROSOFT VISUAL C++ 2019 RUNTIME \par..\b0 These license terms are an agreement between Microsoft Corporation (or based on where you live, one of its affiliates) and you. They apply to the software named above. The terms also apply to any Microsoft services or updates for the software, except to the extent those have different terms.\par..\b IF YOU COMPLY WITH THESE LICENSE TERMS, YOU HAVE THE RIGHTS BELOW.\par....\pard{\pntext\f2\'B7\tab}{\\pn\pnlvlblt\pnf2\pnindent360{\pntxtb\'B7}}\fi-357\li357\sb120\sa120\sl240\slmult1\tx360 INSTALLATION AND USE RIGHTS. \b0\par....\pard{\pntext\f2\'B7\tab}{\*\pn\pnlvlblt\pnf2\pnindent360{\pntxtb\'B7}}\fi-363\

C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\logo.png

Download File

Process:	C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe
File Type:	PNG image data, 64 x 64, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1861
Entropy (8bit):	6.868587546770907
Encrypted:	false
SSDEEP:	24:q36cnTKM/3kTIQiBmYKHeQWalGt1Sj9kYIt1uZ+bYOQe0IChR95aW:qqiTKMPuUBm7eQJGtYJM1uZCVszaW
MD5:	D6BD210F227442B3362493D046CEA233
SHA1:	FF286AC8370FC655AEA0EF35E9CF0BFCB6D698DE
SHA-256:	335A256D4779EC5DCF283D007FB56FD8211BBCAF47DCD70FE60DED6A112744EF
SHA-512:	464AAAB9E08DE610AD34B97D4076E92DC04C2CDC6669F60BFC50F0F9CE5D71C31B8943BD84CEE1A04FB9AB5BBED3442BD41D9CB21A0DD170EA97C463E1CE2B5B
Malicious:	false
Preview:	.PNG........IHDR...@...@.............sRGB.........gAMA......a.....PLTE].q^.r_.r_.s`.s`.s`.ta.ta.ub.ub.vc.vd.vd.vd.we.we.xe.xg.yg yg zh zh"zi"{j#\|i${j$\|n~n.n,.o,.p..q0.r2.s3.t5.x;.x<.y>.z?.\|B.~C.}E..F..F..H..I..J..L..O..P..W..Y..^..a..c..g..i..q..r..}.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................S......pHYs..%...%....^.....tEXtSoftware.Paint.NET v3.5.100.r.....IDATXG..iW.@...EJ.$M...`AEpG..7TpWT@\.."....(..(.._;...di:9.c>q..g....T...._...-....F..+..w.

C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\thm.wxl

Download File

Process:	C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2952
Entropy (8bit):	5.052095286906672
Encrypted:	false
SSDEEP:	48:c5DiTl/+desK19hDUNKwsqq8+JIDxN3mt7NlN1NVvAdMcgLPDHVXK8KTKjKnSnYF:uDiTl/BbTxmup/vrxATd
MD5:	FBFCBC4DACC566A3C426F43CE10907B6
SHA1:	63C45F9A771161740E100FAF710F30EED017D723
SHA-256:	70400F181D00E1769774FF36BCD8B1AB5FBC431418067D31B876D18CC04EF4CE
SHA-512:	063FB6685EE8D2FA57863A74D66A83C819FE848BA3072B6E7D1B4FE397A9B24A1037183BB2FDA776033C0936BE83888A6456AAE947E240521E2AB75D984EE35E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29" />.... <String Id="Caption">[WixBundleName] Setup</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Are you sure you want to cancel?</String>.. <String Id="HelpHeader">Setup Help</String>.. <String Id="HelpText">/install \| /repair \| /uninstall \| /layout [directory] - installs, repairs, uninstalls or.. creates a complete local copy of the bundle in directory. Install is the default...../passive \| /quiet - displays minimal UI with no prompts or displays no UI and.. no prompts. By default UI and all prompts are displayed...../norestart - suppress any attempts to restart. By default UI will prompt before restart.../log log.txt - logs to a specific file. B

C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\thm.xml

Download File

Process:	C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8332
Entropy (8bit):	5.184632608060528
Encrypted:	false
SSDEEP:	96:8L2HdQG+3VzHfz96zYFGaPSWXdhRAmImlqFQKFBiUxn7Ke5A82rkO/pWk3nswP:ZHAzZ/3
MD5:	F62729C6D2540015E072514226C121C7
SHA1:	C1E189D693F41AC2EAFCC363F7890FC0FEA6979C
SHA-256:	F13BAE0EC08C91B4A315BB2D86EE48FADE597E7A5440DCE6F751F98A3A4D6916
SHA-512:	CBBFBFA7E013A2B85B78D71D32FDF65323534816978E7544CA6CEA5286A0F6E8E7E5FFC4C538200211F11B94373D5658732D5D8AA1D01F9CCFDBF20F154F1471
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<Theme xmlns="http://wixtoolset.org/schemas/thmutil/2010">.. <Window Width="485" Height="300" HexStyle="100a0000" FontId="0">#(loc.Caption)</Window>.. <Font Id="0" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="1" Height="-24" Weight="500" Foreground="000000">Segoe UI</Font>.. <Font Id="2" Height="-22" Weight="500" Foreground="666666">Segoe UI</Font>.. <Font Id="3" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="4" Height="-12" Weight="500" Foreground="ff0000" Background="FFFFFF" Underline="yes">Segoe UI</Font>.... <Image X="11" Y="11" Width="64" Height="64" ImageFile="logo.png" Visible="yes"/>.. <Text X="80" Y="11" Width="-11" Heig

C:\Windows\Temp\{7A264376-D4DE-48B4-BA56-4CD7EB3DD11A}\.ba\wixstdba.dll

Download File

Process:	C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	195600
Entropy (8bit):	6.682530937585544
Encrypted:	false
SSDEEP:	3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
MD5:	EAB9CAF4277829ABDF6223EC1EFA0EDD
SHA1:	74862ECF349A9BEDD32699F2A7A4E00B4727543D
SHA-256:	A4EFBDB2CE55788FFE92A244CB775EFD475526EF5B61AD78DE2BCDFADDAC7041
SHA-512:	45B15ADE68E0A90EA7300AEB6DCA9BC9E347A63DBA5CE72A635957564D1BDF0B1584A5E34191916498850FC7B3B7ECFBCBFCB246B39DBF59D47F66BC825C6FD2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3..R...R...R..h.N..R..h.L.R..h.M..R.......R.......R.......R...<..R...,..R...R...S..K....R..K....R..N.@..R...R(..R..K....R..Rich.R..................PE..L......Z...........!................d.....................................................@..............................................................D......,.......T...............................@...............X............................text............................... ..`.rdata.............................@..@.data...............................@....gfids..............................@..@.rsrc...............................@..@.reloc..,...........................@..B........................................................................................................................................................................................................................................

C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe

Download File

Process:	C:\Users\user\Desktop\._cache_file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	647704
Entropy (8bit):	7.215724889481757
Encrypted:	false
SSDEEP:	12288:SnMwHskY7gjcjhVIEhqgM7bWvcsi6aVj7Iy41wXK4Qzh+jMlWCEht:cMysZgjS1hqgSC/izvf0wiz0wyt
MD5:	843288FD72A1152B50B4E4B7344BB592
SHA1:	648416C53721A85666ABAF71C6682FCC1DA70B48
SHA-256:	82C3E3423E48BAFCDD726624EB7FD3E00674E50E4B6ACDCAC408FE8FAE43B022
SHA-512:	04B61BB0A6E748AB78B1037DB68BC9EC1745BB3EFACA0B8FB6D99E01ABBE08A67168CBF3F714B72DAF00DA26084EC6F6F707C3CD08FA8243023E6924719A4E41
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c...'.u.'.u.'.u.......u.....[.u.....?.u...v.4.u...q.4.u...p...u.....".u....6.u.'.t.v.u...p.l.u....&.u.'..%.u...w.&.u.Rich'.u.........................PE..L......Z.....................v......m.............@..........................p............@..............................................;.......... ....#...0...=.. t..T...................tt......@n..@...................$........................text.............................. ..`.rdata..............................@..@.data...@...........................@....wixburn8...........................@..@.tls................................@....gfids..............................@..@.rsrc....;.......<..................@..@.reloc...=...0...>..................@..B........................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465647638680928
Encrypted:	false
SSDEEP:	6144:fIXfpi67eLPU9skLmb0b4gWSPKaJG8nAgejZMMhA2gX4WABl0uN9dwBCswSb8:QXD94gWlLZMM6YFHf+8
MD5:	191DBED31D64305C9590A9D2C610FDFC
SHA1:	59FE0FB95FD4ADD4C7A371DEAEB1088806B05B10
SHA-256:	03F17B247BEC4F467ABF09C0E52AF314B3957D96F32221B5D14FF77050CBF638
SHA-512:	22A0CC6DDC44A80C91F23E845EB8C563DFF4C37531A1F3F25F15A2AC0928A18B71AA6C58DA26642D135AFB83FF78CDD62710CD8A28777F4C879FB1E48C66AD71
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm6.t.L]...............................................................................................................................................................................................................................................................................................................................................Ec.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.978966950180418
TrID:	Win32 Executable (generic) a (10002005/4) 92.21% Win32 Executable Borland Delphi 7 (665061/41) 6.13% Windows ActiveX control (116523/4) 1.07% InstallShield setup (43055/19) 0.40% Win32 Executable Delphi generic (14689/80) 0.14%
File name:	file.exe
File size:	15'745'536 bytes
MD5:	7e33585d157419e39fb4d232c9f0c5dc
SHA1:	1cf4864a9b009e12534cc299c14466f2b2c9cea3
SHA256:	027a4baf9864a23fe09d99be3a6f83d1841e47aac2f94d313d2580e84d1b1b39
SHA512:	3abcb07cdde6d8014149e5ad9c07f1afaa88d4a8fb85a67e6f0514ec613ada145dda81713dd96ba0a91f056d65919820b24c6bf2232d59e7fdc6d27f86b01036
SSDEEP:	393216:EU5lptVYmfr7yBG/4WoI+j6LTinXKSf0fzTDvD:v7pttD7yBG/uljIinXj0fX
TLSH:	83F63332F1D14037C2B3053ADD5AE6245D3DBA143F24999BB7EC9D0D5F392822AB6293
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Static PE Info

General

Entrypoint:	0x49ab80
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	332f7ce65ead0adfb3d35147033aabe9

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 0049A778h
call 00007F3FB13C70FDh
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
call 00007F3FB141AA45h
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
mov edx, 0049ABE0h
call 00007F3FB141A644h
mov ecx, dword ptr [0049DBDCh]
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
mov edx, dword ptr [00496590h]
call 00007F3FB141AA34h
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
call 00007F3FB141AAA8h
call 00007F3FB13C4BDBh
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa0000	0x2a42	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb0000	0xe59978	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa5000	0xa980	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0xa4018	0x21	.rdata
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xa4000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x99bec	0x99c00	33fbe30e8a64654287edd1bf05ae7c8c	False	0.5141641260162602	data	6.572957870355296	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0x9b000	0x2e54	0x3000	1f5e19e7d20c1d128443d738ac7bc610	False	0.453125	data	4.854620797809023	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0x9e000	0x11e5	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xa0000	0x2a42	0x2c00	21ff53180b390dc06e3a1adf0e57a073	False	0.3537819602272727	data	4.919333216027082	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xa3000	0x10	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xa4000	0x39	0x200	a92cf494c617731a527994013429ad97	False	0.119140625	MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 "J"	0.7846201577093705	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0xa5000	0xa980	0xaa00	dcd1b1c3f3d28d444920211170d1e8e6	False	0.5899816176470588	data	6.674124985579511	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0xb0000	0xe59978	0xe59a00	fe72bf384d5cbb67205c2de5793315d7	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0xb0dc8	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"			0.38636363636363635
RT_CURSOR	0xb0efc	0x134	data			0.4642857142857143
RT_CURSOR	0xb1030	0x134	data			0.4805194805194805
RT_CURSOR	0xb1164	0x134	data			0.38311688311688313
RT_CURSOR	0xb1298	0x134	data			0.36038961038961037
RT_CURSOR	0xb13cc	0x134	data			0.4090909090909091
RT_CURSOR	0xb1500	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"			0.4967532467532468
RT_BITMAP	0xb1634	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0xb1804	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380			0.46487603305785125
RT_BITMAP	0xb19e8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0xb1bb8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39870689655172414
RT_BITMAP	0xb1d88	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.4245689655172414
RT_BITMAP	0xb1f58	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5021551724137931
RT_BITMAP	0xb2128	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5064655172413793
RT_BITMAP	0xb22f8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0xb24c8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5344827586206896
RT_BITMAP	0xb2698	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0xb2868	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128			0.4870689655172414
RT_ICON	0xb2950	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096			0.12453095684803002
RT_ICON	0xb39f8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 8192	Turkish	Turkey	0.2101313320825516
RT_DIALOG	0xb4aa0	0x52	data			0.7682926829268293
RT_STRING	0xb4af4	0x358	data			0.3796728971962617
RT_STRING	0xb4e4c	0x428	data			0.37406015037593987
RT_STRING	0xb5274	0x3a4	data			0.40879828326180256
RT_STRING	0xb5618	0x3bc	data			0.33472803347280333
RT_STRING	0xb59d4	0x2d4	data			0.4654696132596685
RT_STRING	0xb5ca8	0x334	data			0.42804878048780487
RT_STRING	0xb5fdc	0x42c	data			0.42602996254681647
RT_STRING	0xb6408	0x1f0	data			0.4213709677419355
RT_STRING	0xb65f8	0x1c0	data			0.44419642857142855
RT_STRING	0xb67b8	0xdc	data			0.6
RT_STRING	0xb6894	0x320	data			0.45125
RT_STRING	0xb6bb4	0xd8	data			0.5879629629629629
RT_STRING	0xb6c8c	0x118	data			0.5678571428571428
RT_STRING	0xb6da4	0x268	data			0.4707792207792208
RT_STRING	0xb700c	0x3f8	data			0.37598425196850394
RT_STRING	0xb7404	0x378	data			0.41103603603603606
RT_STRING	0xb777c	0x380	data			0.35379464285714285
RT_STRING	0xb7afc	0x374	data			0.4061085972850679
RT_STRING	0xb7e70	0xe0	data			0.5535714285714286
RT_STRING	0xb7f50	0xbc	data			0.526595744680851
RT_STRING	0xb800c	0x368	data			0.40940366972477066
RT_STRING	0xb8374	0x3fc	data			0.34901960784313724
RT_STRING	0xb8770	0x2fc	data			0.36649214659685864
RT_STRING	0xb8a6c	0x354	data			0.31572769953051644
RT_RCDATA	0xb8dc0	0x44	data			0.8676470588235294
RT_RCDATA	0xb8e04	0x10	data			1.5
RT_RCDATA	0xb8e14	0xe47c48	PE32 executable (GUI) Intel 80386, for MS Windows			0.7639760971069336
RT_RCDATA	0xf00a5c	0x3	ASCII text, with no line terminators	Turkish	Turkey	3.6666666666666665
RT_RCDATA	0xf00a60	0x3c00	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	Turkish	Turkey	0.54296875
RT_RCDATA	0xf04660	0x64c	data			0.5998759305210918
RT_RCDATA	0xf04cac	0x153	Delphi compiled form 'TFormVir'			0.7522123893805309
RT_RCDATA	0xf04e00	0x47d3	Microsoft Excel 2007+	Turkish	Turkey	0.8675150921846957
RT_GROUP_CURSOR	0xf095d4	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0xf095e8	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0xf095fc	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0xf09610	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0xf09624	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0xf09638	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0xf0964c	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_ICON	0xf09660	0x14	data	Turkish	Turkey	1.1
RT_VERSION	0xf09674	0x304	data	Turkish	Turkey	0.42875647668393785

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetTickCount, QueryPerformanceCounter, GetVersion, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, SetCurrentDirectoryA, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetCurrentDirectoryA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, ExitThread, CreateThread, WriteFile, UnhandledExceptionFilter, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetFileType, CreateFileA, CloseHandle
user32.dll	GetKeyboardType, LoadStringA, MessageBoxA, CharNextA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
advapi32.dll	RegSetValueExA, RegQueryValueExA, RegOpenKeyExA, RegNotifyChangeKeyValue, RegFlushKey, RegDeleteValueA, RegCreateKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA, GetUserNameA, AdjustTokenPrivileges
kernel32.dll	lstrcpyA, WritePrivateProfileStringA, WriteFile, WaitForSingleObject, WaitForMultipleObjects, VirtualQuery, VirtualAlloc, UpdateResourceA, UnmapViewOfFile, TerminateProcess, Sleep, SizeofResource, SetThreadLocale, SetFilePointer, SetFileAttributesA, SetEvent, SetErrorMode, SetEndOfFile, ResumeThread, ResetEvent, RemoveDirectoryA, ReadFile, OpenProcess, OpenMutexA, MultiByteToWideChar, MulDiv, MoveFileA, MapViewOfFile, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalReAlloc, GlobalHandle, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetVersionExA, GetVersion, GetTimeZoneInformation, GetTickCount, GetThreadLocale, GetTempPathA, GetTempFileNameA, GetSystemInfo, GetSystemDirectoryA, GetStringTypeExA, GetStdHandle, GetProcAddress, GetPrivateProfileStringA, GetModuleHandleA, GetModuleFileNameA, GetLogicalDrives, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeThread, GetDriveTypeA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCurrentProcess, GetComputerNameA, GetCPInfo, GetACP, FreeResource, InterlockedIncrement, InterlockedExchange, InterlockedDecrement, FreeLibrary, FormatMessageA, FindResourceA, FindNextFileA, FindFirstFileA, FindClose, FileTimeToLocalFileTime, FileTimeToDosDateTime, EnumCalendarInfoA, EnterCriticalSection, EndUpdateResourceA, DeleteFileA, DeleteCriticalSection, CreateThread, CreateProcessA, CreatePipe, CreateMutexA, CreateFileMappingA, CreateFileA, CreateEventA, CreateDirectoryA, CopyFileA, CompareStringA, CloseHandle, BeginUpdateResourceA
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, RectVisible, RealizePalette, PlayEnhMetaFile, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetPixel, GetPaletteEntries, GetObjectA, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExcludeClipRect, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, BitBlt
user32.dll	CreateWindowExA, WindowFromPoint, WinHelpA, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, ToAsciiEx, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCursor, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageA, OffsetRect, OemToCharA, MsgWaitForMultipleObjects, MessageBoxA, MapWindowPoints, MapVirtualKeyExA, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextLengthA, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassNameA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerBuffA, CharLowerA, CharUpperBuffA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
ole32.dll	CLSIDFromString
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopyInd, VariantCopy, VariantClear, VariantInit
ole32.dll	CLSIDFromProgID, CoCreateInstance, CoUninitialize, CoInitialize
oleaut32.dll	GetErrorInfo, SysFreeString
comctl32.dll	ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_SetDragCursorImage, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create
shell32.dll	ShellExecuteExA, ExtractIconExW
wininet.dll	InternetGetConnectedState, InternetReadFile, InternetOpenUrlA, InternetOpenA, InternetCloseHandle
shell32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHGetMalloc, SHGetDesktopFolder
advapi32.dll	OpenSCManagerA, CloseServiceHandle
wsock32.dll	WSACleanup, WSAStartup, gethostname, gethostbyname, inet_ntoa
netapi32.dll	Netbios

Possible Origin

Language of compilation system	Country where language is spoken	Map
Turkish	Turkey

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-02T20:31:46.328562+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49735	142.250.185.110	443	TCP
2025-01-02T20:31:46.392653+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49736	142.250.185.110	443	TCP
2025-01-02T20:31:47.265511+0100	2832617	ETPRO MALWARE W32.Bloat-A Checkin	1	192.168.2.4	49739	69.42.215.252	80	TCP
2025-01-02T20:31:47.456664+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49743	142.250.185.110	443	TCP
2025-01-02T20:31:47.476921+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49740	142.250.185.110	443	TCP
2025-01-02T20:31:48.537935+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49746	142.250.185.110	443	TCP
2025-01-02T20:31:48.597163+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49745	142.250.185.110	443	TCP
2025-01-02T20:31:49.610571+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49751	142.250.185.110	443	TCP
2025-01-02T20:31:49.731228+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49754	142.250.185.110	443	TCP
2025-01-02T20:31:51.609795+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49766	142.250.185.110	443	TCP
2025-01-02T20:31:51.610243+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49765	142.250.185.110	443	TCP
2025-01-02T20:31:52.653553+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49770	142.250.185.110	443	TCP
2025-01-02T20:31:52.667440+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49772	142.250.185.110	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 2, 2025 20:31:45.316329002 CET	49735	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:45.316359997 CET	443	49735	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:45.316499949 CET	49735	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:45.324436903 CET	49735	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:45.324446917 CET	443	49735	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:45.379877090 CET	49736	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:45.379914999 CET	443	49736	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:45.380004883 CET	49736	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:45.380547047 CET	49736	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:45.380558014 CET	443	49736	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:45.956567049 CET	443	49735	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:45.956681013 CET	49735	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:45.957353115 CET	443	49735	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:45.957425117 CET	49735	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:46.006827116 CET	49735	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:46.006855965 CET	443	49735	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:46.007287025 CET	443	49735	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:46.007364035 CET	49735	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:46.008460999 CET	443	49736	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:46.008562088 CET	49736	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:46.009251118 CET	443	49736	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:46.009306908 CET	49736	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:46.011914015 CET	49735	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:46.014033079 CET	49736	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:46.014058113 CET	443	49736	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:46.014324903 CET	443	49736	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:46.014400005 CET	49736	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:46.015754938 CET	49736	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:46.059343100 CET	443	49735	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:46.063332081 CET	443	49736	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:46.210016966 CET	49739	80	192.168.2.4	69.42.215.252
Jan 2, 2025 20:31:46.214761972 CET	80	49739	69.42.215.252	192.168.2.4
Jan 2, 2025 20:31:46.214848042 CET	49739	80	192.168.2.4	69.42.215.252
Jan 2, 2025 20:31:46.215018034 CET	49739	80	192.168.2.4	69.42.215.252
Jan 2, 2025 20:31:46.219760895 CET	80	49739	69.42.215.252	192.168.2.4
Jan 2, 2025 20:31:46.328552961 CET	443	49735	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:46.328696966 CET	49735	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:46.328706980 CET	443	49735	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:46.328769922 CET	49735	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:46.328851938 CET	49735	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:46.328896046 CET	443	49735	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:46.329041958 CET	443	49735	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:46.329142094 CET	49735	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:46.329142094 CET	49735	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:46.334095001 CET	49740	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:46.334144115 CET	443	49740	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:46.334214926 CET	49740	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:46.334618092 CET	49740	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:46.334635019 CET	443	49740	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:46.345316887 CET	49741	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:46.345354080 CET	443	49741	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:46.345448971 CET	49741	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:46.347138882 CET	49741	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:46.347152948 CET	443	49741	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:46.392657995 CET	443	49736	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:46.392735958 CET	49736	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:46.392759085 CET	443	49736	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:46.392774105 CET	443	49736	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:46.392822027 CET	49736	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:46.392838955 CET	49736	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:46.396975040 CET	49736	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:46.396975040 CET	49736	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:46.397001982 CET	443	49736	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:46.397260904 CET	49736	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:46.398075104 CET	49743	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:46.398076057 CET	49742	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:46.398113012 CET	443	49742	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:46.398118019 CET	443	49743	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:46.398241043 CET	49743	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:46.398241043 CET	49742	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:46.398535967 CET	49743	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:46.398547888 CET	443	49743	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:46.398716927 CET	49742	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:46.398732901 CET	443	49742	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:46.981443882 CET	443	49741	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:46.981566906 CET	49741	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:46.992173910 CET	49741	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:46.992192030 CET	443	49741	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:46.992446899 CET	443	49741	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:46.992582083 CET	443	49740	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:46.992624998 CET	49741	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:46.992670059 CET	49740	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:46.993447065 CET	49740	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:46.993453979 CET	49741	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:46.993463993 CET	443	49740	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:46.995301008 CET	49740	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:46.995321035 CET	443	49740	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:47.039345980 CET	443	49741	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:47.046896935 CET	443	49742	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:47.047005892 CET	443	49743	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:47.047039986 CET	49742	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:47.047142029 CET	49743	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:47.052290916 CET	49742	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:47.052304983 CET	443	49742	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:47.052560091 CET	443	49742	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:47.052714109 CET	49742	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:47.053381920 CET	49742	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:47.053416967 CET	49743	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:47.053426027 CET	443	49743	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:47.055569887 CET	49743	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:47.055574894 CET	443	49743	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:47.095324993 CET	443	49742	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:47.260576963 CET	80	49739	69.42.215.252	192.168.2.4
Jan 2, 2025 20:31:47.265511036 CET	49739	80	192.168.2.4	69.42.215.252
Jan 2, 2025 20:31:47.402621984 CET	443	49741	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:47.402679920 CET	443	49741	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:47.402757883 CET	443	49741	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:47.402789116 CET	49741	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:47.402789116 CET	49741	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:47.402873039 CET	49741	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:47.456664085 CET	443	49743	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:47.457035065 CET	49743	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:47.458136082 CET	443	49743	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:47.458190918 CET	443	49743	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:47.461982965 CET	49743	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:47.476933002 CET	443	49740	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:47.477169037 CET	49740	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:47.477319002 CET	443	49740	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:47.477365971 CET	443	49740	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:47.477492094 CET	49740	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:47.480950117 CET	49740	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:47.480950117 CET	49740	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:47.480968952 CET	443	49740	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:47.481352091 CET	49740	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:47.481753111 CET	49745	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:47.481791019 CET	443	49745	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:47.481961966 CET	49745	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:47.482240915 CET	49745	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:47.482256889 CET	443	49745	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:47.490701914 CET	49743	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:47.490701914 CET	49743	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:47.490720034 CET	443	49743	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:47.494091988 CET	49743	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:47.500360966 CET	49746	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:47.500395060 CET	443	49746	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:47.501512051 CET	49746	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:47.502291918 CET	49741	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:47.502309084 CET	443	49741	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:47.502809048 CET	49746	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:47.502825975 CET	443	49746	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:47.503334999 CET	49747	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:47.503354073 CET	443	49747	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:47.503530979 CET	49747	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:47.506661892 CET	49747	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:47.506675959 CET	443	49747	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:47.546137094 CET	443	49742	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:47.546175957 CET	443	49742	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:47.546189070 CET	49742	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:47.546200991 CET	443	49742	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:47.546246052 CET	49742	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:47.546246052 CET	49742	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:47.546255112 CET	443	49742	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:47.546264887 CET	443	49742	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:47.546344042 CET	49742	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:47.546344042 CET	49742	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:47.630908012 CET	49742	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:47.630933046 CET	443	49742	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:47.633299112 CET	49748	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:47.633347034 CET	443	49748	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:47.633416891 CET	49748	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:47.635004997 CET	49748	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:47.635027885 CET	443	49748	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:48.110855103 CET	443	49745	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:48.110928059 CET	49745	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:48.112548113 CET	49745	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:48.112561941 CET	443	49745	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:48.115956068 CET	49745	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:48.115964890 CET	443	49745	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:48.150146961 CET	443	49746	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:48.150232077 CET	49746	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:48.150827885 CET	49746	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:48.150834084 CET	443	49746	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:48.153099060 CET	49746	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:48.153105974 CET	443	49746	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:48.154453039 CET	443	49747	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:48.154571056 CET	49747	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:48.155034065 CET	49747	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:48.155042887 CET	443	49747	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:48.155194044 CET	49747	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:48.155198097 CET	443	49747	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:48.263557911 CET	443	49748	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:48.263617039 CET	49748	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:48.264425039 CET	49748	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:48.264436007 CET	443	49748	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:48.265006065 CET	49748	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:48.265012026 CET	443	49748	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:48.537971020 CET	443	49746	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:48.538044930 CET	443	49746	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:48.538145065 CET	49746	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:48.538387060 CET	49746	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:48.538403034 CET	443	49746	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:48.539017916 CET	49751	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:48.539067984 CET	443	49751	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:48.539338112 CET	49751	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:48.539338112 CET	49751	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:48.539369106 CET	443	49751	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:48.594181061 CET	443	49747	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:48.594240904 CET	443	49747	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:48.594270945 CET	49747	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:48.594290018 CET	443	49747	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:48.594301939 CET	49747	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:48.594363928 CET	443	49747	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:48.594363928 CET	49747	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:48.594449043 CET	49747	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:48.596200943 CET	49747	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:48.596200943 CET	49753	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:48.596213102 CET	443	49747	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:48.596230030 CET	443	49753	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:48.596404076 CET	49753	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:48.596793890 CET	443	49745	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:48.596834898 CET	49753	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:48.596847057 CET	443	49753	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:48.596873999 CET	49745	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:48.597043037 CET	49745	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:48.597084045 CET	443	49745	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:48.597245932 CET	443	49745	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:48.597271919 CET	49754	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:48.597305059 CET	443	49754	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:48.597306967 CET	49745	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:48.597306967 CET	49745	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:48.597390890 CET	49754	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:48.597778082 CET	49754	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:48.597790956 CET	443	49754	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:48.735093117 CET	443	49748	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:48.735130072 CET	443	49748	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:48.735234022 CET	443	49748	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:48.735253096 CET	49748	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:48.735253096 CET	49748	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:48.735341072 CET	49748	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:48.736128092 CET	49748	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:48.736150026 CET	443	49748	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:48.736692905 CET	49755	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:48.736733913 CET	443	49755	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:48.737421989 CET	49755	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:48.737596035 CET	49755	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:48.737606049 CET	443	49755	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:49.176893950 CET	443	49751	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:49.177077055 CET	49751	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:49.177686930 CET	443	49751	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:49.179752111 CET	49751	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:49.199377060 CET	49751	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:49.199394941 CET	443	49751	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:49.199646950 CET	443	49751	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:49.199836016 CET	49751	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:49.200180054 CET	49751	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:49.231724024 CET	443	49754	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:49.231921911 CET	49754	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:49.232322931 CET	443	49753	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:49.232481003 CET	443	49754	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:49.232548952 CET	49754	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:49.232552052 CET	49753	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:49.244388103 CET	49754	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:49.244406939 CET	443	49754	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:49.244704008 CET	443	49754	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:49.246566057 CET	49753	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:49.246572971 CET	443	49753	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:49.246604919 CET	49754	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:49.247334003 CET	443	49751	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:49.254442930 CET	49754	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:49.265058994 CET	49753	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:49.265064001 CET	443	49753	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:49.299335003 CET	443	49754	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:49.490226984 CET	443	49755	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:49.490406990 CET	49755	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:49.495467901 CET	49755	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:49.495475054 CET	443	49755	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:49.495839119 CET	49755	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:49.495846033 CET	443	49755	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:49.610605955 CET	443	49751	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:49.610683918 CET	443	49751	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:49.610713959 CET	49751	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:49.610740900 CET	49751	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:49.611974001 CET	49751	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:49.611984015 CET	443	49751	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:49.612004995 CET	49751	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:49.612025976 CET	49751	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:49.612747908 CET	49758	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:49.612775087 CET	443	49758	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:49.612831116 CET	49758	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:49.613096952 CET	49758	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:49.613111973 CET	443	49758	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:49.731254101 CET	443	49754	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:49.731342077 CET	49754	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:49.731359005 CET	443	49754	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:49.731486082 CET	49754	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:49.732837915 CET	49754	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:49.732883930 CET	443	49754	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:49.732930899 CET	443	49754	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:49.732949018 CET	49754	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:49.732978106 CET	49754	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:49.733892918 CET	49760	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:49.733928919 CET	443	49760	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:49.734117031 CET	49760	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:49.734391928 CET	49760	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:49.734406948 CET	443	49760	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:49.779719114 CET	443	49753	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:49.779772043 CET	443	49753	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:49.779778957 CET	49753	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:49.779789925 CET	443	49753	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:49.779814959 CET	49753	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:49.779850006 CET	49753	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:49.779854059 CET	443	49753	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:49.780119896 CET	49753	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:49.780379057 CET	443	49753	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:49.780414104 CET	443	49753	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:49.780417919 CET	49753	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:49.780459881 CET	49753	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:49.780857086 CET	49753	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:49.780857086 CET	49753	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:49.780869961 CET	443	49753	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:49.780916929 CET	49753	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:49.781510115 CET	49763	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:49.781543016 CET	443	49763	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:49.781698942 CET	49763	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:49.781975031 CET	49763	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:49.781984091 CET	443	49763	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:49.935041904 CET	443	49755	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:49.935091019 CET	443	49755	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:49.935170889 CET	49755	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:49.935187101 CET	443	49755	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:49.935231924 CET	49755	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:49.935376883 CET	443	49755	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:49.935434103 CET	443	49755	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:49.935482979 CET	49755	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:49.976572990 CET	49755	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:49.976593971 CET	443	49755	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:49.977585077 CET	49764	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:49.977632046 CET	443	49764	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:49.977986097 CET	49764	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:49.978214025 CET	49764	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:49.978231907 CET	443	49764	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:50.007065058 CET	49758	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:50.007124901 CET	49760	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:50.007157087 CET	49763	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:50.007175922 CET	49764	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:50.572211981 CET	49765	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:50.572257996 CET	443	49765	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:50.572463036 CET	49765	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:50.573383093 CET	49765	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:50.573399067 CET	443	49765	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:50.574865103 CET	49766	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:50.574899912 CET	443	49766	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:50.574965954 CET	49766	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:50.576349974 CET	49766	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:50.576359034 CET	443	49766	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:51.219168901 CET	443	49766	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:51.219355106 CET	49766	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:51.219944000 CET	443	49766	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:51.220150948 CET	49766	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:51.222599983 CET	49766	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:51.222609043 CET	443	49766	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:51.222846985 CET	443	49766	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:51.222925901 CET	49766	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:51.223334074 CET	49766	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:51.224845886 CET	443	49765	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:51.224920988 CET	49765	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:51.225600958 CET	443	49765	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:51.225662947 CET	49765	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:51.235692024 CET	49765	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:51.235707045 CET	443	49765	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:51.235971928 CET	443	49765	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:51.236025095 CET	49765	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:51.236649990 CET	49765	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:51.267333031 CET	443	49766	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:51.283334017 CET	443	49765	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:51.609802008 CET	443	49766	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:51.609936953 CET	49766	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:51.609961033 CET	443	49766	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:51.610130072 CET	49766	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:51.610198021 CET	49766	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:51.610241890 CET	443	49766	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:51.610248089 CET	443	49765	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:51.610336065 CET	49766	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:51.610337019 CET	49765	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:51.610363960 CET	443	49765	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:51.610877991 CET	49770	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:51.610910892 CET	49771	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:51.610924006 CET	443	49770	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:51.610941887 CET	49765	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:51.610941887 CET	49765	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:51.610954046 CET	443	49771	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:51.610982895 CET	443	49765	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:51.611041069 CET	49770	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:51.611052990 CET	49771	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:51.611129045 CET	443	49765	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:51.611161947 CET	49765	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:51.611198902 CET	49765	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:51.611794949 CET	49773	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:51.611810923 CET	443	49773	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:51.611850977 CET	49772	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:51.611860991 CET	443	49772	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:51.611937046 CET	49773	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:51.611989021 CET	49772	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:51.612587929 CET	49773	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:51.612603903 CET	443	49773	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:51.612705946 CET	49772	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:51.612720013 CET	443	49772	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:51.613049984 CET	49771	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:51.613059998 CET	443	49771	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:51.613987923 CET	49770	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:51.614001036 CET	443	49770	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:52.239705086 CET	443	49771	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:52.239893913 CET	49771	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:52.240729094 CET	443	49772	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:52.241007090 CET	49772	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:52.241523027 CET	443	49772	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:52.241828918 CET	49772	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:52.242257118 CET	443	49770	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:52.242476940 CET	49770	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:52.243027925 CET	443	49770	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:52.243128061 CET	49770	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:52.253048897 CET	49770	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:52.253070116 CET	443	49770	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:52.253092051 CET	49772	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:52.253108978 CET	443	49772	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:52.253355026 CET	443	49770	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:52.253411055 CET	443	49772	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:52.253443003 CET	49770	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:52.253529072 CET	49772	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:52.254029036 CET	49770	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:52.254034996 CET	49772	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:52.255774975 CET	49771	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:52.255784988 CET	443	49771	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:52.256104946 CET	443	49771	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:52.260942936 CET	443	49773	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:52.261018038 CET	49771	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:52.261671066 CET	49773	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:52.268201113 CET	49773	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:52.268225908 CET	443	49773	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:52.268546104 CET	443	49773	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:52.268676996 CET	49771	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:52.268785000 CET	49773	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:52.269124031 CET	49773	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:52.295327902 CET	443	49770	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:52.295331001 CET	443	49772	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:52.315334082 CET	443	49771	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:52.315339088 CET	443	49773	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:52.653542995 CET	443	49770	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:52.653613091 CET	49770	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:52.653639078 CET	443	49770	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:52.653685093 CET	49770	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:52.655038118 CET	49770	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:52.655076027 CET	443	49770	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:52.655127048 CET	49770	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:52.655764103 CET	49776	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:52.655811071 CET	443	49776	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:52.655936003 CET	49776	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:52.656135082 CET	49776	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:52.656150103 CET	443	49776	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:52.667452097 CET	443	49772	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:52.667521000 CET	49772	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:52.667541981 CET	443	49772	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:52.667609930 CET	49772	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:52.667686939 CET	49772	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:52.667725086 CET	443	49772	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:52.667798996 CET	49772	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:52.668129921 CET	49777	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:52.668163061 CET	443	49777	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:52.668226957 CET	49777	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:52.668479919 CET	49777	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:52.668493986 CET	443	49777	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:52.873945951 CET	443	49771	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:52.874006033 CET	443	49771	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:52.874028921 CET	49771	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:52.874044895 CET	443	49771	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:52.874058008 CET	49771	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:52.874099016 CET	49771	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:52.874115944 CET	443	49771	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:52.874128103 CET	443	49771	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:52.874170065 CET	49771	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:52.874982119 CET	49771	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:52.874996901 CET	443	49771	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:52.875704050 CET	49778	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:52.875730038 CET	443	49778	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:52.875807047 CET	49778	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:52.876132011 CET	49778	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:52.876154900 CET	443	49778	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:52.916838884 CET	443	49773	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:52.916887999 CET	443	49773	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:52.916906118 CET	49773	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:52.916941881 CET	443	49773	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:52.916959047 CET	49773	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:52.917021990 CET	443	49773	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:52.917074919 CET	49773	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:52.918278933 CET	49773	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:52.918296099 CET	443	49773	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:52.918823957 CET	49779	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:52.918864965 CET	443	49779	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:52.918926001 CET	49779	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:52.919300079 CET	49779	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:52.919327021 CET	443	49779	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:53.445475101 CET	443	49776	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:53.445606947 CET	49776	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:53.446260929 CET	443	49776	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:53.446320057 CET	49776	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:53.449870110 CET	443	49777	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:53.449943066 CET	49777	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:53.450634003 CET	443	49777	142.250.185.110	192.168.2.4
Jan 2, 2025 20:31:53.450678110 CET	49777	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:31:53.537683964 CET	443	49778	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:53.537842989 CET	49778	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:31:53.579917908 CET	443	49779	142.250.186.161	192.168.2.4
Jan 2, 2025 20:31:53.579993963 CET	49779	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:32:07.429915905 CET	49777	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:32:07.429918051 CET	49739	80	192.168.2.4	69.42.215.252
Jan 2, 2025 20:32:07.430047035 CET	49776	443	192.168.2.4	142.250.185.110
Jan 2, 2025 20:32:07.430162907 CET	49778	443	192.168.2.4	142.250.186.161
Jan 2, 2025 20:32:07.430196047 CET	49779	443	192.168.2.4	142.250.186.161

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 2, 2025 20:31:45.304853916 CET	64415	53	192.168.2.4	1.1.1.1
Jan 2, 2025 20:31:45.311419010 CET	53	64415	1.1.1.1	192.168.2.4
Jan 2, 2025 20:31:46.183518887 CET	63390	53	192.168.2.4	1.1.1.1
Jan 2, 2025 20:31:46.190654039 CET	53	63390	1.1.1.1	192.168.2.4
Jan 2, 2025 20:31:46.201849937 CET	61367	53	192.168.2.4	1.1.1.1
Jan 2, 2025 20:31:46.208967924 CET	53	61367	1.1.1.1	192.168.2.4
Jan 2, 2025 20:31:46.337275028 CET	58382	53	192.168.2.4	1.1.1.1
Jan 2, 2025 20:31:46.344435930 CET	53	58382	1.1.1.1	192.168.2.4
Jan 2, 2025 20:31:50.894613981 CET	62275	53	192.168.2.4	1.1.1.1
Jan 2, 2025 20:31:50.901896954 CET	53	62275	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 2, 2025 20:31:45.304853916 CET	192.168.2.4	1.1.1.1	0x7987	Standard query (0)	docs.google.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:31:46.183518887 CET	192.168.2.4	1.1.1.1	0xd10e	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:31:46.201849937 CET	192.168.2.4	1.1.1.1	0xa629	Standard query (0)	freedns.afraid.org	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:31:46.337275028 CET	192.168.2.4	1.1.1.1	0xd53b	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:31:50.894613981 CET	192.168.2.4	1.1.1.1	0xa806	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 2, 2025 20:31:45.311419010 CET	1.1.1.1	192.168.2.4	0x7987	No error (0)	docs.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:31:46.190654039 CET	1.1.1.1	192.168.2.4	0xd10e	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:31:46.208967924 CET	1.1.1.1	192.168.2.4	0xa629	No error (0)	freedns.afraid.org		69.42.215.252	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:31:46.344435930 CET	1.1.1.1	192.168.2.4	0xd53b	No error (0)	drive.usercontent.google.com		142.250.186.161	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:31:50.901896954 CET	1.1.1.1	192.168.2.4	0xa806	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:32:27.952963114 CET	1.1.1.1	192.168.2.4	0xd7bc	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 20:32:27.952963114 CET	1.1.1.1	192.168.2.4	0xd7bc	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

docs.google.com

drive.usercontent.google.com

freedns.afraid.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49739	69.42.215.252	80	7024	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2025 20:31:46.215018034 CET	154	OUT	GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1 User-Agent: MyApp Host: freedns.afraid.org Cache-Control: no-cache
Jan 2, 2025 20:31:47.260576963 CET	243	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 02 Jan 2025 19:31:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Cache: MISS Data Raw: 31 66 0d 0a 45 52 52 4f 52 3a 20 43 6f 75 6c 64 20 6e 6f 74 20 61 75 74 68 65 6e 74 69 63 61 74 65 2e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 1fERROR: Could not authenticate.0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	142.250.185.110	443	7024	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:31:46 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:31:46 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:31:46 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-k1kzynUviFKm-o3jlqfjJQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49736	142.250.185.110	443	7024	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:31:46 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:31:46 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:31:46 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-fEjNX3HhTBJcU-C-umuRKg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49741	142.250.186.161	443	7024	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:31:46 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-02 19:31:47 UTC	1594	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4tOl-29wS6k84qHxToX2WixVZgIj661ISdsnkA1BoERt0HQM-ia29C_cUjG83Y5H29 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:31:47 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce--anNo_bVNguTJidWHyS_Wg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Length: 1652 Server: UploadServer Set-Cookie: NID=520=E7Kva_2TXV9tU-xhvFNe3uEsFnvrgAUBbz94lavT56wPDEdOg99fhPQrIFGN0EPu9_D4_0v4flfeNu6t16tIJsA01yw1M0WzBI-9ZX2NrQCrJNrrG5BZ1i8drDoxDvYiN-hVXYJUV4hAQ_cIJoF0oPglLhYD2E9hfK-DCZM9BxCd3s1cmWvsJos; expires=Fri, 04-Jul-2025 19:31:47 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:31:47 UTC	1594	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 54 59 42 72 38 69 6d 61 62 64 44 5a 43 59 69 47 79 35 78 61 4e 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="TYBr8imabdDZCYiGy5xaNQ">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-01-02 19:31:47 UTC	58	IN	Data Raw: 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: nd on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49740	142.250.185.110	443	7024	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:31:46 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:31:47 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:31:47 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-L4EajFu0L9cSw3fdp6eILg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49742	142.250.186.161	443	7024	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:31:47 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-02 19:31:47 UTC	1594	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4xUtMlCqwILzEGcwIjMltxP_tFmwT-fUuLxRDb2IS_71-H3pr6Jpf9KTFRHLeqPO0A Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:31:47 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-7osYibLeB_LCvr6be3hkRw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Set-Cookie: NID=520=jmjpy8C-HwaB0pXfxJynkCpW6IdEUtEUh4BQ9_4nTYV5czewC58-QHaMcyru7AgJavblhbUSa4K_67HMj0wx0A2I6ZDtkSnFt10V3ntT7UNMJkYD5ovgxXytk3nV3j5tLH56FjM8bCnYQB2jwzZ_WJswb9HqvG8moQB-OoWrfqg2m5Jx1jNQrnw; expires=Fri, 04-Jul-2025 19:31:47 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:31:47 UTC	1594	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 45 45 54 6d 2d 55 4b 31 53 79 4a 32 70 44 30 41 58 7a 61 5a 7a 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="EETm-UK1SyJ2pD0AXzaZzA">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-01-02 19:31:47 UTC	58	IN	Data Raw: 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: nd on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49743	142.250.185.110	443	7024	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:31:47 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:31:47 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:31:47 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-uOFi3s-9Hwm_GLT4O_HTxw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49745	142.250.185.110	443	7024	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:31:48 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:31:48 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:31:48 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-QcQ4q-0BcJzv8ZsRFRQf6A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49746	142.250.185.110	443	7024	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:31:48 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:31:48 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:31:48 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-eIA46StM12XrJ0f3rcdtgQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49747	142.250.186.161	443	7024	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:31:48 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-02 19:31:48 UTC	1594	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5gCrnj20n6xOM87ocXMo2e4FNCH_1hPqKE4JbaSTTvZccVScRew-TuDBRqt46nb44l Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:31:48 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-7oZ7VjXZJp8uPk4htv1g2Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Set-Cookie: NID=520=LgUFhhPBqawLki2Ox4f0k8nktyVgTqfUiaMqHVYdMpb4jdttmjxK0GVQBWkzGRlG42lzGmyTgtP8GvLZ2BbgnLnua-cwIa2jb9WO5DMea-FYHyAjlBUQir_CR2L37YBxEyJdazkhnjZDE6BtJeBO-qUpnSfbH_gL-fzQRrORgUnQqqVtQ2eBfms; expires=Fri, 04-Jul-2025 19:31:48 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:31:48 UTC	1594	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 31 35 79 56 50 58 66 62 31 45 45 76 36 39 30 70 30 57 6d 4c 68 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="15yVPXfb1EEv690p0WmLhg">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-01-02 19:31:48 UTC	58	IN	Data Raw: 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: nd on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49748	142.250.186.161	443	7024	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:31:48 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=E7Kva_2TXV9tU-xhvFNe3uEsFnvrgAUBbz94lavT56wPDEdOg99fhPQrIFGN0EPu9_D4_0v4flfeNu6t16tIJsA01yw1M0WzBI-9ZX2NrQCrJNrrG5BZ1i8drDoxDvYiN-hVXYJUV4hAQ_cIJoF0oPglLhYD2E9hfK-DCZM9BxCd3s1cmWvsJos
2025-01-02 19:31:48 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5KzMMeBV1JtD4F3VGvqo7VOsgvrb-buJO_jtAiH_jHhM1d177YjYa4Iz6yvkMP8pN5BgAYG-8 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:31:48 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-b3xTyg5CgVNyYpUJ2ftxRA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:31:48 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:31:48 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 77 73 65 68 6b 71 50 33 56 76 4c 42 31 74 38 5a 34 69 72 4c 6f 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="wsehkqP3VvLB1t8Z4irLoA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:31:48 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49751	142.250.185.110	443	7024	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:31:49 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:31:49 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:31:49 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-Fmx9SZmvcVx5cxNdd10DoA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49754	142.250.185.110	443	7024	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:31:49 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:31:49 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:31:49 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-7JfXhyWI7Yt2jb42pwiO1w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49753	142.250.186.161	443	7024	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:31:49 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=jmjpy8C-HwaB0pXfxJynkCpW6IdEUtEUh4BQ9_4nTYV5czewC58-QHaMcyru7AgJavblhbUSa4K_67HMj0wx0A2I6ZDtkSnFt10V3ntT7UNMJkYD5ovgxXytk3nV3j5tLH56FjM8bCnYQB2jwzZ_WJswb9HqvG8moQB-OoWrfqg2m5Jx1jNQrnw
2025-01-02 19:31:49 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4IpPwBg9i8leVa8-u1U-lHauAkfvQvkrnrhkj19QeLLRfaTfPbYUwnMeBW3n-ZeeLJ Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:31:49 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-vuaB6E5mB1t7SdM5BnPpjw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:31:49 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:31:49 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6c 45 38 5a 4a 34 54 33 4f 63 34 71 4c 75 7a 6f 62 7a 65 73 4f 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="lE8ZJ4T3Oc4qLuzobzesOQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:31:49 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49755	142.250.186.161	443	7024	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:31:49 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=LgUFhhPBqawLki2Ox4f0k8nktyVgTqfUiaMqHVYdMpb4jdttmjxK0GVQBWkzGRlG42lzGmyTgtP8GvLZ2BbgnLnua-cwIa2jb9WO5DMea-FYHyAjlBUQir_CR2L37YBxEyJdazkhnjZDE6BtJeBO-qUpnSfbH_gL-fzQRrORgUnQqqVtQ2eBfms
2025-01-02 19:31:49 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC55aAmwFiLfgCqnVxAJU3o8cTYJ_NJzqVSAR7VEucoGRyhjN-4tlTODCaP2W0mv_S6p Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:31:49 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-1kniKR0S_lOpjzjjJOR9bQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:31:49 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:31:49 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 75 71 75 76 37 57 71 78 33 77 78 51 34 6e 30 46 78 46 55 32 74 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="uquv7Wqx3wxQ4n0FxFU2tQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:31:49 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49766	142.250.185.110	443	7024	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:31:51 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:31:51 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:31:51 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-zIYJz4e8ukzjpSvX4zMMzw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49765	142.250.185.110	443	7024	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:31:51 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:31:51 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:31:51 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-yHRgSl2Lu8PMns6sNvYn6A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49772	142.250.185.110	443	7024	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:31:52 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:31:52 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:31:52 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-omzPHJyGAzts6M4XZ7OgpA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49770	142.250.185.110	443	7024	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:31:52 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:31:52 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:31:52 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-tWrtFECJPPJdG5Q6Yu5AvQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49771	142.250.186.161	443	7024	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:31:52 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=LgUFhhPBqawLki2Ox4f0k8nktyVgTqfUiaMqHVYdMpb4jdttmjxK0GVQBWkzGRlG42lzGmyTgtP8GvLZ2BbgnLnua-cwIa2jb9WO5DMea-FYHyAjlBUQir_CR2L37YBxEyJdazkhnjZDE6BtJeBO-qUpnSfbH_gL-fzQRrORgUnQqqVtQ2eBfms
2025-01-02 19:31:52 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7uLwpxtdXvp5lnUWwXNeO_16aLHSE7ULAc-ZO6-nLSoa8rh8Gb1MOIVaN42E4SLY97Y1sbtPU Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:31:52 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-GPF_J_uQOgm8zHUi_8y0Gg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:31:52 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:31:52 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4d 42 75 42 43 55 69 31 56 39 39 65 51 41 39 38 61 71 65 64 35 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="MBuBCUi1V99eQA98aqed5Q">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:31:52 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49773	142.250.186.161	443	7024	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:31:52 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=LgUFhhPBqawLki2Ox4f0k8nktyVgTqfUiaMqHVYdMpb4jdttmjxK0GVQBWkzGRlG42lzGmyTgtP8GvLZ2BbgnLnua-cwIa2jb9WO5DMea-FYHyAjlBUQir_CR2L37YBxEyJdazkhnjZDE6BtJeBO-qUpnSfbH_gL-fzQRrORgUnQqqVtQ2eBfms
2025-01-02 19:31:52 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6jVyUz9JVphhW8f05i69uFWscCnbCw7Iw8WKsiDwsh8xCuNB28RU2zSbnOjSyWj4upexFp5gc Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:31:52 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-4fsXioiz3Huv1uK1EhXi5g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:31:52 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:31:52 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4a 72 4b 30 6c 72 62 34 43 52 57 77 59 61 6e 75 36 79 33 37 51 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="JrK0lrb4CRWwYanu6y37QA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:31:52 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Target ID:	0
Start time:	14:31:32
Start date:	02/01/2025
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	15'745'536 bytes
MD5 hash:	7E33585D157419E39FB4D232C9F0C5DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: 00000000.00000000.1717369613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000000.00000000.1717369613.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	14:31:34
Start date:	02/01/2025
Path:	C:\Users\user\Desktop\._cache_file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\._cache_file.exe"
Imagebase:	0x900000
File size:	14'974'024 bytes
MD5 hash:	F0248D477E74687C5619AE16498B13D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	14:31:34
Start date:	02/01/2025
Path:	C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Temp\{857E71F0-569F-4069-9DBC-4DC89A8122EE}\.cr\._cache_file.exe" -burn.clean.room="C:\Users\user\Desktop\._cache_file.exe" -burn.filehandle.attached=544 -burn.filehandle.self=648
Imagebase:	0xce0000
File size:	647'704 bytes
MD5 hash:	843288FD72A1152B50B4E4B7344BB592
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	14:31:36
Start date:	02/01/2025
Path:	C:\ProgramData\Synaptics\Synaptics.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
Imagebase:	0x400000
File size:	771'584 bytes
MD5 hash:	B753207B14C635F29B2ABF64F603570A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: 00000003.00000003.1828103351.00000000006C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 87%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:31:38
Start date:	02/01/2025
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Imagebase:	0x710000
File size:	53'161'064 bytes
MD5 hash:	4A871771235598812032C822E6F68F19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	14:31:44
Start date:	02/01/2025
Path:	C:\ProgramData\Synaptics\Synaptics.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Synaptics\Synaptics.exe"
Imagebase:	0x400000
File size:	771'584 bytes
MD5 hash:	B753207B14C635F29B2ABF64F603570A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	14:31:52
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7024 -s 3880
Imagebase:	0x510000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	14:31:52
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7024 -s 3928
Imagebase:	0x510000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 0090508D Relevance: 44.1, APIs: 5, Strings: 20, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?), ref: 0090510F

Part of subcall function 009403F0: InitializeCriticalSection.KERNEL32(0096B60C,?,0090511B,00000000,?,?,?,?,?,?), ref: 00940407

Part of subcall function 00901209: CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,00905137,00000000,?), ref: 00901247
Part of subcall function 00901209: GetLastError.KERNEL32(?,?,?,00905137,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 00901251

CoInitializeEx.COMBASE(00000000,00000000,?,?,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 0090517D

Part of subcall function 00940CD1: GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 00940CF2

GetVersionExW.KERNEL32(?,?,?,?,?,?,?), ref: 0090520F
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 00905219
CoUninitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0090549B

Strings

Failed to run embedded mode., xrefs: 0090533C
Failed to run untrusted mode., xrefs: 009053AE
Failed to run RunOnce mode., xrefs: 00905314
Setup, xrefs: 009053FC
Failed to get OS info., xrefs: 00905247
Failed to initialize COM., xrefs: 00905189
Failed to initialize Cryputil., xrefs: 0090519E
_Failed, xrefs: 009053F7
Invalid run mode., xrefs: 009052F1
Failed to run per-machine mode., xrefs: 00905364
engine.cpp, xrefs: 0090523D
Failed to initialize Regutil., xrefs: 009051C1
Failed to initialize engine state., xrefs: 00905164
3.10.4.4718, xrefs: 0090527C
Failed to initialize XML util., xrefs: 009051F1
Failed to run per-user mode., xrefs: 0090538C
txt, xrefs: 009053F2
Failed to initialize core., xrefs: 009052BB
Failed to parse command line., xrefs: 0090513D
Failed to initialize Wiutil., xrefs: 009051D9

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorInitializeLast$AddressArgvCommandCriticalHandleLineModuleProcSectionUninitializeVersion
String ID: 3.10.4.4718$Failed to get OS info.$Failed to initialize COM.$Failed to initialize Cryputil.$Failed to initialize Regutil.$Failed to initialize Wiutil.$Failed to initialize XML util.$Failed to initialize core.$Failed to initialize engine state.$Failed to parse command line.$Failed to run RunOnce mode.$Failed to run embedded mode.$Failed to run per-machine mode.$Failed to run per-user mode.$Failed to run untrusted mode.$Invalid run mode.$Setup$_Failed$engine.cpp$txt
API String ID: 3262001429-867073019
Opcode ID: 142f027ddb847526efea6097a4af06f5a7f179151f7da70e9940495931e773c4
Instruction ID: be378f876f4017e21bcd6137c0256bacfb10d7dd03d8b5e45e05851ebc10ac9c
Opcode Fuzzy Hash: 142f027ddb847526efea6097a4af06f5a7f179151f7da70e9940495931e773c4
Instruction Fuzzy Hash: A9B1B572D45A299FDB32AF64CC46FEF76A8AF84705F020195F908B6291D770DE808F91

Function 00942F23 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 152libraryloadercomCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,009434DF,00000000,?,00000000), ref: 00942F3D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,0092BDED,?,009052FD,?,00000000,?), ref: 00942F49
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00942F89
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00942F95
GetProcAddress.KERNEL32(00000000,Wow64EnableWow64FsRedirection), ref: 00942FA0
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00942FAA
CoCreateInstance.OLE32(0096B6C8,00000000,00000001,0094B808,?,?,?,?,?,?,?,?,?,?,?,0092BDED), ref: 00942FE5
ExitProcess.KERNEL32 ref: 00943094

Strings

Wow64EnableWow64FsRedirection, xrefs: 00942F97
Wow64RevertWow64FsRedirection, xrefs: 00942FA2
kernel32.dll, xrefs: 00942F2D
xmlutil.cpp, xrefs: 00942F6D
IsWow64Process, xrefs: 00942F83
Wow64DisableWow64FsRedirection, xrefs: 00942F8F

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: AddressProc$CreateErrorExitHandleInstanceLastModuleProcess
String ID: IsWow64Process$Wow64DisableWow64FsRedirection$Wow64EnableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$xmlutil.cpp
API String ID: 2124981135-499589564
Opcode ID: 325181d8fb0c98ff6ca5894708530cfb049827cef2639cb4080f0d7b625b97d8
Instruction ID: 8d7575982389d2b5da09478ef743772104a0c16399f6ef0816632d285248113e
Opcode Fuzzy Hash: 325181d8fb0c98ff6ca5894708530cfb049827cef2639cb4080f0d7b625b97d8
Instruction Fuzzy Hash: B541AF31A01315ABDB249FB8C854FAEB7F8EF44710F1182A9F901EB250EB71DE408B90

Function 00901070 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 77fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009033D7: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,009010DD,?,00000000), ref: 009033F8

CreateFileW.KERNELBASE(?,80000000,00000005,00000000,00000003,00000080,00000000,?,00000000), ref: 009010F6

Part of subcall function 00901174: HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,0090111A,cabinet.dll,00000009,?,?,00000000), ref: 00901185
Part of subcall function 00901174: GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,0090111A,cabinet.dll,00000009,?,?,00000000), ref: 00901190
Part of subcall function 00901174: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0090119E
Part of subcall function 00901174: GetLastError.KERNEL32(?,?,?,?,0090111A,cabinet.dll,00000009,?,?,00000000), ref: 009011B9
Part of subcall function 00901174: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 009011C1
Part of subcall function 00901174: GetLastError.KERNEL32(?,?,?,?,0090111A,cabinet.dll,00000009,?,?,00000000), ref: 009011D6

CloseHandle.KERNEL32(?,?,?,?,0094B4C0,?,cabinet.dll,00000009,?,?,00000000), ref: 00901131

Strings

comres.dll, xrefs: 009010B5
msi.dll, xrefs: 009010A0
msasn1.dll, xrefs: 009010C3
crypt32.dll, xrefs: 009010CA
clbcatq.dll, xrefs: 009010BC
cabinet.dll, xrefs: 00901099
version.dll, xrefs: 009010A7
feclient.dll, xrefs: 009010D1
wininet.dll, xrefs: 009010AE

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: AddressErrorFileHandleLastModuleProc$CloseCreateHeapInformationName
String ID: cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$feclient.dll$msasn1.dll$msi.dll$version.dll$wininet.dll
API String ID: 3687706282-3151496603
Opcode ID: 4dbd374dc94a3a7729150a92f64c89a5b7e5ade43e24b7a3902702ad8d40ffa2
Instruction ID: 670f30bafded32cc1ca574d7ba200bf990cd8e3a6f26b668f810070a7e06c577
Opcode Fuzzy Hash: 4dbd374dc94a3a7729150a92f64c89a5b7e5ade43e24b7a3902702ad8d40ffa2
Instruction Fuzzy Hash: 88213D71900218AFDB209FA5DC45FEEBBF9AF45724F504119EA14B72E1D7709908CBA4

Function 00919EB7 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51COMMON

Download Yara Rule

Strings

Failed to calculate working folder to ensure it exists., xrefs: 00919ED4
Failed create working folder., xrefs: 00919EEA
Failed to copy working folder., xrefs: 00919F12

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CurrentDirectoryErrorLastProcessWindows
String ID: Failed create working folder.$Failed to calculate working folder to ensure it exists.$Failed to copy working folder.
API String ID: 3841436932-2072961686
Opcode ID: 443ded090887d57b49cb6c111c7913b55a29b12eb5ed671b83e760962e2770a5
Instruction ID: b39092a224ef2a9053863132ff09b8a7119c5cf99ff93db3c87f517a3019114a
Opcode Fuzzy Hash: 443ded090887d57b49cb6c111c7913b55a29b12eb5ed671b83e760962e2770a5
Instruction Fuzzy Hash: B3018432E0862CBB8B229B55DC16DEF7A79DFD5721B104165FD04B6211DB318E80A6D0

Function 009038D4 Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,000001C7,?,00902284,000001C7,00000001,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 009038E5
RtlAllocateHeap.NTDLL(00000000,?,00902284,000001C7,00000001,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 009038EC

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 8e236d17edde9ef6ea793ce7c6988929f647ab400a94e969d5aff66d02e1ef29
Instruction ID: d85fc2657b0baa49a4bf2fcddf87a990805d38717c39cc4488d581a7035adaf4
Opcode Fuzzy Hash: 8e236d17edde9ef6ea793ce7c6988929f647ab400a94e969d5aff66d02e1ef29
Instruction Fuzzy Hash: D9C012361A8208AB8B006FF8EC0EC9A3BACAB2A6027008400B905C2110CB3CE014AB60

Function 0090F86E Relevance: 112.4, APIs: 3, Strings: 61, Instructions: 445
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Manufacturer, xrefs: 0090FCDD
Failed to select Update node., xrefs: 0090FCC6
Failed to set registration paths., xrefs: 0090FD92
button, xrefs: 0090FB9F
Failed to get @DisableRemove., xrefs: 0090FC6A
ExecutableName, xrefs: 0090F97E
Failed to get @HelpTelephone., xrefs: 0090FAB3
Failed to get @ProviderKey., xrefs: 0090F970
UpdateUrl, xrefs: 0090FAE6
HelpLink, xrefs: 0090FA77
AboutUrl, xrefs: 0090FAC1
Publisher, xrefs: 0090FA52
Failed to get @DisableModify., xrefs: 0090FC42
Department, xrefs: 0090FD01
DisplayVersion, xrefs: 0090FA2D
Failed to select ARP node., xrefs: 0090F9D9
registration.cpp, xrefs: 0090FC11
Failed to get @PerMachine., xrefs: 0090F9AF
Classification, xrefs: 0090FD6C
Comments, xrefs: 0090FB33
Failed to get @Version., xrefs: 0090F92E
Failed to get @Comments., xrefs: 0090FB4A
Register, xrefs: 0090F9E7
ProductFamily, xrefs: 0090FD26
DisableModify, xrefs: 0090FB80
Failed to get @Tag., xrefs: 0090F8F4
ParentDisplayName, xrefs: 0090FB0B
Failed to parse @Version: %ls, xrefs: 0090F94F
Failed to get @Manufacturer., xrefs: 0090FCF0
DisplayName, xrefs: 0090FA08
Failed to parse related bundles, xrefs: 0090F90D
Failed to get @Publisher., xrefs: 0090FA69
Failed to get @Register., xrefs: 0090F9FA
ProviderKey, xrefs: 0090F95D
Failed to get @Classification., xrefs: 0090FD7F
DisableRemove, xrefs: 0090FC53
Failed to get @DisplayVersion., xrefs: 0090FA44
yes, xrefs: 0090FBC0
Version, xrefs: 0090F91B
Update, xrefs: 0090FCA8
Failed to get @HelpLink., xrefs: 0090FA8E
Failed to get @Department., xrefs: 0090FD18
Failed to parse software tag., xrefs: 0090FC9A
HelpTelephone, xrefs: 0090FA9C
Failed to get @ParentDisplayName., xrefs: 0090FB22
Registration, xrefs: 0090F888
Invalid modify disabled type: %ls, xrefs: 0090FC1E
Failed to select registration node., xrefs: 0090F8A6
Failed to get @ProductFamily., xrefs: 0090FD3D
Failed to get @DisplayName., xrefs: 0090FA1F
Failed to get @ExecutableName., xrefs: 0090F991
Contact, xrefs: 0090FB5B
Failed to get @Id., xrefs: 0090F8D3
Arp, xrefs: 0090F9BD
Failed to get @UpdateUrl., xrefs: 0090FAFD
PerMachine, xrefs: 0090F99C
Failed to get @AboutUrl., xrefs: 0090FAD8
Failed to get @Name., xrefs: 0090FD5E
Name, xrefs: 0090FD4B
Failed to get @Contact., xrefs: 0090FB72
Tag, xrefs: 0090F8E1

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID:
String ID: AboutUrl$Arp$Classification$Comments$Contact$Department$DisableModify$DisableRemove$DisplayName$DisplayVersion$ExecutableName$Failed to get @AboutUrl.$Failed to get @Classification.$Failed to get @Comments.$Failed to get @Contact.$Failed to get @Department.$Failed to get @DisableModify.$Failed to get @DisableRemove.$Failed to get @DisplayName.$Failed to get @DisplayVersion.$Failed to get @ExecutableName.$Failed to get @HelpLink.$Failed to get @HelpTelephone.$Failed to get @Id.$Failed to get @Manufacturer.$Failed to get @Name.$Failed to get @ParentDisplayName.$Failed to get @PerMachine.$Failed to get @ProductFamily.$Failed to get @ProviderKey.$Failed to get @Publisher.$Failed to get @Register.$Failed to get @Tag.$Failed to get @UpdateUrl.$Failed to get @Version.$Failed to parse @Version: %ls$Failed to parse related bundles$Failed to parse software tag.$Failed to select ARP node.$Failed to select Update node.$Failed to select registration node.$Failed to set registration paths.$HelpLink$HelpTelephone$Invalid modify disabled type: %ls$Manufacturer$Name$ParentDisplayName$PerMachine$ProductFamily$ProviderKey$Publisher$Register$Registration$Tag$Update$UpdateUrl$Version$button$registration.cpp$yes
API String ID: 0-2956246334
Opcode ID: 191973f1ee7a816b92ef2e57df2a3965a4b03ded80e1ed8d671b62b3a797fb9f
Instruction ID: 00cd0c47e8a63d37925c4c0d4043afedab744d14e563339cd82d7822946071fa
Opcode Fuzzy Hash: 191973f1ee7a816b92ef2e57df2a3965a4b03ded80e1ed8d671b62b3a797fb9f
Instruction Fuzzy Hash: EFE1F232E44729BFCB31DAB0CC62FAD7AA8AB44719F114674FD14B6AD0D760AF449780

Function 0090B389 Relevance: 91.6, APIs: 24, Strings: 28, Instructions: 565
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,00000000,76EEC3F0,00000000), ref: 0090B3FF
SetFilePointerEx.KERNELBASE(000000FF,00000000,00000000,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0090B44C
GetLastError.KERNEL32(?,?,?,00000000,76EEC3F0,00000000), ref: 0090B452
ReadFile.KERNELBASE(00000000,0090435C,00000040,?,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0090B49A
GetLastError.KERNEL32(?,?,?,00000000,76EEC3F0,00000000), ref: 0090B4A0
SetFilePointerEx.KERNELBASE(00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0090B4FD
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0090B503
ReadFile.KERNELBASE(00000000,?,00000018,00000040,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0090B54C
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0090B552
SetFilePointerEx.KERNELBASE(00000000,-00000098,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0090B5C3
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0090B5C9

Strings

Failed to find valid NT image header in buffer., xrefs: 0090BACC
Failed to read section info, unsupported version: %08x, xrefs: 0090B8F1
(, xrefs: 0090B719
Failed to find Burn section., xrefs: 0090BA2E
Failed to find valid DOS image header in buffer., xrefs: 0090BAE7
PE Header from file didn't match PE Header in memory., xrefs: 0090BA0D
PE, xrefs: 0090B594
Failed to allocate buffer for section info., xrefs: 0090B7E0
Failed to read section info., xrefs: 0090B895
Failed to read section info, data to short: %u, xrefs: 0090B7A6
.wix, xrefs: 0090B72C
Failed to read image section header, index: %u, xrefs: 0090BAA8
burn, xrefs: 0090B734
Failed to get total size of bundle., xrefs: 0090B91F
Failed to read NT header., xrefs: 0090B57D
Failed to read signature offset., xrefs: 0090B643
Failed to read signature size., xrefs: 0090B692
Failed to read complete image section header, index: %u, xrefs: 0090BA71
Failed to seek to NT header., xrefs: 0090B52E
Failed to allocate memory for container sizes., xrefs: 0090B9CF
Failed to read DOS header., xrefs: 0090B4CB
4, xrefs: 0090B780
section.cpp, xrefs: 0090B420, 0090B473, 0090B4C1, 0090B524, 0090B573, 0090B5EA, 0090B639, 0090B688, 0090B6DD, 0090B794, 0090B7D4, 0090B826, 0090B88B, 0090B8B5, 0090B8DC, 0090B9C3, 0090BA03, 0090BA22, 0090BA5F, 0090BA9D, 0090BAC0, 0090BADB
Failed to seek past optional headers., xrefs: 0090B6E7
Failed to open handle to engine process path., xrefs: 0090B42A
Failed to seek to start of file., xrefs: 0090B47D
Failed to read complete section info., xrefs: 0090B8C1
Failed to seek to section info., xrefs: 0090B5F4, 0090B830

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorLast$File$Pointer$Read
String ID: ($.wix$4$Failed to allocate buffer for section info.$Failed to allocate memory for container sizes.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get total size of bundle.$Failed to open handle to engine process path.$Failed to read DOS header.$Failed to read NT header.$Failed to read complete image section header, index: %u$Failed to read complete section info.$Failed to read image section header, index: %u$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$Failed to read section info.$Failed to read signature offset.$Failed to read signature size.$Failed to seek past optional headers.$Failed to seek to NT header.$Failed to seek to section info.$Failed to seek to start of file.$PE$PE Header from file didn't match PE Header in memory.$burn$section.cpp
API String ID: 2600052162-695169583
Opcode ID: bd5b85b362a0ea827a934fef78352c80f980f6c42257f064b1580d2c94c073a9
Instruction ID: 6caa934dfa9edb94be15eed44e79f706126dd62b58105b7176cee8b23fa216f5
Opcode Fuzzy Hash: bd5b85b362a0ea827a934fef78352c80f980f6c42257f064b1580d2c94c073a9
Instruction Fuzzy Hash: C0128F75E40325AFEB209A25CC45FAB76E8EF85710F0141A5FD09EB2C1D7758E40DBA2

Function 00920A77 Relevance: 54.5, APIs: 20, Strings: 11, Instructions: 288
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEvent.KERNEL32(?,?,?,?,00000000,00000000,?,00920621,?,?), ref: 00920A85
GetLastError.KERNEL32(?,?,?,00000000,00000000,?,00920621,?,?), ref: 00920A92
WaitForSingleObject.KERNEL32(?,?,?,?,?,00000000,00000000,?,00920621,?,?), ref: 00920ACE
GetLastError.KERNEL32(?,?,?,?,00000000,00000000,?,00920621,?,?), ref: 00920AD8

Strings

Failed to allocate buffer for stream., xrefs: 00920CC8
cabextract.cpp, xrefs: 00920AB6, 00920AFC, 00920B41, 00920B6D, 00920CBE, 00920D2B, 00920D7D, 00920DC2, 00920E16
Failed to set file pointer to beginning of file., xrefs: 00920E20
Failed to reset begin operation event., xrefs: 00920B4B
Failed to set operation complete event., xrefs: 00920AC0
Failed to set file pointer to end of file., xrefs: 00920D87
Failed to create file: %ls, xrefs: 00920D38
Failed to set end of file., xrefs: 00920DCC
Failed to wait for begin operation event., xrefs: 00920B06
Invalid operation for this state., xrefs: 00920B79
Failed to copy stream name: %ls, xrefs: 00920BB7

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorLast$EventObjectSingleWait
String ID: Failed to allocate buffer for stream.$Failed to copy stream name: %ls$Failed to create file: %ls$Failed to reset begin operation event.$Failed to set end of file.$Failed to set file pointer to beginning of file.$Failed to set file pointer to end of file.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$cabextract.cpp
API String ID: 3600396749-2104912459
Opcode ID: 35c9e5b97dd780b97ccd033345830e4862aaa4614245c29a14c6a1296dc89803
Instruction ID: 49bd69e72d4627a6226b2d68e24ea8fa799db0088ae9d62ad16262ef50334ceb
Opcode Fuzzy Hash: 35c9e5b97dd780b97ccd033345830e4862aaa4614245c29a14c6a1296dc89803
Instruction Fuzzy Hash: 74913476A40331BFE7209A7A9D49F673AD8EF88711F014225FE09EA5A5E364CC0097D5

Function 00904C33 Relevance: 38.7, APIs: 6, Strings: 16, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009033D7: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,009010DD,?,00000000), ref: 009033F8

CloseHandle.KERNEL32(00000000,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00904E3A
CloseHandle.KERNEL32(000000FF,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00904E49
CloseHandle.KERNEL32(000000FF,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00904E58
CloseHandle.KERNEL32(?,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00904E63

Strings

Failed to allocate parameters for unelevated process., xrefs: 00904CF4
Failed to allocate full command-line., xrefs: 00904D88
Failed to wait for clean room process: %ls, xrefs: 00904E1D
Failed to launch clean room process: %ls, xrefs: 00904DF1
burn.clean.room, xrefs: 00904CD8
engine.cpp, xrefs: 00904DE4
D, xrefs: 00904DA3
burn.filehandle.self, xrefs: 00904D3F
%ls %ls, xrefs: 00904D4F
Failed to cache to clean room., xrefs: 00904CBC
burn.filehandle.attached, xrefs: 00904D11
"%ls" %ls, xrefs: 00904D74
Failed to get path for current process., xrefs: 00904C7D
Failed to append original command line., xrefs: 00904D63
Failed to append %ls, xrefs: 00904D16
-%ls="%ls", xrefs: 00904CE0

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CloseHandle$FileModuleName
String ID: "%ls" %ls$%ls %ls$-%ls="%ls"$D$Failed to allocate full command-line.$Failed to allocate parameters for unelevated process.$Failed to append %ls$Failed to append original command line.$Failed to cache to clean room.$Failed to get path for current process.$Failed to launch clean room process: %ls$Failed to wait for clean room process: %ls$burn.clean.room$burn.filehandle.attached$burn.filehandle.self$engine.cpp
API String ID: 3884789274-2391192076
Opcode ID: de9009378028defc59d5189674788f326def101fea454d8a31579a03626d0d49
Instruction ID: fd68bd93d999ef9f9b405d3b009906ac62b6f53a880b7b11bd95bd8cf04beb35
Opcode Fuzzy Hash: de9009378028defc59d5189674788f326def101fea454d8a31579a03626d0d49
Instruction Fuzzy Hash: 9D717272D00229AFDF219BA4CC81EEFBBBCEF44714F104265FA14B62D1D7749A419BA1

Function 00917337 Relevance: 35.3, APIs: 1, Strings: 19, Instructions: 277
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to open attached UX container., xrefs: 0091739B
Failed to set original source variable., xrefs: 00917558
WixBundleOriginalSource, xrefs: 00917547
Failed to load manifest., xrefs: 009173F5
Failed to get unique temporary folder for bootstrapper application., xrefs: 009175BC
Failed to open manifest stream., xrefs: 009173B8
Failed to extract bootstrapper application payloads., xrefs: 009175DD
Failed to initialize variables., xrefs: 0091737E
Failed to set source process folder variable., xrefs: 00917533
WixBundleElevated, xrefs: 009174B3, 009174C4
WixBundleSourceProcessFolder, xrefs: 00917522
Failed to load catalog files., xrefs: 009175FD
Failed to overwrite the %ls built-in variable., xrefs: 009174C9
Failed to get manifest stream from container., xrefs: 009173D9
WixBundleSourceProcessPath, xrefs: 009174E6
Failed to set source process path variable., xrefs: 009174F7
Failed to get source process folder from path., xrefs: 00917513
Failed to initialize internal cache functionality., xrefs: 0091758D
Failed to parse command line., xrefs: 00917474

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: Failed to extract bootstrapper application payloads.$Failed to get manifest stream from container.$Failed to get source process folder from path.$Failed to get unique temporary folder for bootstrapper application.$Failed to initialize internal cache functionality.$Failed to initialize variables.$Failed to load catalog files.$Failed to load manifest.$Failed to open attached UX container.$Failed to open manifest stream.$Failed to overwrite the %ls built-in variable.$Failed to parse command line.$Failed to set original source variable.$Failed to set source process folder variable.$Failed to set source process path variable.$WixBundleElevated$WixBundleOriginalSource$WixBundleSourceProcessFolder$WixBundleSourceProcessPath
API String ID: 32694325-252221001
Opcode ID: 17e4f171968f04d4ae33596650850e307672bd52494b321bf054cd17b62092a2
Instruction ID: 20a5f5364373da7f86f6e901a4212bda24aa8de833ab2d3d62bee30ea028c4ff
Opcode Fuzzy Hash: 17e4f171968f04d4ae33596650850e307672bd52494b321bf054cd17b62092a2
Instruction Fuzzy Hash: BD916172B48A1EBBCB12DAE4CC41FEEF77CAF44744F014626F915A6141D734AA848BA1

Function 009184C4 Relevance: 35.2, APIs: 9, Strings: 11, Instructions: 205
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,40000000,00000005,00000000,00000002,08000080,00000000,?,00000000,00000000,00904CB6,?,?,00000000,00904CB6,00000000), ref: 00918507
GetLastError.KERNEL32 ref: 00918514
CloseHandle.KERNELBASE(00000000,?,00000000,0094B4F0,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 009186F6

Strings

Failed to update signature offset., xrefs: 00918615
Failed to zero out original data offset., xrefs: 009186E8
Failed to seek to original data in exe burn section header., xrefs: 009186CF
Failed to seek to beginning of engine file: %ls, xrefs: 0091856D
msi.dll, xrefs: 00918608
Failed to seek to signature table in exe header., xrefs: 00918660
Failed to copy engine from: %ls to: %ls, xrefs: 0091859C
cache.cpp, xrefs: 00918538, 009185EF, 00918656, 009186C5
Failed to seek to checksum in exe header., xrefs: 009185F9
Failed to create engine file at path: %ls, xrefs: 00918545
cabinet.dll, xrefs: 0091866F

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: Failed to copy engine from: %ls to: %ls$Failed to create engine file at path: %ls$Failed to seek to beginning of engine file: %ls$Failed to seek to checksum in exe header.$Failed to seek to original data in exe burn section header.$Failed to seek to signature table in exe header.$Failed to update signature offset.$Failed to zero out original data offset.$cabinet.dll$cache.cpp$msi.dll
API String ID: 2528220319-1976062716
Opcode ID: bb32881949293a3a858ac47a202af3010663166432218472a8bc4688219d6b6b
Instruction ID: 37aa7c1d6c957f829bebf0b1a8b9916191bca9543ebc97e38479f878b6fc0020
Opcode Fuzzy Hash: bb32881949293a3a858ac47a202af3010663166432218472a8bc4688219d6b6b
Instruction Fuzzy Hash: 2B510672B40229BFF711AA699C45FBB76ACEB88751F010129FE00F7180EB64CD00A7E5

Function 00907503 Relevance: 33.4, APIs: 1, Strings: 21, Instructions: 378
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(00917378,009052B5,00000000,0090533D), ref: 00907523

Strings

WixBundleExecutePackageAction, xrefs: 00907CCE
WixBundleForcedRestartPackage, xrefs: 00907CF0
WixBundleAction, xrefs: 00907C90
', xrefs: 009077E2
0, xrefs: 0090753D
InstallerName, xrefs: 009076F8
WixBundleElevated, xrefs: 00907D2E
WixBundleSourceProcessFolder, xrefs: 00907D86
WixBundleVersion, xrefs: 00907DAC
InstallerVersion, xrefs: 0090771E
$, xrefs: 00907C54
WixBundleActiveParent, xrefs: 00907D47
Date, xrefs: 00907642
WixBundleTag, xrefs: 00907D99
WixBundleSourceProcessPath, xrefs: 00907D6D
WixBundleInstalled, xrefs: 00907D12
Failed to add built-in variable: %ls., xrefs: 00907DF0
WixBundleProviderKey, xrefs: 00907D5A
LogonUser, xrefs: 009077B2
#, xrefs: 0090759C
WixBundleExecutePackageCacheFolder, xrefs: 00907CAC

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: #$$$'$0$Date$Failed to add built-in variable: %ls.$InstallerName$InstallerVersion$LogonUser$WixBundleAction$WixBundleActiveParent$WixBundleElevated$WixBundleExecutePackageAction$WixBundleExecutePackageCacheFolder$WixBundleForcedRestartPackage$WixBundleInstalled$WixBundleProviderKey$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleTag$WixBundleVersion
API String ID: 32694325-826827252
Opcode ID: 86946b51a4f26bef688b557eaed015c4f3b6df1a68e5499dc579e1e1486334f0
Instruction ID: 6eaefbaed0a5099f0a7fd71cfef7de51e1ec04e17c9382c49980426588e00962
Opcode Fuzzy Hash: 86946b51a4f26bef688b557eaed015c4f3b6df1a68e5499dc579e1e1486334f0
Instruction Fuzzy Hash: CF321BF0D263799FDBB5CF59894878DBAF8BB49B04F5081DAE10CA6251D7B10A84CF84

Function 009180AE Relevance: 31.7, APIs: 7, Strings: 11, Instructions: 151
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00905381), ref: 00918104

Part of subcall function 0094076C: OpenProcessToken.ADVAPI32(?,00000008,?,009052B5,00000000,?,?,?,?,?,?,?,009174AB,00000000), ref: 0094078A
Part of subcall function 0094076C: GetLastError.KERNEL32(?,?,?,?,?,?,?,009174AB,00000000), ref: 00940794
Part of subcall function 0094076C: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,009174AB,00000000), ref: 0094081D

GetWindowsDirectoryW.KERNEL32(?,00000104,00000000), ref: 0091812A
GetLastError.KERNEL32 ref: 00918134
GetTempPathW.KERNEL32(00000104,?,00000000), ref: 009181B1
GetLastError.KERNEL32 ref: 009181BB

Strings

%ls%ls\, xrefs: 0091824C
Failed to append bundle id on to temp path for working folder., xrefs: 00918264
Failed to concat Temp directory on windows path for working folder., xrefs: 009181A1
Failed to get temp path for working folder., xrefs: 009181E9
Failed to get windows path for working folder., xrefs: 00918162
Failed to convert working folder guid into string., xrefs: 0091823A
Failed to create working folder guid., xrefs: 00918207
Temp\, xrefs: 00918189
cache.cpp, xrefs: 00918158, 009181DF, 00918230
Failed to ensure windows path for working folder ended in backslash., xrefs: 0091817F
Failed to copy working folder path., xrefs: 0091827F

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorLast$Process$CloseCurrentDirectoryHandleOpenPathTempTokenWindows
String ID: %ls%ls\$Failed to append bundle id on to temp path for working folder.$Failed to concat Temp directory on windows path for working folder.$Failed to convert working folder guid into string.$Failed to copy working folder path.$Failed to create working folder guid.$Failed to ensure windows path for working folder ended in backslash.$Failed to get temp path for working folder.$Failed to get windows path for working folder.$Temp\$cache.cpp
API String ID: 348923985-819636856
Opcode ID: d93a3726742c7e8145e3817ff16c5a8b0c5706d7786d80a81d04b098110463ad
Instruction ID: f9ac4dfb698dfcc46d0baf673ea3a2336b3ec298330afd5a9418f92bff5f914d
Opcode Fuzzy Hash: d93a3726742c7e8145e3817ff16c5a8b0c5706d7786d80a81d04b098110463ad
Instruction Fuzzy Hash: AB413572B44728BBEB21D6A5CC4AFAB33ECAB84741F000555FD04F7180EA749D499BA1

Function 00920E43 Relevance: 30.0, APIs: 8, Strings: 9, Instructions: 210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 00920E65
CoUninitialize.COMBASE ref: 009210D9

Strings

Failed to initialize cabinet.dll., xrefs: 00920EE7
cabextract.cpp, xrefs: 00920EDB, 00920FFF, 0092104A, 00921087, 009210B3
Failed to extract all files from container, erf: %d:%X:%d, xrefs: 00920FC0
Failed to reset begin operation event., xrefs: 00921091
Failed to set operation complete event., xrefs: 00921009
Failed to initialize COM., xrefs: 00920E71
Failed to wait for begin operation event., xrefs: 00921054
Invalid operation for this state., xrefs: 009210BD
<the>.cab, xrefs: 00920F05

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: InitializeUninitialize
String ID: <the>.cab$Failed to extract all files from container, erf: %d:%X:%d$Failed to initialize COM.$Failed to initialize cabinet.dll.$Failed to reset begin operation event.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$cabextract.cpp
API String ID: 3442037557-1168358783
Opcode ID: 7d061bec9b048fee599630de7873b95f21120f1d96917806c14b12de013bc748
Instruction ID: 4c6abe464ee5ff174e000a2580cdd4de795ba1c05ea7354a0f8bfbe9ba999a11
Opcode Fuzzy Hash: 7d061bec9b048fee599630de7873b95f21120f1d96917806c14b12de013bc748
Instruction Fuzzy Hash: DE518136ED4331E7D3305665AD45FAB7A74DBC4721F220329FC02BB289D6698C409AD6

Function 009041D2 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 158
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(00000000,?,00000000,00000000,?,?,0090515E,?,?,00000000,?,?), ref: 009041FE
InitializeCriticalSection.KERNEL32(000000D0,?,?,0090515E,?,?,00000000,?,?), ref: 00904207
lstrlenW.KERNEL32(burn.filehandle.attached,000004B8,000004A0,?,?,0090515E,?,?,00000000,?,?), ref: 0090424D
lstrlenW.KERNEL32(burn.filehandle.attached,burn.filehandle.attached,00000000,?,?,0090515E,?,?,00000000,?,?), ref: 00904257
CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,0090515E,?,?,00000000,?,?), ref: 0090426B
lstrlenW.KERNEL32(burn.filehandle.attached,?,?,0090515E,?,?,00000000,?,?), ref: 0090427B
lstrlenW.KERNEL32(burn.filehandle.self,?,?,0090515E,?,?,00000000,?,?), ref: 009042CB
lstrlenW.KERNEL32(burn.filehandle.self,burn.filehandle.self,00000000,?,?,0090515E,?,?,00000000,?,?), ref: 009042D5
CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,0090515E,?,?,00000000,?,?), ref: 009042E9
lstrlenW.KERNEL32(burn.filehandle.self,?,?,0090515E,?,?,00000000,?,?), ref: 009042F9

Strings

burn.filehandle.attached, xrefs: 00904248, 00904250, 00904255, 00904256, 00904276, 0090439A
Missing required parameter for switch: %ls, xrefs: 0090439F
Failed to parse file handle: '%ls', xrefs: 0090437D
Failed to initialize engine section., xrefs: 00904362
engine.cpp, xrefs: 00904390, 009043BC
burn.filehandle.self, xrefs: 009042C6, 009042CE, 009042D3, 009042D4, 009042F4, 009043C6

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: lstrlen$CompareCriticalInitializeSectionString
String ID: Failed to initialize engine section.$Failed to parse file handle: '%ls'$Missing required parameter for switch: %ls$burn.filehandle.attached$burn.filehandle.self$engine.cpp
API String ID: 3039292287-3209860532
Opcode ID: 0fb3644ab449240219092a24d90140f348d0a78e587d7ff67f38f223dbba1b9a
Instruction ID: 2c5dcf2bef6d2511f99f646bb08ddeda83a69289112e1d7c8b57991ec7574763
Opcode Fuzzy Hash: 0fb3644ab449240219092a24d90140f348d0a78e587d7ff67f38f223dbba1b9a
Instruction Fuzzy Hash: EE5192B1B44219BFCB249B69DC86FAAB76CEB45764F000116F718E7290DB70E950CBA4

Function 0090C129 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 128
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,08000080,00000000,?,00000000,00000000,?,0090C319,009052FD,?,?,0090533D), ref: 0090C170
GetLastError.KERNEL32(?,0090C319,009052FD,?,?,0090533D,0090533D,00000000,?,00000000), ref: 0090C181
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002,?,00000000,00000000,?,0090C319,009052FD,?,?,0090533D,0090533D,00000000,?), ref: 0090C1D0
GetCurrentProcess.KERNEL32(000000FF,00000000,?,0090C319,009052FD,?,?,0090533D,0090533D,00000000,?,00000000), ref: 0090C1D6
DuplicateHandle.KERNELBASE(00000000,?,0090C319,009052FD,?,?,0090533D,0090533D,00000000,?,00000000), ref: 0090C1D9
GetLastError.KERNEL32(?,0090C319,009052FD,?,?,0090533D,0090533D,00000000,?,00000000), ref: 0090C1E3
SetFilePointerEx.KERNELBASE(?,00000000,00000000,00000000,00000000,?,0090C319,009052FD,?,?,0090533D,0090533D,00000000,?,00000000), ref: 0090C235
GetLastError.KERNEL32(?,0090C319,009052FD,?,?,0090533D,0090533D,00000000,?,00000000), ref: 0090C23F

Strings

Failed to duplicate handle to container: %ls, xrefs: 0090C214
Failed to open file: %ls, xrefs: 0090C1B2
Failed to move file pointer to container offset., xrefs: 0090C26D
crypt32.dll, xrefs: 0090C231
Failed to open container., xrefs: 0090C28B
container.cpp, xrefs: 0090C1A5, 0090C207, 0090C263
feclient.dll, xrefs: 0090C232

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorLast$CurrentFileProcess$CreateDuplicateHandlePointer
String ID: Failed to duplicate handle to container: %ls$Failed to move file pointer to container offset.$Failed to open container.$Failed to open file: %ls$container.cpp$crypt32.dll$feclient.dll
API String ID: 2619879409-373955632
Opcode ID: 9492b00ca29bc4f414185a5dbe03be63016cbb9fa586597ae6849891330a10b5
Instruction ID: 0a5902a8cd0646051c829304b69553787b3ad2eef9262e0ef6fcb7e2c760b28a
Opcode Fuzzy Hash: 9492b00ca29bc4f414185a5dbe03be63016cbb9fa586597ae6849891330a10b5
Instruction Fuzzy Hash: B341C176240301AFEB209F699C48F573BEAEBC5750F114229FD19DB291DA31C801DBA0

Function 009429B3 Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 86
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009037EA: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00903829
Part of subcall function 009037EA: GetLastError.KERNEL32 ref: 00903833

Part of subcall function 00944932: GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 0094495A

GetProcAddress.KERNEL32(MsiDeterminePatchSequenceW,00000000), ref: 009429FD
GetProcAddress.KERNEL32(MsiDetermineApplicablePatchesW), ref: 00942A20
GetProcAddress.KERNEL32(MsiEnumProductsExW), ref: 00942A43
GetProcAddress.KERNEL32(MsiGetPatchInfoExW), ref: 00942A66
GetProcAddress.KERNEL32(MsiGetProductInfoExW), ref: 00942A89
GetProcAddress.KERNEL32(MsiSetExternalUIRecord), ref: 00942AAC
GetProcAddress.KERNEL32(MsiSourceListAddSourceExW), ref: 00942ACF

Strings

MsiGetProductInfoExW, xrefs: 00942A70
MsiEnumProductsExW, xrefs: 00942A2A
MsiGetPatchInfoExW, xrefs: 00942A4D
Msi.dll, xrefs: 009429C5
MsiSourceListAddSourceExW, xrefs: 00942AB6
MsiDetermineApplicablePatchesW, xrefs: 00942A07
MsiDeterminePatchSequenceW, xrefs: 009429F2
MsiSetExternalUIRecord, xrefs: 00942A93

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: AddressProc$ErrorLast$DirectorySystem
String ID: Msi.dll$MsiDetermineApplicablePatchesW$MsiDeterminePatchSequenceW$MsiEnumProductsExW$MsiGetPatchInfoExW$MsiGetProductInfoExW$MsiSetExternalUIRecord$MsiSourceListAddSourceExW
API String ID: 2510051996-1735120554
Opcode ID: 32f511eaab2918d42fea32b51ec2776462181846748091909094b8303d5f1aeb
Instruction ID: a0f4cbff4eaaa6a938018c75ecf586b2b80ea0bf48ff47cb771bbf080a19e1ce
Opcode Fuzzy Hash: 32f511eaab2918d42fea32b51ec2776462181846748091909094b8303d5f1aeb
Instruction Fuzzy Hash: EC31C1B0669208AFDB58DF25EC52B293BB5F784728741452EF40AD2270FBF19990EF50

Function 0093FBAD Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNELBASE(SystemFunction040,AdvApi32.dll), ref: 0093FBD5
GetProcAddress.KERNEL32(SystemFunction041), ref: 0093FBE7
GetProcAddress.KERNEL32(CryptProtectMemory,Crypt32.dll), ref: 0093FC2A
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 0093FC3E
GetProcAddress.KERNEL32(CryptUnprotectMemory), ref: 0093FC76
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 0093FC8A

Strings

SystemFunction041, xrefs: 0093FBD7
CryptProtectMemory, xrefs: 0093FC1F
SystemFunction040, xrefs: 0093FBCA
cryputil.cpp, xrefs: 0093FC5F
`+9s, xrefs: 0093FBE9, 0093FBF0, 0093FC78
Crypt32.dll, xrefs: 0093FC0B
CryptUnprotectMemory, xrefs: 0093FC6B
AdvApi32.dll, xrefs: 0093FBB4

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: AddressProc$ErrorLast
String ID: AdvApi32.dll$Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory$SystemFunction040$SystemFunction041$`+9s$cryputil.cpp
API String ID: 4214558900-213721895
Opcode ID: 1d09e189379a10cfb7716813b6d93030cf62fb1ae7c5bf5dea6f1ad3be2c53f6
Instruction ID: 247666bc352b4a71ce375592a28a3fb964fb62bb16655bedf5e70d1086c26c10
Opcode Fuzzy Hash: 1d09e189379a10cfb7716813b6d93030cf62fb1ae7c5bf5dea6f1ad3be2c53f6
Instruction Fuzzy Hash: 6C21F671E983269BD7216B269D14B927AD8EB80744F02013AFD02E61A0F7A08C81FED0

Function 00921484 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 103COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,wininet.dll,?,00000000,00000000,00000000,?,?,0090C285,?,00000000,?,0090C319), ref: 009214BB
GetLastError.KERNEL32(?,0090C285,?,00000000,?,0090C319,009052FD,?,?,0090533D,0090533D,00000000,?,00000000), ref: 009214C4

Strings

cabextract.cpp, xrefs: 009214E8, 0092152E, 0092157A
Failed to create begin operation event., xrefs: 009214F2
Failed to create operation complete event., xrefs: 00921538
Failed to wait for operation complete., xrefs: 00921597
wininet.dll, xrefs: 0092149A
Failed to create extraction thread., xrefs: 00921584
Failed to copy file name., xrefs: 009214A6

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CreateErrorEventLast
String ID: Failed to copy file name.$Failed to create begin operation event.$Failed to create extraction thread.$Failed to create operation complete event.$Failed to wait for operation complete.$cabextract.cpp$wininet.dll
API String ID: 545576003-938279966
Opcode ID: 111cb7b56338c8789c2b7e9957bd201748ffe77f4c32e1ad4289d27b4118a66a
Instruction ID: 6eac341978d5af00584cade6181c793502335d43227283733282e8cb8db6538d
Opcode Fuzzy Hash: 111cb7b56338c8789c2b7e9957bd201748ffe77f4c32e1ad4289d27b4118a66a
Instruction Fuzzy Hash: 4E2148B2E40739BEF320667A6C41F6729ECEF987A4F010222FD09F7180E654DC1086E6

Function 00920627 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 103fileCOMMON

Download Yara Rule

APIs

CompareStringA.KERNELBASE(00000000,00000000,<the>.cab,?,?), ref: 00920657
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 0092066F
GetCurrentProcess.KERNEL32(?,00000000,?,?), ref: 00920674
DuplicateHandle.KERNELBASE(00000000,?,?), ref: 00920677
GetLastError.KERNEL32(?,?), ref: 00920681
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,08000080,00000000,?,?), ref: 009206F0
GetLastError.KERNEL32(?,?), ref: 009206FD

Strings

Failed to add virtual file pointer for cab container., xrefs: 009206D6
Failed to open cabinet file: %hs, xrefs: 0092072E
cabextract.cpp, xrefs: 009206A5, 00920721
Failed to duplicate handle to cab container., xrefs: 009206AF
<the>.cab, xrefs: 00920650

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CurrentErrorLastProcess$CompareCreateDuplicateFileHandleString
String ID: <the>.cab$Failed to add virtual file pointer for cab container.$Failed to duplicate handle to cab container.$Failed to open cabinet file: %hs$cabextract.cpp
API String ID: 3030546534-3446344238
Opcode ID: 7f199a82167c3aab85e3031501ad18f1d05a236506ec9313348f1065946a929b
Instruction ID: fffc73cf6f0bd9366915a8d88b99a57ef35e18d8200a78d045bd8e431a260a83
Opcode Fuzzy Hash: 7f199a82167c3aab85e3031501ad18f1d05a236506ec9313348f1065946a929b
Instruction Fuzzy Hash: 1731F576A01634BBEB209B669C44F9B7EACEF89760F000215FD08F7150D7209D10DBE5

Function 00916859 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(000000FF,00000000,00000001,00000002,?,00000000,?,?,00904D0B,?,?), ref: 00916879
GetCurrentProcess.KERNEL32(?,00000000,?,?,00904D0B,?,?), ref: 0091687F
DuplicateHandle.KERNELBASE(00000000,?,?,00904D0B,?,?), ref: 00916882
GetLastError.KERNEL32(?,?,00904D0B,?,?), ref: 0091688C
CloseHandle.KERNEL32(000000FF,?,00904D0B,?,?), ref: 00916905

Strings

burn.filehandle.attached, xrefs: 009168D2
core.cpp, xrefs: 009168B0
Failed to append the file handle to the command line., xrefs: 009168ED
Failed to duplicate file handle for attached container., xrefs: 009168BA
%ls -%ls=%u, xrefs: 009168D9

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CurrentHandleProcess$CloseDuplicateErrorLast
String ID: %ls -%ls=%u$Failed to append the file handle to the command line.$Failed to duplicate file handle for attached container.$burn.filehandle.attached$core.cpp
API String ID: 4224961946-4196573879
Opcode ID: df4dc765196d3e2dc072f3c2f0407df505e2f7747794e7828a19b6bf2809daa7
Instruction ID: 797b7a21d7c070f91e379d6a665859442dd71726f74c87d953bd48eae6ae57ed
Opcode Fuzzy Hash: df4dc765196d3e2dc072f3c2f0407df505e2f7747794e7828a19b6bf2809daa7
Instruction Fuzzy Hash: 4511B131A00319BBDB10ABB99D05E9A7BACAF45B30F110266FD20E72E0D7719D0097A0

Function 00916915 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 72fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000005,?,00000003,00000080,00000000,?,00000000,?,?,?), ref: 0091694B
CloseHandle.KERNEL32(00000000), ref: 009169BB

Strings

Failed to append the file handle to the obfuscated command line., xrefs: 009169A9
Failed to append the file handle to the command line., xrefs: 00916977
burn.filehandle.self, xrefs: 0091695C, 0091698E
%ls -%ls=%u, xrefs: 00916963, 00916995

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: %ls -%ls=%u$Failed to append the file handle to the command line.$Failed to append the file handle to the obfuscated command line.$burn.filehandle.self
API String ID: 3498533004-3263533295
Opcode ID: c5964cf55544dfe523cc7ed27ed42254168e3c1d27f27f97dddf8a1c2dce0b7c
Instruction ID: af0e291283221860b4b4175c89c7e5b2776c2f61b99067c93a2c2b42f33467fe
Opcode Fuzzy Hash: c5964cf55544dfe523cc7ed27ed42254168e3c1d27f27f97dddf8a1c2dce0b7c
Instruction Fuzzy Hash: C911C832B406187BCB205A699C05F9F7BACDBC5B35F010364FE28EB2E2E77498558791

Function 0094076C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32(?,00000008,?,009052B5,00000000,?,?,?,?,?,?,?,009174AB,00000000), ref: 0094078A
GetLastError.KERNEL32(?,?,?,?,?,?,?,009174AB,00000000), ref: 00940794
GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?,?,?,?,?,?,?,?,009174AB,00000000), ref: 009407C6
CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,009174AB,00000000), ref: 0094081D

Strings

procutil.cpp, xrefs: 0094080B

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Token$CloseErrorHandleInformationLastOpenProcess
String ID: procutil.cpp
API String ID: 3370771294-1178289305
Opcode ID: c6125e1e4b1e0262ebf80915fb0df68f0bfd85981bad10e499484bc2093748ea
Instruction ID: 3be921da68939cec677bd4f94490873fef3ec8167cffed028db7365e641b435e
Opcode Fuzzy Hash: c6125e1e4b1e0262ebf80915fb0df68f0bfd85981bad10e499484bc2093748ea
Instruction Fuzzy Hash: F921C675D00228EBDB20AB998D44E9EBBFCEF84711F114066EE05E7250D3318E00EBD0

Function 0094343B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0094344A
InterlockedIncrement.KERNEL32(0096B6D8), ref: 00943467
CLSIDFromProgID.COMBASE(Msxml2.DOMDocument,0096B6C8,?,?,?,?,?,?), ref: 00943482
CLSIDFromProgID.OLE32(MSXML.DOMDocument,0096B6C8,?,?,?,?,?,?), ref: 0094348E

Strings

Msxml2.DOMDocument, xrefs: 0094347D
MSXML.DOMDocument, xrefs: 00943489

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: FromProg$IncrementInitializeInterlocked
String ID: MSXML.DOMDocument$Msxml2.DOMDocument
API String ID: 2109125048-2356320334
Opcode ID: 29249d9c90c5086f3a09c7690a7d9159fdda48c085a0748ce0d4564565afdecb
Instruction ID: 0ba75b26803225f4443b41325086b31484ac8e9fbe3226e9daddcb64bea4ca10
Opcode Fuzzy Hash: 29249d9c90c5086f3a09c7690a7d9159fdda48c085a0748ce0d4564565afdecb
Instruction Fuzzy Hash: 8FF0302175923956D7224BB6EC0DF572E68AF81B79B108419F901D11B4F7A4C981D6A0

Function 00944932 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 0094495A
GlobalAlloc.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00944989
GetLastError.KERNEL32(?,00000000,00000000,00000000), ref: 009449B3
GetLastError.KERNEL32(00000000,0094B790,?,?,?,00000000,00000000,00000000), ref: 009449F4
GlobalFree.KERNEL32(00000000), ref: 00944A28

Strings

fileutil.cpp, xrefs: 00944978, 009449D1

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorLast$Global$AllocFree
String ID: fileutil.cpp
API String ID: 1145190524-2967768451
Opcode ID: 89b75e68894e9f4c04ee6acc89a18757f96b0ad20c3b618ee9b25851f3e7196d
Instruction ID: f79891cee1484fa232bd94f143b84905abeed4bf2f078543e5ac52f57d708a0c
Opcode Fuzzy Hash: 89b75e68894e9f4c04ee6acc89a18757f96b0ad20c3b618ee9b25851f3e7196d
Instruction Fuzzy Hash: 2A210479A40329ABD7119BA98C45FAFBBACEF80764F004226FD05E7200E730CC00E6E1

Function 009207E4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 99COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 0092088A
GetLastError.KERNEL32(?,?,?), ref: 00920894

Strings

cabextract.cpp, xrefs: 009208B8
Invalid seek type., xrefs: 00920820
Failed to move file pointer 0x%x bytes., xrefs: 009208C5

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move file pointer 0x%x bytes.$Invalid seek type.$cabextract.cpp
API String ID: 2976181284-417918914
Opcode ID: 59d54ebb3e1033e5b68f70b81579e22d442a5e9b5e29a65a2a89df23511f6616
Instruction ID: f85e1f7d89061482017ccb2beca3e53493f6673aaa29ec53cb2166257fa949e0
Opcode Fuzzy Hash: 59d54ebb3e1033e5b68f70b81579e22d442a5e9b5e29a65a2a89df23511f6616
Instruction Fuzzy Hash: 6931A271A00629EFCB04DF69D884D6AB7B9FB88314B008229F915A7651D731E9108BD1

Function 00904013 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(0090533D,009053B5,00000000,00000000,?,00919EE4,00000000,00000000,0090533D,00000000,009052B5,00000000,?,?,0090D4AC,0090533D), ref: 00904021
GetLastError.KERNEL32(?,00919EE4,00000000,00000000,0090533D,00000000,009052B5,00000000,?,?,0090D4AC,0090533D,00000000,00000000), ref: 0090402F
CreateDirectoryW.KERNEL32(0090533D,009053B5,00905381,?,00919EE4,00000000,00000000,0090533D,00000000,009052B5,00000000,?,?,0090D4AC,0090533D,00000000), ref: 00904097
GetLastError.KERNEL32(?,00919EE4,00000000,00000000,0090533D,00000000,009052B5,00000000,?,?,0090D4AC,0090533D,00000000,00000000), ref: 009040A1

Strings

dirutil.cpp, xrefs: 009040CF

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: dirutil.cpp
API String ID: 1375471231-2193988115
Opcode ID: 644154f7ccdc47055fd1d2852b3238fa95926ca6a17a6bdb9f98744b66e1e799
Instruction ID: 1d5d8a6b801d6e15a9bc8f532fc4f49735f1711c7a9ff60386d3e66152b10bf8
Opcode Fuzzy Hash: 644154f7ccdc47055fd1d2852b3238fa95926ca6a17a6bdb9f98744b66e1e799
Instruction Fuzzy Hash: A511E4BA644221EEEB311BA14C44B3BB6BCDF95B60F104125FF05FB1D0D7648C01A6E1

Function 009055B6 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

CompareStringW.KERNELBASE(0000007F,00001000,?,000000FF,version.dll,000000FF,?,00000000,00000007,0090648B,0090648B,?,0090554A,?,?,00000000), ref: 009055F2
GetLastError.KERNEL32(?,0090554A,?,?,00000000,?,00000000,0090648B,?,00907DDC,?,?,?,?,?), ref: 00905621

Strings

variable.cpp, xrefs: 00905645
Failed to compare strings., xrefs: 0090564F
version.dll, xrefs: 009055E4

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CompareErrorLastString
String ID: Failed to compare strings.$variable.cpp$version.dll
API String ID: 1733990998-4228644734
Opcode ID: a6fad60896515865751db91fd52039f937ab829897f2902c9e930121b1f2e33e
Instruction ID: 93c827cefbee3d495e29e693615bb17c592151f7c2ace04e36cc0b003850285f
Opcode Fuzzy Hash: a6fad60896515865751db91fd52039f937ab829897f2902c9e930121b1f2e33e
Instruction Fuzzy Hash: E5210532614614AFC7148FACCC44E6BB7A8EF49B60F660319F915EB2D0DA32DE018B90

Function 0092074E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0092114F: SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,0092077D,?,?,?), ref: 00921177
Part of subcall function 0092114F: GetLastError.KERNEL32(?,0092077D,?,?,?), ref: 00921181

ReadFile.KERNELBASE(?,?,?,?,00000000,?,?,?), ref: 0092078B
GetLastError.KERNEL32 ref: 00920795

Strings

cabextract.cpp, xrefs: 009207B9
Failed to read during cabinet extraction., xrefs: 009207C3

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorFileLast$PointerRead
String ID: Failed to read during cabinet extraction.$cabextract.cpp
API String ID: 2170121939-2426083571
Opcode ID: 9232e6e0921e4f28cbb65bcc948c2af983b038b246cf1e30d9396203f0c94ae1
Instruction ID: 5fac9c2cf46fe4313fb38e3c3db3a49ce229b55824327633d3b86904278321ba
Opcode Fuzzy Hash: 9232e6e0921e4f28cbb65bcc948c2af983b038b246cf1e30d9396203f0c94ae1
Instruction Fuzzy Hash: E401C472A04224BBDB209FA9DC04E9A7BADFF49760F010219FE09E7650D731DA10DBD4

Function 0092114F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,0092077D,?,?,?), ref: 00921177
GetLastError.KERNEL32(?,0092077D,?,?,?), ref: 00921181

Strings

cabextract.cpp, xrefs: 009211A5
Failed to move to virtual file pointer., xrefs: 009211AF

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move to virtual file pointer.$cabextract.cpp
API String ID: 2976181284-3005670968
Opcode ID: 210cd4bfa0dacbf3c154cb9cf3a52399fbfaf8761c9bac78581ceb16f547a990
Instruction ID: 8e2fdbb44c252a0b92e733bd4d11427cf597f33f2b3f0c6c7da9d1236f9a7e80
Opcode Fuzzy Hash: 210cd4bfa0dacbf3c154cb9cf3a52399fbfaf8761c9bac78581ceb16f547a990
Instruction Fuzzy Hash: 62012136604235BBDB215AAAAC04E87FFA9EF817B1B00822AFE0C96150D735DC30D7D4

Function 00943DB5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00000000,?,00000000), ref: 00943E5E
GetLastError.KERNEL32 ref: 00943EC1

Strings

fileutil.cpp, xrefs: 00943EE5

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: fileutil.cpp
API String ID: 1948546556-2967768451
Opcode ID: 2f722368b73899b379e7371e6b245d14a8ae7d80c3e17bfc562a63c925bf9b39
Instruction ID: 96abfd38ed902321e82fc868e490f90fc37a1730ebf8a6d0a6ef756d4d86b3df
Opcode Fuzzy Hash: 2f722368b73899b379e7371e6b245d14a8ae7d80c3e17bfc562a63c925bf9b39
Instruction Fuzzy Hash: B6414F75E012699BDB21CF64C840BEBB7B8EF48751F0081AAA949E7240D7B59EC49F90

Function 00944CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00943E85,?,?,?), ref: 00944D12
GetLastError.KERNEL32(?,?,00943E85,?,?,?), ref: 00944D1C

Strings

fileutil.cpp, xrefs: 00944D44

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: fileutil.cpp
API String ID: 442123175-2967768451
Opcode ID: da9fef6f91cabf3e99946254293b84f5e284dc512b0226c37d25c51b7a391705
Instruction ID: a34ce8cf3f8e3d16b98bd8d1fb21a17d222bc8bec8250fa69b1e0d1ac5445d1f
Opcode Fuzzy Hash: da9fef6f91cabf3e99946254293b84f5e284dc512b0226c37d25c51b7a391705
Instruction Fuzzy Hash: 35F08172A01229BBD7109E9ACD45F9BB7ADFB44761F004116FD04D7040D730ED009AE0

Function 009447D3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00000000,?,?,?,00918564,00000000,00000000,00000000,00000000,00000000), ref: 009447EB
GetLastError.KERNEL32(?,?,?,00918564,00000000,00000000,00000000,00000000,00000000), ref: 009447F5

Strings

fileutil.cpp, xrefs: 00944819

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: fileutil.cpp
API String ID: 2976181284-2967768451
Opcode ID: 31470e3ffc7cd402be1022487d047109f5d9746bdb94fd43da1c62f8709c08dc
Instruction ID: 753fddb53f1bdbac7554a0baf93f85b300a6a3c9bef3b45551fbc0c093907720
Opcode Fuzzy Hash: 31470e3ffc7cd402be1022487d047109f5d9746bdb94fd43da1c62f8709c08dc
Instruction Fuzzy Hash: 7CF08175A00219AFDB108F95CC04EAB7BACEF08351F014119FD05D7250D631DC10DBE0

Function 009037EA Relevance: 4.6, APIs: 3, Instructions: 79libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00903829
GetLastError.KERNEL32 ref: 00903833
LoadLibraryW.KERNELBASE(?,?,00000104,?), ref: 0090389B

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: DirectoryErrorLastLibraryLoadSystem
String ID:
API String ID: 1230559179-0
Opcode ID: 9bb21beaf77ee1e118bb06e1bca555c62b7effaf83b8d1d1279a480ab14837d6
Instruction ID: 24309f1c766e4d89deb328f0fedcaff44d0cbc4552b5852bd261d789577448de
Opcode Fuzzy Hash: 9bb21beaf77ee1e118bb06e1bca555c62b7effaf83b8d1d1279a480ab14837d6
Instruction Fuzzy Hash: 122195B6D013296BEB209B649C49F9A77ADAB45710F1181A5BE04E7281EA70DE448BA0

Function 00903999 Relevance: 4.5, APIs: 3, Instructions: 20memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00903B34,00000000,?,00901472,00000000,80004005,00000000,80004005,00000000,000001C7,?,009013B7), ref: 009039A3
RtlFreeHeap.NTDLL(00000000,?,00903B34,00000000,?,00901472,00000000,80004005,00000000,80004005,00000000,000001C7,?,009013B7,000001C7,00000100), ref: 009039AA
GetLastError.KERNEL32(?,00903B34,00000000,?,00901472,00000000,80004005,00000000,80004005,00000000,000001C7,?,009013B7,000001C7,00000100,?), ref: 009039B4

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Heap$ErrorFreeLastProcess
String ID:
API String ID: 406640338-0
Opcode ID: 356ed7808c2bde29f500d452300bcbeaa8b7a36cf10f38f7a2b370b099bd5bbb
Instruction ID: 126c3e1c78a575b1e81ba4c3de68fd07497941bd3dd29e838f160dcd140f2acb
Opcode Fuzzy Hash: 356ed7808c2bde29f500d452300bcbeaa8b7a36cf10f38f7a2b370b099bd5bbb
Instruction Fuzzy Hash: 69D012366182346B87202BFA5C0CA97BE9CEF0A5A27014121FD05D2110D725C810D6E4

Function 00940E3F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,00945699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 00940E52

Strings

regutil.cpp, xrefs: 00940E8A

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Open
String ID: regutil.cpp
API String ID: 71445658-955085611
Opcode ID: 8030aee85f367a3647d7dbd0bc3a20c98f694b337c2d0be0a7b788b64f04d990
Instruction ID: a9953c8fdde338c2c8816684663c11d25624f7ed28d448ed58a220d41d687fc9
Opcode Fuzzy Hash: 8030aee85f367a3647d7dbd0bc3a20c98f694b337c2d0be0a7b788b64f04d990
Instruction Fuzzy Hash: 75F0A7727011356BDF2449568C04FAB7D85DF846B0F118528FE49DA160E276CC2092D0

Function 0093F349 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0093F35B

Part of subcall function 00949814: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00949891
Part of subcall function 00949814: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 009498A2

Strings

PAYn, xrefs: 0093F349, 0093F355

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: PAYn
API String ID: 1269201914-1516412171
Opcode ID: 73a663ccd58bf6cf5994b5bffc1e54fdc214def30430cc402f1fab27ac776eb7
Instruction ID: d5ec2d6e1e8315047eb1d6b216bceff04b7df6c924478736ca26e38e50ffbc37
Opcode Fuzzy Hash: 73a663ccd58bf6cf5994b5bffc1e54fdc214def30430cc402f1fab27ac776eb7
Instruction Fuzzy Hash: B0B012A26585017C321413146C13C37024CC2C1F2C334C93AB500D0040E8841D081433

Function 0093F37A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0093F35B

Part of subcall function 00949814: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00949891
Part of subcall function 00949814: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 009498A2

Strings

PAYn, xrefs: 0093F355

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: PAYn
API String ID: 1269201914-1516412171
Opcode ID: fc5df51186eae499916c96ef3f75794682da1ce24a62e34ba3f70dacd6546d93
Instruction ID: e92457600eb14e1557386178d0f1724cfeea2a5e47298abe5602e103ce523317
Opcode Fuzzy Hash: fc5df51186eae499916c96ef3f75794682da1ce24a62e34ba3f70dacd6546d93
Instruction Fuzzy Hash: A6B012A16586017C325853181C13D37018CC2C1F28334CA3AF004C1140E8800C441433

Function 0093F36A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0093F35B

Part of subcall function 00949814: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00949891
Part of subcall function 00949814: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 009498A2

Strings

PAYn, xrefs: 0093F355

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: PAYn
API String ID: 1269201914-1516412171
Opcode ID: edb622f84b3bdee748dc3020f9c6cbafed1c2eaa2a3474a621fed78cf261cc1c
Instruction ID: d214a707d9db9395a0d815d730b1124bad101e7823bbe81ae499118778a489a4
Opcode Fuzzy Hash: edb622f84b3bdee748dc3020f9c6cbafed1c2eaa2a3474a621fed78cf261cc1c
Instruction Fuzzy Hash: 47B012A16585017D325457181D13D37018CC2C1F28334C93AB004C1140E8840C051833

Function 00943499 Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 009434CE

Part of subcall function 00942F23: GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,009434DF,00000000,?,00000000), ref: 00942F3D
Part of subcall function 00942F23: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,0092BDED,?,009052FD,?,00000000,?), ref: 00942F49

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorHandleInitLastModuleVariant
String ID:
API String ID: 52713655-0
Opcode ID: 8c102a36e43ec230198423c3a7c65834da5cee2135823bc2f1a8c54f8f006792
Instruction ID: 680d8938396fe5e8bcc8aaa3009bf258fdcf95a203fc72284fd112e5079a4a07
Opcode Fuzzy Hash: 8c102a36e43ec230198423c3a7c65834da5cee2135823bc2f1a8c54f8f006792
Instruction Fuzzy Hash: 34311976E016299BCB11DFA8C884AEEB7F8EF08750F01456AFD15EB211D6719E048BA0

Function 00945728 Relevance: 1.6, APIs: 1, Instructions: 60registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(80070490,00000000,80070490,0096AAA0,00000000,80070490,00A1E520,?,0091890E,WiX\Burn,PackageCache,00000000,0096AAA0,00000000,00000000,80070490), ref: 00945782

Part of subcall function 00940F6E: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00940FE4
Part of subcall function 00940F6E: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 0094101F

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: QueryValue$Close
String ID:
API String ID: 1979452859-0
Opcode ID: ca6e83420f520b131e6ca24b1937d4620b3b14e5ecd10b44e5fab12e2e016f69
Instruction ID: 0dd78637d9a65990304c5cc1c2c45c0910fe17bab2f93564db4d0d458e2ad6e6
Opcode Fuzzy Hash: ca6e83420f520b131e6ca24b1937d4620b3b14e5ecd10b44e5fab12e2e016f69
Instruction Fuzzy Hash: 3311C236800529EFCF21AFE4DC81EAEB7A9EB44325B164239ED016B122C3315D50DAD0

Function 009034C5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,00000104,00000000,?,009189CA,0000001C,80070490,00000000,00000000,80070490), ref: 009034E5

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 5a6892bf40cc01c7d1559e7f09d24fc3a885da0cf49531b6a79805e84c6dcd8a
Instruction ID: b670897057fdfe4bbfd1e84dd5796fc7b9c88166ac39648af78792810e98f51e
Opcode Fuzzy Hash: 5a6892bf40cc01c7d1559e7f09d24fc3a885da0cf49531b6a79805e84c6dcd8a
Instruction Fuzzy Hash: 75E012762012297FE6022E629C09DEB7B9CDF067507008051BE40DA050E661E91097B0

Function 009494D5 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 009494E7

Part of subcall function 00949814: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00949891
Part of subcall function 00949814: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 009498A2

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 540399645f8b12aa58c6c83731b8a13292e94349bb356b9891ca1407992d6ea8
Instruction ID: 68937903414304c2ccbb66320c8cc1b415d080a48a92876ff63dbeea4caaeb36
Opcode Fuzzy Hash: 540399645f8b12aa58c6c83731b8a13292e94349bb356b9891ca1407992d6ea8
Instruction Fuzzy Hash: 68B012852B86017C332427185D47C37010CD7C0F14330CB2AB100E1080A8400C050033

Function 009494F6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 009494E7

Part of subcall function 00949814: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00949891
Part of subcall function 00949814: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 009498A2

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ac3509b500b010fcc6766a7e473771fd357190ef2b1cb5ba34ff332f4d902512
Instruction ID: 8b01be0158b491620a357b66b5806fcde0da8cecff9b0dec0b329357d2feaf82
Opcode Fuzzy Hash: ac3509b500b010fcc6766a7e473771fd357190ef2b1cb5ba34ff332f4d902512
Instruction Fuzzy Hash: 26B012852B85027C326467185C07D37014CC3C0F14330CB2AB500C2180E8401C090032

Function 00949506 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 009494E7

Part of subcall function 00949814: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00949891
Part of subcall function 00949814: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 009498A2

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b2458027179938f2f37444fabb0776bd404d2aeee216ebf4bb0d755dad883792
Instruction ID: f4f68b13e9ee16d1f1a3728e93c8e4949a428e73b3b6753fa5da6e6460000dea
Opcode Fuzzy Hash: b2458027179938f2f37444fabb0776bd404d2aeee216ebf4bb0d755dad883792
Instruction Fuzzy Hash: 13B012852B87017C326467586F07D37014CC7C0F143308B2AB100D2180E8440C060432

Function 009014B2 Relevance: 1.3, APIs: 1, Instructions: 54stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,00000000,00000000,?,?,009021B8,?,00000000,?,00000000,?,009038BD,00000000,?,00000104), ref: 009014E4

Part of subcall function 00903B51: GetProcessHeap.KERNEL32(00000000,000001C7,?,009021DC,000001C7,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 00903B59
Part of subcall function 00903B51: HeapSize.KERNEL32(00000000,?,009021DC,000001C7,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 00903B60

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Heap$ProcessSizelstrlen
String ID:
API String ID: 3492610842-0
Opcode ID: 2719a46cc481d9cc1be08934d79bd14102c92babcfd945e5d15a9ce4af05ba61
Instruction ID: e30fb082560fb553c3ed8601063ea145be27eff46954e2b7a2da49298248881a
Opcode Fuzzy Hash: 2719a46cc481d9cc1be08934d79bd14102c92babcfd945e5d15a9ce4af05ba61
Instruction Fuzzy Hash: 4201D837300219AFCF215E54DC85F9A77A9AF81764F218225FA259B1F0D731DD509A90

Non-executed Functions

Function 0090A7EF Relevance: 170.4, APIs: 29, Strings: 68, Instructions: 688COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 0090B01A

Part of subcall function 009038D4: GetProcessHeap.KERNEL32(?,000001C7,?,00902284,000001C7,00000001,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 009038E5
Part of subcall function 009038D4: RtlAllocateHeap.NTDLL(00000000,?,00902284,000001C7,00000001,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 009038EC

CompareStringW.KERNEL32(0000007F,00000000,0094CA64,000000FF,DirectorySearch,000000FF,0094CA64,Condition,feclient.dll,0094CA64,Variable,?,0094CA64,0094CA64,?,?), ref: 0090A927
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exists,000000FF,?,Type,?,?,Path,clbcatq.dll), ref: 0090A97C
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,path,000000FF), ref: 0090A998
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,FileSearch,000000FF), ref: 0090A9BC
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exists,000000FF,?,Type,?,?,Path,clbcatq.dll), ref: 0090AA0F
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,version,000000FF), ref: 0090AA29
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,RegistrySearch,000000FF), ref: 0090AA51
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,HKCR,000000FF,?,Root,?), ref: 0090AA8F
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,HKCU,000000FF), ref: 0090AAAE
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,HKLM,000000FF), ref: 0090AACD
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exists,000000FF,?,Win64,msi.dll,?,Type,?,?,Value,version.dll,?), ref: 0090AB8B
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,value,000000FF), ref: 0090ABA5

Part of subcall function 009431C7: VariantInit.OLEAUT32(?), ref: 009431DD
Part of subcall function 009431C7: SysAllocString.OLEAUT32(?), ref: 009431F9
Part of subcall function 009431C7: VariantClear.OLEAUT32(?), ref: 00943280
Part of subcall function 009431C7: SysFreeString.OLEAUT32(00000000), ref: 0094328B

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,numeric,000000FF,?,VariableType,?,?,ExpandEnvironment,cabinet.dll), ref: 0090AC04
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,string,000000FF), ref: 0090AC26
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,version,000000FF), ref: 0090AC46
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,directory,000000FF), ref: 0090AD1E
SysFreeString.OLEAUT32(?), ref: 0090AEFC

Strings

RegistrySearch, xrefs: 0090AA44
msi.dll, xrefs: 0090AB5A
Failed to get @Type., xrefs: 0090AFAE
Failed to get Win64 attribute., xrefs: 0090AF44
clbcatq.dll, xrefs: 0090A938, 0090A9CB, 0090AC81, 0090AE73
Failed to get Value attribute., xrefs: 0090AF3A
exists, xrefs: 0090A96D, 0090AA00, 0090AB7C
Invalid value for @Root: %ls, xrefs: 0090AF76
Key, xrefs: 0090AB02
ComponentId, xrefs: 0090ACA5
Failed to get next node., xrefs: 0090AFE9
feclient.dll, xrefs: 0090A8F6
value, xrefs: 0090AB98
language, xrefs: 0090ADF5
numeric, xrefs: 0090ABF5
keyPath, xrefs: 0090ACD9
Unexpected element name: %ls, xrefs: 0090AFCB
Invalid value for @Type: %ls, xrefs: 0090AF9F
search.cpp, xrefs: 0090A871
version.dll, xrefs: 0090AB1C
wininet.dll, xrefs: 0090AB01
MsiFeatureSearch, xrefs: 0090AE51
Path, xrefs: 0090A939, 0090A9CC
Condition, xrefs: 0090A8F7
assignment, xrefs: 0090AE2B
version, xrefs: 0090AA1C, 0090AC39, 0090ADD9
HKCU, xrefs: 0090AAA1
Failed to get search node count., xrefs: 0090A843
comres.dll, xrefs: 0090ACA4, 0090AD59, 0090AD89, 0090AE8E
DirectorySearch, xrefs: 0090A918
Value, xrefs: 0090AB1D
cabinet.dll, xrefs: 0090ABB8
MsiComponentSearch, xrefs: 0090AC5F
Failed to get @UpgradeCode., xrefs: 0090AF8B
Failed to get @FeatureId., xrefs: 0090AFB5
path, xrefs: 0090A98B, 0090AA38
state, xrefs: 0090ACF5, 0090AE11, 0090AEC3
ProductCode, xrefs: 0090AC82, 0090AD5A, 0090AE74
Failed to allocate memory for search structs., xrefs: 0090A87B
Failed to get @Condition., xrefs: 0090AF26
Root, xrefs: 0090AA67
Failed to get @Root., xrefs: 0090AF7D
Failed to select search nodes., xrefs: 0090A81E
FeatureId, xrefs: 0090AE8F
DirectorySearch|FileSearch|RegistrySearch|MsiComponentSearch|MsiProductSearch|MsiFeatureSearch, xrefs: 0090A80B
Type, xrefs: 0090A954, 0090A9E7, 0090AB40, 0090ACC0, 0090ADC0, 0090AEAA
Failed to get @ExpandEnvironment., xrefs: 0090AF4E
HKU, xrefs: 0090AADF
Win64, xrefs: 0090AB5B
Failed to get @ProductCode or @UpgradeCode., xrefs: 0090AF92
Invalid value for @VariableType: %ls, xrefs: 0090AF5B
HKCR, xrefs: 0090AA80
HKLM, xrefs: 0090AAC0
Failed to get @VariableType., xrefs: 0090AF62
Variable, xrefs: 0090A8DC
UpgradeCode, xrefs: 0090AD8A
MsiProductSearch, xrefs: 0090AD37
Failed to get @ComponentId., xrefs: 0090AF84
Failed to get @Id., xrefs: 0090AFE2
ExpandEnvironment, xrefs: 0090ABB9
Failed to get @ProductCode., xrefs: 0090AFBC
Failed to get @Path., xrefs: 0090AF30
FileSearch, xrefs: 0090A9AF
Failed to get Key attribute., xrefs: 0090AF6C
string, xrefs: 0090AC19
VariableType, xrefs: 0090ABDC
directory, xrefs: 0090AD11
Failed to get @Variable., xrefs: 0090AFDB

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: String$Compare$Free$HeapVariant$AllocAllocateClearInitProcess
String ID: ComponentId$Condition$DirectorySearch$DirectorySearch|FileSearch|RegistrySearch|MsiComponentSearch|MsiProductSearch|MsiFeatureSearch$ExpandEnvironment$Failed to allocate memory for search structs.$Failed to get @ComponentId.$Failed to get @Condition.$Failed to get @ExpandEnvironment.$Failed to get @FeatureId.$Failed to get @Id.$Failed to get @Path.$Failed to get @ProductCode or @UpgradeCode.$Failed to get @ProductCode.$Failed to get @Root.$Failed to get @Type.$Failed to get @UpgradeCode.$Failed to get @Variable.$Failed to get @VariableType.$Failed to get Key attribute.$Failed to get Value attribute.$Failed to get Win64 attribute.$Failed to get next node.$Failed to get search node count.$Failed to select search nodes.$FeatureId$FileSearch$HKCR$HKCU$HKLM$HKU$Invalid value for @Root: %ls$Invalid value for @Type: %ls$Invalid value for @VariableType: %ls$Key$MsiComponentSearch$MsiFeatureSearch$MsiProductSearch$Path$ProductCode$RegistrySearch$Root$Type$Unexpected element name: %ls$UpgradeCode$Value$Variable$VariableType$Win64$assignment$cabinet.dll$clbcatq.dll$comres.dll$directory$exists$feclient.dll$keyPath$language$msi.dll$numeric$path$search.cpp$state$string$value$version$version.dll$wininet.dll
API String ID: 2748437055-1695159631
Opcode ID: d5888b80949bb37fae40a2f8667a2d665877b4b578a2724168020825cf78b336
Instruction ID: d9a714e4610dd34fec75dc845e26e431da115029d4ef34dc2479fffc322cc2a4
Opcode Fuzzy Hash: d5888b80949bb37fae40a2f8667a2d665877b4b578a2724168020825cf78b336
Instruction Fuzzy Hash: E6220771E4932ABECB219A64CC42EAEBE69EF45738F204750F530B61D1D7B09E40D6D2

Function 00903BC3 Relevance: 45.8, APIs: 23, Strings: 3, Instructions: 311fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,?,?,?,00000001,00000000,?), ref: 00903C3F
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00903C52
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,00000001,00000000,?), ref: 00903C9D
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00903CA7
GetTempPathW.KERNEL32(00000104,?,?,?,?,00000001,00000000,?), ref: 00903CF5
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00903CFF
FindFirstFileW.KERNEL32(?,?,?,*.*,?,?,?,?,00000001,00000000,?), ref: 00903D52
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00903D63
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,?,00000001,00000000,?), ref: 00903E3D
DeleteFileW.KERNEL32(?,?,?,?,?,?,?,00000001,00000000,?), ref: 00903E51
GetTempFileNameW.KERNEL32(?,DEL,00000000,?,?,?,?,00000001,00000000,?), ref: 00903E78
MoveFileExW.KERNEL32(?,?,00000001,?,?,?,00000001,00000000,?), ref: 00903E9B
MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,00000001,00000000,?), ref: 00903EB4
FindNextFileW.KERNEL32(000000FF,?,?,?,?,?,?,?,00000001,00000000,?), ref: 00903EC4
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00903ED9
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00903F08
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00903F2A
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00903F4C
RemoveDirectoryW.KERNEL32(?,?,?,?,00000001,00000000,?), ref: 00903F63
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00903F6D
MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,00000001,00000000,?), ref: 00903F93
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00903FAE
FindClose.KERNEL32(000000FF,?,?,?,00000001,00000000,?), ref: 00903FE4

Strings

dirutil.cpp, xrefs: 00903C75, 00903EF9
*.*, xrefs: 00903D2B
DEL, xrefs: 00903E6C

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorFileLast$AttributesFindMove$Temp$CloseDeleteDirectoryFirstNameNextPathRemove
String ID: *.*$DEL$dirutil.cpp
API String ID: 1544372074-1252831301
Opcode ID: 27aa6d9cdc158b60313c3ff10b27d3b1d1ddb45d782282a54af79707ea57c83f
Instruction ID: 8fcdffddab5741e1ff90fe6b148b934e6e7232b7cee11bb0a0057bfd62e9fcf7
Opcode Fuzzy Hash: 27aa6d9cdc158b60313c3ff10b27d3b1d1ddb45d782282a54af79707ea57c83f
Instruction Fuzzy Hash: 70B1B876E04239AFEB305A758C44BAAB6BDAF44750F0142A5ED09F71D0D7368E80DBA0

Function 009415CB Relevance: 38.8, APIs: 21, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 0094166B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00941675
CreateWellKnownSid.ADVAPI32(0000001A,00000000,?,?), ref: 009416C2
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 009416C8
CreateWellKnownSid.ADVAPI32(00000017,00000000,?,?), ref: 00941702
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00941708
CreateWellKnownSid.ADVAPI32(00000018,00000000,?,?), ref: 00941748
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0094174E
CreateWellKnownSid.ADVAPI32(00000010,00000000,?,?), ref: 0094178E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00941794
CreateWellKnownSid.ADVAPI32(00000016,00000000,?,?), ref: 009417D4
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 009417DA
SetEntriesInAclA.ADVAPI32(00000005,?,00000000,?), ref: 009418BD
LocalFree.KERNEL32(?), ref: 009419DC

Strings

srputil.cpp, xrefs: 00941696

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorLast$CreateKnownWell$DescriptorEntriesFreeInitializeLocalSecurity
String ID: srputil.cpp
API String ID: 3627156773-4105181634
Opcode ID: c27aa17f016c26ea652070b8f5a17dce9839a37c5e093ae0cb1ca2539f722efa
Instruction ID: 9616fb86e1ba54d3a4a8b13f817d450fe3b9baf7768d28ef1cf829f8774cce93
Opcode Fuzzy Hash: c27aa17f016c26ea652070b8f5a17dce9839a37c5e093ae0cb1ca2539f722efa
Instruction Fuzzy Hash: 14B16676D5532CAAEB209BA59D44FEBB7FCEF08741F014166ED09F7150E7708E808AA0

Function 0092C0FA Relevance: 37.1, APIs: 1, Strings: 20, Instructions: 364COMMON

Download Yara Rule

Strings

Failed to copy uninstall arguments for related bundle package, xrefs: 0092C3EB
Failed to allocate memory for pseudo bundle payload hash., xrefs: 0092C275
Failed to allocate space for burn package payload inside of related bundle struct, xrefs: 0092C14D
Failed to copy key for pseudo bundle payload., xrefs: 0092C1BB
Failed to copy display name for pseudo bundle., xrefs: 0092C4F2
Failed to allocate space for burn payload inside of related bundle struct, xrefs: 0092C186
Failed to copy cache id for pseudo bundle., xrefs: 0092C327
Failed to append relation type to install arguments for related bundle package, xrefs: 0092C371
pseudobundle.cpp, xrefs: 0092C141, 0092C17A, 0092C269, 0092C475
Failed to copy download source for pseudo bundle., xrefs: 0092C231
-%ls, xrefs: 0092C114
Failed to copy repair arguments for related bundle package, xrefs: 0092C398
Failed to copy filename for pseudo bundle., xrefs: 0092C1DF
Failed to copy version for pseudo bundle., xrefs: 0092C4D0
Failed to copy local source path for pseudo bundle., xrefs: 0092C203
Failed to copy key for pseudo bundle., xrefs: 0092C30A
Failed to append relation type to repair arguments for related bundle package, xrefs: 0092C3B9
Failed to allocate memory for dependency providers., xrefs: 0092C481
Failed to copy install arguments for related bundle package, xrefs: 0092C34C
Failed to append relation type to uninstall arguments for related bundle package, xrefs: 0092C40C

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID: -%ls$Failed to allocate memory for dependency providers.$Failed to allocate memory for pseudo bundle payload hash.$Failed to allocate space for burn package payload inside of related bundle struct$Failed to allocate space for burn payload inside of related bundle struct$Failed to append relation type to install arguments for related bundle package$Failed to append relation type to repair arguments for related bundle package$Failed to append relation type to uninstall arguments for related bundle package$Failed to copy cache id for pseudo bundle.$Failed to copy display name for pseudo bundle.$Failed to copy download source for pseudo bundle.$Failed to copy filename for pseudo bundle.$Failed to copy install arguments for related bundle package$Failed to copy key for pseudo bundle payload.$Failed to copy key for pseudo bundle.$Failed to copy local source path for pseudo bundle.$Failed to copy repair arguments for related bundle package$Failed to copy uninstall arguments for related bundle package$Failed to copy version for pseudo bundle.$pseudobundle.cpp
API String ID: 1357844191-2832335422
Opcode ID: 1bb7bd8e08da15c0614a4e0432a1e70c8cc6f20ca77fccd443d9daf940ec7242
Instruction ID: c1915341a9523c2de953c3c53435ff77d374d0c4832b385ff660f834058eba5e
Opcode Fuzzy Hash: 1bb7bd8e08da15c0614a4e0432a1e70c8cc6f20ca77fccd443d9daf940ec7242
Instruction Fuzzy Hash: 3CC1D0B1A00666BFEB15DF68D861F6F76A8BF48714B008225FD15EB351DB74EC108B90

Function 009169CC Relevance: 31.9, APIs: 6, Strings: 12, Instructions: 358synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0090D39D: EnterCriticalSection.KERNEL32(000000D0,?,000000B8,00000000,?,00916E4B,000000B8,00000000,?,00000000,75C0B390), ref: 0090D3AC
Part of subcall function 0090D39D: InterlockedCompareExchange.KERNEL32(000000E8,00000001,00000000), ref: 0090D3BB
Part of subcall function 0090D39D: LeaveCriticalSection.KERNEL32(000000D0,?,00916E4B,000000B8,00000000,?,00000000,75C0B390), ref: 0090D3D0

ReleaseMutex.KERNEL32(00000000,?,00000000,?,00000000,00000001,00000000), ref: 00916D9A
CloseHandle.KERNEL32(00000000), ref: 00916DA3
CloseHandle.KERNEL32(00904740,?,00000000,?,00000000,00000001,00000000), ref: 00916DC0

Strings

UX aborted apply begin., xrefs: 00916AA6
Engine cannot start apply because it is busy with another action., xrefs: 00916A2F
Failed to cache engine to working directory., xrefs: 00916B7F
Another per-machine setup is already executing., xrefs: 00916BD9
core.cpp, xrefs: 00916A9C, 00916C76
Failed while caching, aborting execution., xrefs: 00916CA8
Failed to register bundle., xrefs: 00916C00
Another per-user setup is already executing., xrefs: 00916AF1
Failed to elevate., xrefs: 00916BA5
crypt32.dll, xrefs: 00916CD2
Failed to create cache thread., xrefs: 00916C80
Failed to set initial apply variables., xrefs: 00916B18

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CloseCriticalHandleSection$CompareEnterExchangeInterlockedLeaveMutexRelease
String ID: Another per-machine setup is already executing.$Another per-user setup is already executing.$Engine cannot start apply because it is busy with another action.$Failed to cache engine to working directory.$Failed to create cache thread.$Failed to elevate.$Failed to register bundle.$Failed to set initial apply variables.$Failed while caching, aborting execution.$UX aborted apply begin.$core.cpp$crypt32.dll
API String ID: 322611130-4292671789
Opcode ID: a0b681fb4ca83cbeeec20232e1720eff767a8bc61a9c2480d0d10974119ddac1
Instruction ID: a18888a7ea7ac0f769f774f48a531e6ff3527340b5cb1e6e3aa6ce568794cddc
Opcode Fuzzy Hash: a0b681fb4ca83cbeeec20232e1720eff767a8bc61a9c2480d0d10974119ddac1
Instruction Fuzzy Hash: 19C1C075F0561EAFDB199BA4DC45BEEB7BCFF44305F00422AF615A6181DB30A984CB90

Function 009044E9 Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 137COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000020,?,00000001,00000000,?,?,?,?,?,?,?), ref: 00904512
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 00904519
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 00904523
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00904573
GetLastError.KERNEL32 ref: 0090457D
CloseHandle.KERNEL32(?), ref: 00904677

Strings

Failed to schedule restart., xrefs: 00904662
Failed to adjust token to add shutdown privileges., xrefs: 009045F9
SeShutdownPrivilege, xrefs: 00904566
engine.cpp, xrefs: 00904547, 009045A1, 009045EF, 00904658
Failed to get process token., xrefs: 00904551
Failed to get shutdown privilege LUID., xrefs: 009045AB

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorLastProcess$CloseCurrentHandleLookupOpenPrivilegeTokenValue
String ID: Failed to adjust token to add shutdown privileges.$Failed to get process token.$Failed to get shutdown privilege LUID.$Failed to schedule restart.$SeShutdownPrivilege$engine.cpp
API String ID: 4232854991-1583736410
Opcode ID: d9c15416f9515777671cefd7ed006e2b90b77f945a6161f5a74ff92b0b1864dc
Instruction ID: 42548f32b82bc7db01512da8cf7591f539cd6ba1e0df5108991fd6d8823821e4
Opcode Fuzzy Hash: d9c15416f9515777671cefd7ed006e2b90b77f945a6161f5a74ff92b0b1864dc
Instruction Fuzzy Hash: 6C4123B6A54324AFEB205BB99C4AFBB76ACEB45745F010129FF01F61D0E6258C0096E1

Function 00914CE8 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 161pipeCOMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD),00000001,?,00000000), ref: 00914D16
GetLastError.KERNEL32(?,00000000,?,?,0090442A,?), ref: 00914D1F
CreateNamedPipeW.KERNEL32(000000FF,00080003,00000000,00000001,00010000,00010000,00000001,?,?,00000000,?,?,0090442A,?), ref: 00914DC0
GetLastError.KERNEL32(?,0090442A,?), ref: 00914DCD
CloseHandle.KERNEL32(00000000,pipe.cpp,00000132,00000000,?,?,?,?,?,?,?,0090442A,?), ref: 00914E93
LocalFree.KERNEL32(00000000,?,0090442A,?), ref: 00914EC1

Strings

D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD), xrefs: 00914D11
Failed to create pipe: %ls, xrefs: 00914DFE, 00914E84
\\.\pipe\%ls, xrefs: 00914D77
\\.\pipe\%ls.Cache, xrefs: 00914E14
Failed to create the security descriptor for the connection event and pipe., xrefs: 00914D4D
Failed to allocate full name of cache pipe: %ls, xrefs: 00914E2A
Failed to allocate full name of pipe: %ls, xrefs: 00914D8D
pipe.cpp, xrefs: 00914D43, 00914DF1, 00914E77

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: DescriptorErrorLastSecurity$CloseConvertCreateFreeHandleLocalNamedPipeString
String ID: D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD)$Failed to allocate full name of cache pipe: %ls$Failed to allocate full name of pipe: %ls$Failed to create pipe: %ls$Failed to create the security descriptor for the connection event and pipe.$\\.\pipe\%ls$\\.\pipe\%ls.Cache$pipe.cpp
API String ID: 3065245045-3253666091
Opcode ID: abe907444f8a8076b7b86feb5434514245ebe9b4d3f674586f4ca85a00f83b8c
Instruction ID: 3587d2f47335270b67671cf8ccd586802911a20169d21c98fac10f65ca0689a4
Opcode Fuzzy Hash: abe907444f8a8076b7b86feb5434514245ebe9b4d3f674586f4ca85a00f83b8c
Instruction Fuzzy Hash: 5D51E075E40328BFEB219AA5DC46BEEBBB8EF48315F104125FD10B61D0D3758E849B91

Function 0093F961 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 167encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000003,F0000040,00000003,00000000,00000000,00919CFF,00000003,000007D0,00000003,?,000007D0,00000000,000007D0), ref: 0093F9C6
GetLastError.KERNEL32 ref: 0093F9D0
CryptCreateHash.ADVAPI32(?,?,00000000,00000000,?), ref: 0093FA0D
GetLastError.KERNEL32 ref: 0093FA17
CryptDestroyHash.ADVAPI32(00000000), ref: 0093FAC9
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0093FAE0
GetLastError.KERNEL32 ref: 0093FAFB
CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000), ref: 0093FB33
GetLastError.KERNEL32 ref: 0093FB3D
SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00008004,00000001), ref: 0093FB76
GetLastError.KERNEL32 ref: 0093FB84

Strings

cryputil.cpp, xrefs: 0093FAB0

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CryptErrorLast$Hash$Context$AcquireCreateDestroyFileParamPointerRelease
String ID: cryputil.cpp
API String ID: 1716956426-2185294990
Opcode ID: b7f1c43f01d5cb5da97308dfc3bf81941223c55a56e838f570162f41cc299081
Instruction ID: 2ad07d598b6d9e6d28f478644966df1371de5173cae808c5d40ed4119e00b2ea
Opcode Fuzzy Hash: b7f1c43f01d5cb5da97308dfc3bf81941223c55a56e838f570162f41cc299081
Instruction Fuzzy Hash: 75518436E14364ABEB319B658C04BE776E8EB08742F014176FE4DE6190E7748D80DEE4

Function 00919C99 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 181COMMON

Download Yara Rule

Strings

Failed to get cached path for package with cache id: %ls, xrefs: 00919CC3
moving, xrefs: 00919E2C, 00919E34
Failed to find payload: %ls in working path: %ls and unverified path: %ls, xrefs: 00919DC6
Failed to create unverified path., xrefs: 00919D69
Failed to transfer working path to unverified path for payload: %ls., xrefs: 00919D9F
copying, xrefs: 00919E27
Failed to reset permissions on unverified cached payload: %ls, xrefs: 00919DEC
Failed to move verified file to complete payload path: %ls, xrefs: 00919E68
Failed to concat complete cached path., xrefs: 00919CEF

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID:
String ID: Failed to concat complete cached path.$Failed to create unverified path.$Failed to find payload: %ls in working path: %ls and unverified path: %ls$Failed to get cached path for package with cache id: %ls$Failed to move verified file to complete payload path: %ls$Failed to reset permissions on unverified cached payload: %ls$Failed to transfer working path to unverified path for payload: %ls.$copying$moving
API String ID: 0-1289240508
Opcode ID: 72d874a280e418e6fffbe58bb608291c07dbfce8c18668fd482adc663e473137
Instruction ID: 14ab939afcc435669592925440c85b3a16d1fb840d8e609752dc225d3c6531d1
Opcode Fuzzy Hash: 72d874a280e418e6fffbe58bb608291c07dbfce8c18668fd482adc663e473137
Instruction Fuzzy Hash: D8515D36E4011DBBDF22AF90DC12FDEBB76AF84701F104155FA00761A1E7769EA0AB91

Function 00906184 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 147COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C), ref: 009061D2
GetLastError.KERNEL32 ref: 009061DC

Strings

variable.cpp, xrefs: 00906200
Failed to set variant value., xrefs: 00906314
Failed to get OS info., xrefs: 0090620A

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorLastVersion
String ID: Failed to get OS info.$Failed to set variant value.$variable.cpp
API String ID: 305913169-1971907631
Opcode ID: 74f6b4c71abb1367803e3807c3318e67778fef03019995673c76fd0a9793a422
Instruction ID: 0e6dc36d63a240146d6a7d22f2a0c22941388778fb3a86c6c329438ff013d6fc
Opcode Fuzzy Hash: 74f6b4c71abb1367803e3807c3318e67778fef03019995673c76fd0a9793a422
Instruction Fuzzy Hash: 5741A572E04228AFDB209BA9CC45FEB7BB8EF89710F10059AF515E7180D7749E91CB90

Function 0093FDC2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130threadtimeCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0096B60C,00000000,?,?,?,?,00921014,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 0093FDF0
GetCurrentProcessId.KERNEL32(00000000,?,00921014,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 0093FE00
GetCurrentThreadId.KERNEL32 ref: 0093FE09
GetLocalTime.KERNEL32(8007139F,?,00921014,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 0093FE1F
LeaveCriticalSection.KERNEL32(0096B60C,?,00000000,00000000,0000FDE9), ref: 0093FF12

Strings

%ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls, xrefs: 0093FEB9

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CriticalCurrentSection$EnterLeaveLocalProcessThreadTime
String ID: %ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls
API String ID: 296830338-59366893
Opcode ID: 25befa785f2b65c07c86a98b10a92545a8dd8b157c6a8049bd13bc21446804c8
Instruction ID: f95c05219f28be73dc4539e3fa2d43d553ed85d26f90a5a88474c2e65d5f8d64
Opcode Fuzzy Hash: 25befa785f2b65c07c86a98b10a92545a8dd8b157c6a8049bd13bc21446804c8
Instruction Fuzzy Hash: 6E416272E05219AFDF209BA4DC55ABEB7F9AB49751F104029F901E6260E734CD80DFA1

Function 0091993E Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,?,?,*.*,?,?,?,00000000,.unverified,?), ref: 009199ED
lstrlenW.KERNEL32(?), ref: 00919A14
FindNextFileW.KERNEL32(00000000,00000010), ref: 00919A74
FindClose.KERNEL32(00000000), ref: 00919A7F

Part of subcall function 00903BC3: GetFileAttributesW.KERNEL32(?,?,?,?,00000001,00000000,?), ref: 00903C3F
Part of subcall function 00903BC3: GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00903C52

Strings

.unverified, xrefs: 00919981
*.*, xrefs: 009199C7

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: FileFind$AttributesCloseErrorFirstLastNextlstrlen
String ID: *.*$.unverified
API String ID: 457978746-2528915496
Opcode ID: 689922701f52c992439a01db22f44f36ea704d0ed4a98c13ecd8153eda273765
Instruction ID: 4bfc13380549308160e033039c7571dd7aea2bc623182e72e9e7686ae1f351dd
Opcode Fuzzy Hash: 689922701f52c992439a01db22f44f36ea704d0ed4a98c13ecd8153eda273765
Instruction Fuzzy Hash: 27417331A0456CAEDF21EB64DC59BEA77BCAF84702F4001E5E908E50A1EB719EC8DF14

Function 00948733 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 79timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000001,00000000), ref: 00948788
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?), ref: 0094879A

Strings

crypt32.dll, xrefs: 00948758
%04hu-%02hu-%02huT%02hu:%02hu:%02hu%c%02u:%02u, xrefs: 009487E3
%04hu-%02hu-%02huT%02hu:%02hu:%02huZ, xrefs: 00948771
feclient.dll, xrefs: 00948762

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Time$InformationLocalSpecificSystemZone
String ID: %04hu-%02hu-%02huT%02hu:%02hu:%02hu%c%02u:%02u$%04hu-%02hu-%02huT%02hu:%02hu:%02huZ$crypt32.dll$feclient.dll
API String ID: 1772835396-1985132828
Opcode ID: 74933f748d9259175bcdb8af4ea1a1e9f4705131782c6a9a597585efd2cea556
Instruction ID: 39d7a8db370bb2887228b69d789146c9098cbdc678abeec201521279ad8aad30
Opcode Fuzzy Hash: 74933f748d9259175bcdb8af4ea1a1e9f4705131782c6a9a597585efd2cea556
Instruction Fuzzy Hash: 44210EA6900118BED724DF959C05FBBB3FCEB48B11F10455AFA55D6080E778AD80D770

Function 0093A85E Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0093A9A4

Strings

1#IND, xrefs: 0093BB9C
1#INF, xrefs: 0093BBB1
1#SNAN, xrefs: 0093BBA3
1#QNAN, xrefs: 0093BBAA

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 873519ecd3fcfbd65807b5c4c7d0796e86c72fc245cc194d8cf7d9037d231a4b
Instruction ID: c232c7ec304941c3bef47453d019dc4bd1d8e863859652f3988a7cb1a17494ed
Opcode Fuzzy Hash: 873519ecd3fcfbd65807b5c4c7d0796e86c72fc245cc194d8cf7d9037d231a4b
Instruction Fuzzy Hash: 8CC24E71E086288FDB25CF28DD407EAB7B9EB84305F1545EAD54DE7240E778AE818F41

Function 009060BA Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 52COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 009060EA
GetLastError.KERNEL32 ref: 009060F4

Strings

variable.cpp, xrefs: 00906112
Failed to get the user name., xrefs: 0090611C
Failed to set variant value., xrefs: 00906138

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorLastNameUser
String ID: Failed to get the user name.$Failed to set variant value.$variable.cpp
API String ID: 2054405381-1522884404
Opcode ID: d003c8a75a31ce3372c43e465c9507db21337ff5d1c8a0f0b6451608008dc65c
Instruction ID: 9491efe8c9d9e89fc226a4e9934d7ec8a3a9afd9b09f8389fa4a97e48785a30e
Opcode Fuzzy Hash: d003c8a75a31ce3372c43e465c9507db21337ff5d1c8a0f0b6451608008dc65c
Instruction Fuzzy Hash: 5E01D672A053396BD760AB649C09EAB77ACDF41714F00415AF814E7281EB749E149691

Function 0093FD20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00000900,?,00000000,00000000,00000000,00000000,?,00000000,?,?,009403EC,?,00000000,?,?,00000001), ref: 0093FD3F
GetLastError.KERNEL32(?,009403EC,?,00000000,?,?,00000001,?,00905523,?,?,00000000,?,?,0090528D,00000002), ref: 0093FD4B
LocalFree.KERNEL32(00000000,?,00000000,00000000,?,?,009403EC,?,00000000,?,?,00000001,?,00905523,?,?), ref: 0093FDB3

Strings

logutil.cpp, xrefs: 0093FD69

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: logutil.cpp
API String ID: 1365068426-3545173039
Opcode ID: 60a6437ea52761c449d557f2759de2a31f22cbfe4dff9299c53e4db48e5fd10a
Instruction ID: 260448af97fdb16230e57b53c26e8d7502ffa75befef25aa95d0b4b4eb5058bd
Opcode Fuzzy Hash: 60a6437ea52761c449d557f2759de2a31f22cbfe4dff9299c53e4db48e5fd10a
Instruction Fuzzy Hash: A011BC36A00219ABDB21AFA0CD19FEF7B69EF54711F014029FE11961A0D7308E20EBA1

Function 00926945 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000003,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,009268EF,00000000,00000003), ref: 0092695C
GetLastError.KERNEL32(?,009268EF,00000000,00000003,00000000,?,?,?,?,?,?,?,?,?,00926CE1,?), ref: 00926966

Strings

Failed to set service start type., xrefs: 00926994
msuengine.cpp, xrefs: 0092698A

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ChangeConfigErrorLastService
String ID: Failed to set service start type.$msuengine.cpp
API String ID: 1456623077-1628545019
Opcode ID: 150165f5c9fa96f48b5ad6156132c138f4201e366c43662f22b9ada7216fbd62
Instruction ID: 1bca3b391582ceadfd09b3069eb38c0ac3d89c9e11dc11fb0f50072074d93ba2
Opcode Fuzzy Hash: 150165f5c9fa96f48b5ad6156132c138f4201e366c43662f22b9ada7216fbd62
Instruction Fuzzy Hash: 24F0E53670933036AB202AAA6C05F877FC8DF427F5B114325FD28F61E0DA218D0093E5

Function 00933BB0 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00933CA8
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00933CB2
UnhandledExceptionFilter.KERNEL32(80003CDD,?,?,?,?,?,?), ref: 00933CBF

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 43616a9701ddfe63a8df9d2576d089cb80601120f4603ce5e6a38974c7079289
Instruction ID: fb9f1065a79ac6da6797c2a5a927df4255f439d9074f4b71c8aad5c6d54db857
Opcode Fuzzy Hash: 43616a9701ddfe63a8df9d2576d089cb80601120f4603ce5e6a38974c7079289
Instruction Fuzzy Hash: 3831D37490122CABCB21DF64D888B9CBBB8AF08310F5041EAE81CA7251E7709F858F44

Function 00934812 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,009347E8,00000000,00967CF8,0000000C,0093493F,00000000,00000002,00000000), ref: 00934833
TerminateProcess.KERNEL32(00000000,?,009347E8,00000000,00967CF8,0000000C,0093493F,00000000,00000002,00000000), ref: 0093483A
ExitProcess.KERNEL32 ref: 0093484C

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 4ecf67779a5f28842a77f466f5ca95d6b50975a6507bffa55af432bc3fc7528c
Instruction ID: 9016b10fca4040d9e199ea68458ec2477480f137efe1fb0c80221fde65789ba4
Opcode Fuzzy Hash: 4ecf67779a5f28842a77f466f5ca95d6b50975a6507bffa55af432bc3fc7528c
Instruction Fuzzy Hash: BBE0B635414688ABCF116F65DD09E5A3F69FB96341F060024F9158B232CB75ED42EE94

Function 0093A3B0 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb5ef6380223df80c09fbffff4406c54564286920eb9de1bd108dda9bf4439f2
Instruction ID: 0089ddf45f5551b42c6fd3bfd359bd5252c54acd3253f4abe77723fafb6ebb03
Opcode Fuzzy Hash: eb5ef6380223df80c09fbffff4406c54564286920eb9de1bd108dda9bf4439f2
Instruction Fuzzy Hash: A6021C71E002199FDF14CFA9C8806AEB7F5EF88314F25816AE959E7284D731AE41CF91

Function 0094393B Relevance: 3.1, APIs: 2, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00943AC9: RegCloseKey.ADVAPI32(00000000,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00020019,00000000,?,?,?,?,?,0094396A,?), ref: 00943B3A

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0094398E
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 0094399F

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: AllocateCheckCloseInitializeMembershipToken
String ID:
API String ID: 2114926846-0
Opcode ID: 518ba7d7cee22637b8c60ed77929d5a37c6dcdf8a7419ce9fef88bb4a2624966
Instruction ID: 15acd0e1caaaadb68bbc7a952b5dd9fe4720a15c7680b3689d315a43e9fa7b24
Opcode Fuzzy Hash: 518ba7d7cee22637b8c60ed77929d5a37c6dcdf8a7419ce9fef88bb4a2624966
Instruction Fuzzy Hash: F91109B191021AEBDB10EFA5DC85FBFBBBCFF08300F50492DA545A6191E7B09A44CB55

Function 00944315 Relevance: 3.0, APIs: 2, Instructions: 44fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00928FFA,?,000002C0,00000000,00000000), ref: 00944350
FindClose.KERNEL32(00000000), ref: 0094435C

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: a1913402af69e2be67103c4da23336c51b5e48c7ce9c24be1dc33f6358812cf1
Instruction ID: d3dbf3bdb8a00efdb0580f375eb4e1e76c7f2ab1cfa65ddfc9db30a65c5aa2cd
Opcode Fuzzy Hash: a1913402af69e2be67103c4da23336c51b5e48c7ce9c24be1dc33f6358812cf1
Instruction Fuzzy Hash: 2B01F972600118ABDB10EF79DD89EAAB3BCEFC6711F000165F908D3240E7309D5D8B50

Function 00932B21 Relevance: 2.7, Strings: 2, Instructions: 214COMMON

Download Yara Rule

Strings

comres.dll, xrefs: 00932CC8, 00932CE1, 00932D09, 00932D34
0, xrefs: 00932C91

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID:
String ID: 0$comres.dll
API String ID: 0-3030269839
Opcode ID: f7a880ec5967ec64a90054ca813bf1243ddeae79b496adee3d9f08ad155e7dd2
Instruction ID: 5aa813a3a8697223282f26bdcfcb93f31c743d28d4fcb6a86d78126f667f4212
Opcode Fuzzy Hash: f7a880ec5967ec64a90054ca813bf1243ddeae79b496adee3d9f08ad155e7dd2
Instruction Fuzzy Hash: D151A9706047445BDB384F2C8856BFFA3ADEF53340F18495AE8C2DB282C619DE458F92

Function 0093ED4C Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0093ED47,?,?,00000008,?,?,0093E9E7,00000000), ref: 0093EF79

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 7f112b76f7f47a31d493d2bdf46d6dfdffc3c15d8a888f4a26c38f2317c88fdd
Instruction ID: 44522638428baf3da73def3c270f4a3b31afae9f07f2286d867bf8cdc700af17
Opcode Fuzzy Hash: 7f112b76f7f47a31d493d2bdf46d6dfdffc3c15d8a888f4a26c38f2317c88fdd
Instruction Fuzzy Hash: C8B128365106099FDB29CF28C48AB657BE1FF45364F258658E89ACF2E1C335E991CF40

Function 0094858F Relevance: 1.5, APIs: 1, Instructions: 23timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,00000000,?,?,?), ref: 009485A7

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: SystemTime
String ID:
API String ID: 2656138-0
Opcode ID: eca915c3a00b993ea5689142b946deed9409b5abe994ed6503325ec796d2d742
Instruction ID: cd7065c46c6f6cf4902365a451d63c2cfcc3eef9caa459669ad073c9ca95f4af
Opcode Fuzzy Hash: eca915c3a00b993ea5689142b946deed9409b5abe994ed6503325ec796d2d742
Instruction Fuzzy Hash: 44E04F7190511DEB8F00EFA8D911CFFB7BCEF09210B51405AF801AB100DA30AF19DBA6

Function 0092E773 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0002E77F,0092DEF8), ref: 0092E778

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 76052f2084f3d71ed01f868d11da3c39fc62585e7715fbdd23e8190872bbc305
Instruction ID: dd11fd3d2a819bd2e64e7e3b3d06182957c13392ff6441da0bc885eb8800a1ca
Opcode Fuzzy Hash: 76052f2084f3d71ed01f868d11da3c39fc62585e7715fbdd23e8190872bbc305
Instruction Fuzzy Hash:

Function 00930662 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: fba680df1b6bf9d20b6f9b57ea736a53376ec29cbbcc4db8a4903f46fa056be7
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 04C1C3322051A30EDF6D4A79D43423FBAA96EE27B171A576DD4B7CB0C5EE20C524DE20

Function 00930A97 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 26f87ccfd813939036aab59d372abd525c4280bb0bcb3dd9870b835a7a9b91c5
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: E3C1B3322091A30EDF6D467AD43413FFAB96AE27B171A176DD4B7CB1C4EE20D524DA20

Function 0093022D Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: 8bd704836cba449378c2dc416c0557110ca094972283f27f302f6e1586c1b454
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: 88C184322051A30EDF6D467A943813FBAA96AE27B171A576DD4B7CB0D4FE20C524DE20

Function 0092FE15 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 16aed5f79a41e69a32094bb20415f1b4bf49f0a8c378c6771371dc141479b71a
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 7AC1A3322090A30DDF6D4A79E43413FBAB96AE27B171A576DD4B7CB0D5EE20C524DA20

Function 00932D50 Relevance: .2, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09fec4e715685c5b3e8ab354e9019dd66aeaadc3b8dcad7f808bccfc3a2a87de
Instruction ID: cbc8a4d50000ab5739c341d107423fd03087ea17cbbc4d97d536a7255ec84173
Opcode Fuzzy Hash: 09fec4e715685c5b3e8ab354e9019dd66aeaadc3b8dcad7f808bccfc3a2a87de
Instruction Fuzzy Hash: 5E618B312407096ADB385B288897BBE339DEF81300F144919F853DF2C1D615DD828F56

Function 0090FE26 Relevance: 81.0, APIs: 1, Strings: 45, Instructions: 476registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000101,?,?,00020006,00000000,?,?,?), ref: 00910409

Strings

"%ls" /uninstall /quiet, xrefs: 009102B0
Failed to write update registration., xrefs: 0091034E
%hu.%hu.%hu.%hu, xrefs: 0090FF85
BundleProviderKey, xrefs: 0090FFA9, 0090FFAE
"%ls" /modify, xrefs: 00910218
SystemComponent, xrefs: 00910290, 009102A3
Failed to write %ls value., xrefs: 0091039A
QuietUninstallString, xrefs: 009102B5, 009102CB
Failed to update resume mode., xrefs: 009103D6
NoElevateOnModify, xrefs: 0091023F, 00910252
BundleAddonCode, xrefs: 0090FF07, 0090FF0F
%hs, xrefs: 0090FFE7
Failed to cache bundle from path: %ls, xrefs: 0090FE81
"%ls" %ls, xrefs: 009102ED
NoModify, xrefs: 009101F3, 00910206
Failed to create registration key., xrefs: 0090FEAE
HelpLink, xrefs: 009100C2, 009100D5
BundleDetectCode, xrefs: 0090FF25, 0090FF2D
BundleVersion, xrefs: 0090FF61, 0090FF8A
URLUpdateInfo, xrefs: 00910134, 00910147
%s,0, xrefs: 0091000F
Publisher, xrefs: 0091009C, 009100AF
HelpTelephone, xrefs: 009100E8, 009100FB
UninstallString, xrefs: 009102F2, 00910308
EngineVersion, xrefs: 0090FFEC, 0090FFF1
ParentKeyName, xrefs: 0091017A, 0091018D
DisplayVersion, xrefs: 00910069, 0091007C
URLInfoAbout, xrefs: 0091010E, 00910121
Failed to register the bundle dependency key., xrefs: 009103BC
/uninstall, xrefs: 009102DC
Comments, xrefs: 009101A2, 009101B5
ModifyPath, xrefs: 0091021D, 00910233
/modify, xrefs: 009102E1, 009102E9
Contact, xrefs: 009101CA, 009101DD
DisplayIcon, xrefs: 0091000A, 00910014
NoRemove, xrefs: 0091026B, 0091027E
Failed to write software tags., xrefs: 0091032E
3.10.4.4718, xrefs: 0090FFE2
ParentDisplayName, xrefs: 0091015A, 0091016D
BundleCachePath, xrefs: 0090FECE, 0090FED3
BundleUpgradeCode, xrefs: 0090FEE9, 0090FEF1
DisplayName, xrefs: 00910043, 00910056
BundleTag, xrefs: 0090FFCA, 0090FFCF
BundlePatchCode, xrefs: 0090FF43, 0090FF4B
EstimatedSize, xrefs: 00910385, 0091038A, 00910399

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Close
String ID: /uninstall$"%ls" %ls$"%ls" /modify$"%ls" /uninstall /quiet$%hs$%hu.%hu.%hu.%hu$%s,0$/modify$3.10.4.4718$BundleAddonCode$BundleCachePath$BundleDetectCode$BundlePatchCode$BundleProviderKey$BundleTag$BundleUpgradeCode$BundleVersion$Comments$Contact$DisplayIcon$DisplayName$DisplayVersion$EngineVersion$EstimatedSize$Failed to cache bundle from path: %ls$Failed to create registration key.$Failed to register the bundle dependency key.$Failed to update resume mode.$Failed to write %ls value.$Failed to write software tags.$Failed to write update registration.$HelpLink$HelpTelephone$ModifyPath$NoElevateOnModify$NoModify$NoRemove$ParentDisplayName$ParentKeyName$Publisher$QuietUninstallString$SystemComponent$URLInfoAbout$URLUpdateInfo$UninstallString
API String ID: 3535843008-3978993339
Opcode ID: c747b67f726a21048b70b8a5b13ac06e26db27e35db65163806fdbc011c88d1e
Instruction ID: de6ba60ed88ced8b7ce8f1377e334834fd8d717925d3f2bf99eaac60047f681d
Opcode Fuzzy Hash: c747b67f726a21048b70b8a5b13ac06e26db27e35db65163806fdbc011c88d1e
Instruction Fuzzy Hash: 6BF1C131B40A2EBBCF229A54CC02FED7AA4BBC4719F100611FD10B6251D7B6ADE5A7C0

Function 0090CCB6 Relevance: 73.9, APIs: 3, Strings: 39, Instructions: 366COMMON

Download Yara Rule

APIs

Part of subcall function 009038D4: GetProcessHeap.KERNEL32(?,000001C7,?,00902284,000001C7,00000001,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 009038E5
Part of subcall function 009038D4: RtlAllocateHeap.NTDLL(00000000,?,00902284,000001C7,00000001,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 009038EC

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,download,000000FF,00000000,Packaging,00000000,00000000,FilePath,00905355,00000000,0094CA64,0090533D,00000000), ref: 0090CDEC

Strings

Failed to get @CertificateRootThumbprint., xrefs: 0090D0C0
Failed to get @FilePath., xrefs: 0090D113
Failed to parse @FileSize., xrefs: 0090D09A
Failed to hex decode @CertificateRootPublicKeyIdentifier., xrefs: 0090D0AB
SourcePath, xrefs: 0090CEA9
Container, xrefs: 0090CE44
Invalid value for @Packaging: %ls, xrefs: 0090D0F9
embedded, xrefs: 0090CDFE
FileSize, xrefs: 0090CEFB
Failed to hex decode the Payload/@Hash., xrefs: 0090D0D5
FilePath, xrefs: 0090CDA4
Failed to get @DownloadUrl., xrefs: 0090D0E3
Failed to get @Container., xrefs: 0090D086
Failed to get next node., xrefs: 0090D121
Failed to find catalog., xrefs: 0090D0C7
Failed to allocate memory for payload structs., xrefs: 0090CD42
Failed to get payload node count., xrefs: 0090CD09
LayoutOnly, xrefs: 0090CE86
Failed to select payload nodes., xrefs: 0090CCE4
CertificateRootThumbprint, xrefs: 0090CF73
Payload, xrefs: 0090CCD1
Failed to to find container: %ls, xrefs: 0090D07F
CertificateRootPublicKeyIdentifier, xrefs: 0090CF36
Packaging, xrefs: 0090CDBF
Failed to get @Packaging., xrefs: 0090D10C
payload.cpp, xrefs: 0090CD38
Failed to get @LayoutOnly., xrefs: 0090D090
Failed to get @Id., xrefs: 0090D11A
Failed to get @Hash., xrefs: 0090D0DC
download, xrefs: 0090CDDE
Hash, xrefs: 0090CFB0
Catalog, xrefs: 0090CFE5
DownloadUrl, xrefs: 0090CED2
Failed to get @CertificateRootPublicKeyIdentifier., xrefs: 0090D0B2
Failed to get @Catalog., xrefs: 0090D0CE
Failed to get @FileSize., xrefs: 0090D0A4
external, xrefs: 0090CE1A
Failed to hex decode @CertificateRootThumbprint., xrefs: 0090D0B9
Failed to get @SourcePath., xrefs: 0090D0EA

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Heap$AllocateCompareProcessString
String ID: Catalog$CertificateRootPublicKeyIdentifier$CertificateRootThumbprint$Container$DownloadUrl$Failed to allocate memory for payload structs.$Failed to find catalog.$Failed to get @Catalog.$Failed to get @CertificateRootPublicKeyIdentifier.$Failed to get @CertificateRootThumbprint.$Failed to get @Container.$Failed to get @DownloadUrl.$Failed to get @FilePath.$Failed to get @FileSize.$Failed to get @Hash.$Failed to get @Id.$Failed to get @LayoutOnly.$Failed to get @Packaging.$Failed to get @SourcePath.$Failed to get next node.$Failed to get payload node count.$Failed to hex decode @CertificateRootPublicKeyIdentifier.$Failed to hex decode @CertificateRootThumbprint.$Failed to hex decode the Payload/@Hash.$Failed to parse @FileSize.$Failed to select payload nodes.$Failed to to find container: %ls$FilePath$FileSize$Hash$Invalid value for @Packaging: %ls$LayoutOnly$Packaging$Payload$SourcePath$download$embedded$external$payload.cpp
API String ID: 1171520630-3127305756
Opcode ID: 83da84776421ecbd1a61385322376b62a30c0d801c4628ccf5a190fc122b613b
Instruction ID: aea5416dd9af3817e2eede646c541a77d2ed6aa97b8b45560261c213722ddf04
Opcode Fuzzy Hash: 83da84776421ecbd1a61385322376b62a30c0d801c4628ccf5a190fc122b613b
Instruction Fuzzy Hash: 81C11472D4622ABFCB219BA0CC51FAEBA78EF45B28F104264F904B71D0C775AE11D790

Function 0090834D Relevance: 59.8, APIs: 5, Strings: 29, Instructions: 331COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0090533D,?,00000000,80070490,?,?,?,?,?,?,?,?,0092BF87,?,0090533D,?), ref: 0090837E
LeaveCriticalSection.KERNEL32(0090533D,?,?,?,?,?,?,?,?,0092BF87,?,0090533D,?,0090533D,0090533D,Chain), ref: 009086DB

Strings

Failed to change variant type., xrefs: 009086B1
Failed to get @Type., xrefs: 0090865F
Attempt to set built-in variable value: %ls, xrefs: 0090869F
Failed to set variant value., xrefs: 00908666
Initializing string variable '%ls' to value '%ls', xrefs: 009084F1
Value, xrefs: 0090843C
Failed to get @Value., xrefs: 0090866D
Failed to insert variable '%ls'., xrefs: 0090859D
Initializing numeric variable '%ls' to value '%ls', xrefs: 009084B9
Failed to find variable value '%ls'., xrefs: 009086A9
Failed to get next node., xrefs: 009086CD
Failed to set value of variable: %ls, xrefs: 0090867E
Failed to get @Persisted., xrefs: 009086B8
Type, xrefs: 0090847A
Persisted, xrefs: 00908421
Failed to get variable node count., xrefs: 009083B8
numeric, xrefs: 00908493
variable.cpp, xrefs: 00908690
Failed to get @Hidden., xrefs: 009086BF
Invalid value for @Type: %ls, xrefs: 0090864F
Hidden, xrefs: 00908406
Failed to set variant encryption, xrefs: 00908674
Variable, xrefs: 00908388
Failed to get @Id., xrefs: 009086C6
Initializing version variable '%ls' to value '%ls', xrefs: 0090852A
version, xrefs: 00908503
Initializing hidden variable '%ls', xrefs: 00908548
Failed to select variable nodes., xrefs: 0090839B
string, xrefs: 009084CE

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Attempt to set built-in variable value: %ls$Failed to change variant type.$Failed to find variable value '%ls'.$Failed to get @Hidden.$Failed to get @Id.$Failed to get @Persisted.$Failed to get @Type.$Failed to get @Value.$Failed to get next node.$Failed to get variable node count.$Failed to insert variable '%ls'.$Failed to select variable nodes.$Failed to set value of variable: %ls$Failed to set variant encryption$Failed to set variant value.$Hidden$Initializing hidden variable '%ls'$Initializing numeric variable '%ls' to value '%ls'$Initializing string variable '%ls' to value '%ls'$Initializing version variable '%ls' to value '%ls'$Invalid value for @Type: %ls$Persisted$Type$Value$Variable$numeric$string$variable.cpp$version
API String ID: 3168844106-1614826165
Opcode ID: 5f9107a723f797e3d901a015f68fe40c609ba6b8c2638fa47293444b6c835aef
Instruction ID: a7cd865e929fdff5341e535441062984815d9c6c63d915826298e71a95f9cd34
Opcode Fuzzy Hash: 5f9107a723f797e3d901a015f68fe40c609ba6b8c2638fa47293444b6c835aef
Instruction Fuzzy Hash: 02B1F0B2E01229BFCF119B94CC45EAFBB79AF84714F114665F940B62D0CB769E40DB90

Function 00926A85 Relevance: 58.1, APIs: 7, Strings: 26, Instructions: 377COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,0091BBCA,00000007,?,?,?), ref: 00926AD9

Part of subcall function 009409BB: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00905D8F,00000000), ref: 009409CF
Part of subcall function 009409BB: GetProcAddress.KERNEL32(00000000), ref: 009409D6
Part of subcall function 009409BB: GetLastError.KERNEL32(?,?,?,00905D8F,00000000), ref: 009409ED

CloseHandle.KERNEL32(00000000,?,000001F4,?,?,?,?,?,?,?,?,?,?,wusa.exe,?,00000025), ref: 00926EC9
CloseHandle.KERNEL32(00000000,?,000001F4,?,?,?,?,?,?,?,?,?,?,wusa.exe,?,00000025), ref: 00926EDD

Strings

"%ls" /uninstall /kb:%ls /quiet /norestart, xrefs: 00926C2E
Failed to append log switch to MSU command-line., xrefs: 00926C6F
Failed to get action arguments for MSU package., xrefs: 00926B8F
Failed to ensure WU service was enabled to install MSU package., xrefs: 00926CE7
SysNative\, xrefs: 00926B23
/log:, xrefs: 00926C5B
Failed to determine WOW64 status., xrefs: 00926AEB
Failed to allocate WUSA.exe path., xrefs: 00926B6C
2, xrefs: 00926D6C
Failed to append SysNative directory., xrefs: 00926B36
wusa.exe, xrefs: 00926B59
Failed to append log path to MSU command-line., xrefs: 00926C8D
Failed to find Windows directory., xrefs: 00926B18
Failed to CreateProcess on path: %ls, xrefs: 00926D53
D, xrefs: 00926CF4
Failed to format MSU install command., xrefs: 00926C15
"%ls" "%ls" /quiet /norestart, xrefs: 00926C01
Failed to build MSU path., xrefs: 00926BEE
Failed to get cached path for package: %ls, xrefs: 00926BB5
Bootstrapper application aborted during MSU progress., xrefs: 00926E0D
Failed to get process exit code., xrefs: 00926DE5
Failed to format MSU uninstall command., xrefs: 00926C42
msuengine.cpp, xrefs: 00926D46, 00926DDB, 00926E03
Failed to wait for executable to complete: %ls, xrefs: 00926E58
WixBundleExecutePackageCacheFolder, xrefs: 00926BC4, 00926EF5
Failed to find System32 directory., xrefs: 00926B4E

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Handle$Close$AddressCurrentErrorLastModuleProcProcess
String ID: /log:$"%ls" "%ls" /quiet /norestart$"%ls" /uninstall /kb:%ls /quiet /norestart$2$Bootstrapper application aborted during MSU progress.$D$Failed to CreateProcess on path: %ls$Failed to allocate WUSA.exe path.$Failed to append SysNative directory.$Failed to append log path to MSU command-line.$Failed to append log switch to MSU command-line.$Failed to build MSU path.$Failed to determine WOW64 status.$Failed to ensure WU service was enabled to install MSU package.$Failed to find System32 directory.$Failed to find Windows directory.$Failed to format MSU install command.$Failed to format MSU uninstall command.$Failed to get action arguments for MSU package.$Failed to get cached path for package: %ls$Failed to get process exit code.$Failed to wait for executable to complete: %ls$SysNative\$WixBundleExecutePackageCacheFolder$msuengine.cpp$wusa.exe
API String ID: 1400713077-4261965642
Opcode ID: 83f5da1c998b34d43487a9117cd64b24b8fd12ce589e6d5a13c490d3a97c08a5
Instruction ID: fee81924da593ccb365ade377f1779fbe3b5f3ee19595bce9b43947d8f9c0a9f
Opcode Fuzzy Hash: 83f5da1c998b34d43487a9117cd64b24b8fd12ce589e6d5a13c490d3a97c08a5
Instruction Fuzzy Hash: 15D1E370A0032AAFDF11EFE9DC85FAE7BB8AF48704F104025FA01A25A5D7B59E449B51

Function 009472F4 Relevance: 45.8, APIs: 13, Strings: 13, Instructions: 340COMMON

Download Yara Rule

APIs

Part of subcall function 009038D4: GetProcessHeap.KERNEL32(?,000001C7,?,00902284,000001C7,00000001,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 009038E5
Part of subcall function 009038D4: RtlAllocateHeap.NTDLL(00000000,?,00902284,000001C7,00000001,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 009038EC

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,generator,000000FF,?,?,?), ref: 00947407
SysFreeString.OLEAUT32(00000000), ref: 009475D0
SysFreeString.OLEAUT32(00000000), ref: 0094766D

Strings

updated, xrefs: 009474AE
category, xrefs: 00947362, 0094750F
@, xrefs: 00947576
atomutil.cpp, xrefs: 00947321, 00947657
subtitle, xrefs: 00947476
logo, xrefs: 0094745A
entry, xrefs: 0094737F, 00947548
title, xrefs: 00947492
generator, xrefs: 009473FA
author, xrefs: 00947345, 009474D6
(, xrefs: 009475AB
link, xrefs: 0094739C, 0094757E
icon, xrefs: 0094741E

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: String$FreeHeap$AllocateCompareProcess
String ID: ($@$atomutil.cpp$author$category$entry$generator$icon$link$logo$subtitle$title$updated
API String ID: 1555028553-2592408802
Opcode ID: 33bd6a877786ff920260b10a1c1e7c497bad129b9c20d795ed0049946c3687ed
Instruction ID: 1d094b72be98da4bdab6edc2adeadd2aed6041cb9bba56f7de2916fce8004af7
Opcode Fuzzy Hash: 33bd6a877786ff920260b10a1c1e7c497bad129b9c20d795ed0049946c3687ed
Instruction Fuzzy Hash: 5EB1A37194861ABBCB219BA8CC41F6EFB79AF05724F210754F921AA2D1D770EE00DB91

Function 00946FB7 Relevance: 45.8, APIs: 11, Strings: 15, Instructions: 298COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,00963C78,000000FF,?,?,?), ref: 0094707E
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,summary,000000FF), ref: 009470A3
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,title,000000FF), ref: 009470C3
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,published,000000FF), ref: 009470DF
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,updated,000000FF), ref: 00947107
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,author,000000FF), ref: 00947123
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,category,000000FF), ref: 0094715C
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,content,000000FF), ref: 00947195

Part of subcall function 00946BF6: SysFreeString.OLEAUT32(00000000), ref: 00946D2F
Part of subcall function 00946BF6: SysFreeString.OLEAUT32(00000000), ref: 00946D71

SysFreeString.OLEAUT32(00000000), ref: 00947219
SysFreeString.OLEAUT32(00000000), ref: 009472C9

Strings

updated, xrefs: 009470F9
summary, xrefs: 00947095
msi.dll, xrefs: 00946FE1
category, xrefs: 00946FFF, 0094714E
clbcatq.dll, xrefs: 009470EC
atomutil.cpp, xrefs: 009472B6
cabinet.dll, xrefs: 00946FFA
version.dll, xrefs: 00946FDD
content, xrefs: 00947187
published, xrefs: 009470D1
title, xrefs: 009470B5
author, xrefs: 00946FE2, 00947115
(, xrefs: 009471F4
link, xrefs: 0094701C, 009471C7
feclient.dll, xrefs: 009470B0

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: String$Compare$Free
String ID: ($atomutil.cpp$author$cabinet.dll$category$clbcatq.dll$content$feclient.dll$link$msi.dll$published$summary$title$updated$version.dll
API String ID: 318886736-4294603148
Opcode ID: bc12eae698f0b14ada45dbc044cd42c7bf89b9d8122bc685dfb7f61923d14549
Instruction ID: f6dd50bf93b4c1fa8703ce801d1622d6f65ac88fd6c58247e746a428192a5896
Opcode Fuzzy Hash: bc12eae698f0b14ada45dbc044cd42c7bf89b9d8122bc685dfb7f61923d14549
Instruction Fuzzy Hash: DBA19E7194822ABBCB219BE4CC41FAEF778AF05730F204755F921A62D1D7B0EA50DB90

Function 009152E3 Relevance: 45.7, APIs: 17, Strings: 9, Instructions: 222filepipesleepCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00000000,?,0094B4F0,?,00000000,?,0090442A,?,0094B4F0), ref: 00915304
GetCurrentProcessId.KERNEL32(?,0090442A,?,0094B4F0), ref: 0091530F
SetNamedPipeHandleState.KERNEL32(?,000000FF,00000000,00000000,?,0090442A,?,0094B4F0), ref: 00915346
ConnectNamedPipe.KERNEL32(?,00000000,?,0090442A,?,0094B4F0), ref: 0091535B
GetLastError.KERNEL32(?,0090442A,?,0094B4F0), ref: 00915365
Sleep.KERNEL32(00000064,?,0090442A,?,0094B4F0), ref: 00915396
SetNamedPipeHandleState.KERNEL32(?,00000000,00000000,00000000,?,0090442A,?,0094B4F0), ref: 009153B9
WriteFile.KERNEL32(?,crypt32.dll,00000004,00000000,00000000,?,0090442A,?,0094B4F0), ref: 009153D4
WriteFile.KERNEL32(?,0090442A,0094B4F0,00000000,00000000,?,0090442A,?,0094B4F0), ref: 009153EF
WriteFile.KERNEL32(?,?,00000004,00000000,00000000,?,0090442A,?,0094B4F0), ref: 0091540A
ReadFile.KERNEL32(?,00000000,00000004,00000000,00000000,?,0090442A,?,0094B4F0), ref: 00915425
GetLastError.KERNEL32(?,0090442A,?,0094B4F0), ref: 0091547D
GetLastError.KERNEL32(?,0090442A,?,0094B4F0), ref: 009154B1
GetLastError.KERNEL32(?,0090442A,?,0094B4F0), ref: 009154E5
GetLastError.KERNEL32(?,0090442A,?,0094B4F0), ref: 0091557B

Strings

Failed to set pipe to non-blocking., xrefs: 009155A5
Failed to wait for child to connect to pipe., xrefs: 00915473
Failed to read ACK from pipe., xrefs: 009154A7
Failed to write secret length to pipe., xrefs: 00915543
crypt32.dll, xrefs: 009153D2
Failed to write our process id to pipe., xrefs: 009154DB
Failed to reset pipe to blocking., xrefs: 00915574
Failed to write secret to pipe., xrefs: 0091550F
pipe.cpp, xrefs: 00915469, 0091549D, 009154D1, 00915505, 00915539, 0091556A, 0091559B

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorLast$File$NamedPipeWrite$HandleState$ConnectCurrentProcessReadSleeplstrlen
String ID: Failed to read ACK from pipe.$Failed to reset pipe to blocking.$Failed to set pipe to non-blocking.$Failed to wait for child to connect to pipe.$Failed to write our process id to pipe.$Failed to write secret length to pipe.$Failed to write secret to pipe.$crypt32.dll$pipe.cpp
API String ID: 2944378912-2047837012
Opcode ID: cfdb0ee0d208d05005c44557c0c020842b131f0b037dcfc0df1406fe21a13dee
Instruction ID: 8c95de9c1f7b023eceb4bbab016c817ab41efd6e0fd298de8a76c928455a72da
Opcode Fuzzy Hash: cfdb0ee0d208d05005c44557c0c020842b131f0b037dcfc0df1406fe21a13dee
Instruction Fuzzy Hash: 7B61E3B6F50729EAE710EAA98C45BEAB6EDAF44741F134125BD01E7090E7B4CD4087E1

Function 0090A311 Relevance: 44.0, APIs: 8, Strings: 17, Instructions: 299registryCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 0090A356
_MREFOpen@16.MSPDB140-MSVCRT ref: 0090A37C
RegCloseKey.ADVAPI32(00000000,?,00000000,?,?,?,?,?), ref: 0090A666

Strings

Registry key not found. Key = '%ls', xrefs: 0090A3B0
Failed to format key string., xrefs: 0090A361
Failed to read registry value., xrefs: 0090A5F4
Failed to query registry key value., xrefs: 0090A4D8
Failed to allocate memory registry value., xrefs: 0090A487
search.cpp, xrefs: 0090A44A, 0090A47D, 0090A4CE, 0090A5D1
Failed to format value string., xrefs: 0090A387
Failed to change value type., xrefs: 0090A60D
RegistrySearchValue failed: ID '%ls', HRESULT 0x%x, xrefs: 0090A63E
Failed to open registry key., xrefs: 0090A3E9
Registry value not found. Key = '%ls', Value = '%ls', xrefs: 0090A418
Failed to set variable., xrefs: 0090A629
Failed to allocate string buffer., xrefs: 0090A565
Failed to clear variable., xrefs: 0090A3D4
Unsupported registry key value type. Type = '%u', xrefs: 0090A506
Failed to get expand environment string., xrefs: 0090A5DB
Failed to query registry key value size., xrefs: 0090A454

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Open@16$Close
String ID: Failed to allocate memory registry value.$Failed to allocate string buffer.$Failed to change value type.$Failed to clear variable.$Failed to format key string.$Failed to format value string.$Failed to get expand environment string.$Failed to open registry key.$Failed to query registry key value size.$Failed to query registry key value.$Failed to read registry value.$Failed to set variable.$Registry key not found. Key = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchValue failed: ID '%ls', HRESULT 0x%x$Unsupported registry key value type. Type = '%u'$search.cpp
API String ID: 2348241696-3124384294
Opcode ID: 847eaf7d70ccf0846d341ddc0101fad7a93712267774921b6eac8b9ec9d9d3ad
Instruction ID: 7b7f544b9b986e4f293b5d4bba8667644d70d5897869e4f1b76c4bed1343ad80
Opcode Fuzzy Hash: 847eaf7d70ccf0846d341ddc0101fad7a93712267774921b6eac8b9ec9d9d3ad
Instruction Fuzzy Hash: DFA1B172D40729BFDF229AA4CC45FAE7AB9BF48310F148125F904B61D0D7769E009BE2

Function 0092D22C Relevance: 44.0, APIs: 10, Strings: 15, Instructions: 276processCOMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0092D2A7
StringFromGUID2.OLE32(?,?,00000027), ref: 0092D2D0
CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?,?,?,?,?), ref: 0092D3BC
GetLastError.KERNEL32(?,?,?,?), ref: 0092D3C6
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,00000064,?,?,?,?), ref: 0092D45B
GetExitCodeProcess.KERNEL32(?,?), ref: 0092D485
GetLastError.KERNEL32(?,?,?,?), ref: 0092D493
GetLastError.KERNEL32(?,?,?,?), ref: 0092D4CB

Part of subcall function 0092D12C: WaitForSingleObject.KERNEL32(?,000000FF,74DF30B0,00000000,?,?,?,?,0092D439,?), ref: 0092D145
Part of subcall function 0092D12C: ReleaseMutex.KERNEL32(?,?,?,?,0092D439,?), ref: 0092D161
Part of subcall function 0092D12C: WaitForSingleObject.KERNEL32(?,000000FF), ref: 0092D1A4
Part of subcall function 0092D12C: ReleaseMutex.KERNEL32(?), ref: 0092D1BB
Part of subcall function 0092D12C: SetEvent.KERNEL32(?), ref: 0092D1C4

CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?), ref: 0092D580
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?), ref: 0092D598

Strings

Failed to convert netfx chainer guid into string., xrefs: 0092D2EF
Failed to CreateProcess on path: %ls, xrefs: 0092D3F5
Failed to process netfx chainer message., xrefs: 0092D43F
Failed to allocate netfx chainer arguments., xrefs: 0092D387
Failed to allocate section name., xrefs: 0092D311
Failed to allocate event name., xrefs: 0092D333
Failed to wait for netfx chainer process to complete, xrefs: 0092D4F9
%ls /pipe %ls, xrefs: 0092D373
D, xrefs: 0092D3A1
NetFxChainer.cpp, xrefs: 0092D2E5, 0092D3EA, 0092D4B7, 0092D4EF
NetFxEvent.%ls, xrefs: 0092D31F
Failed to create netfx chainer., xrefs: 0092D352
Failed to create netfx chainer guid., xrefs: 0092D2B4
Failed to get netfx return code., xrefs: 0092D4C1
NetFxSection.%ls, xrefs: 0092D2FD

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorLastWait$CloseCreateHandleMutexObjectProcessReleaseSingle$CodeEventExitFromMultipleObjectsStringUuid
String ID: %ls /pipe %ls$D$Failed to CreateProcess on path: %ls$Failed to allocate event name.$Failed to allocate netfx chainer arguments.$Failed to allocate section name.$Failed to convert netfx chainer guid into string.$Failed to create netfx chainer guid.$Failed to create netfx chainer.$Failed to get netfx return code.$Failed to process netfx chainer message.$Failed to wait for netfx chainer process to complete$NetFxChainer.cpp$NetFxEvent.%ls$NetFxSection.%ls
API String ID: 2531618940-1825855094
Opcode ID: 067e459b8148986f5db2c0c7db35592bdd6e0fb3fa722e2118efdb29ff8bd1c6
Instruction ID: 8b86f5ad98b989a0399a613e80d429c4dafda3e4a4f0b50da2730b00af4058a2
Opcode Fuzzy Hash: 067e459b8148986f5db2c0c7db35592bdd6e0fb3fa722e2118efdb29ff8bd1c6
Instruction Fuzzy Hash: 09A19E71E01328AFEB209BA4DC45FAEB7B8AF88304F104169F909F7195D7749E448FA1

Function 0090567D Relevance: 42.5, APIs: 5, Strings: 19, Instructions: 476stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(000002C0,00000100,00000100,00000000,00000000,?,009099BB,000002C0,?,00000000,00000000,000002C0,00000100,000002C0,00000100), ref: 009056A2
lstrlenW.KERNEL32(00000000,?,009099BB,000002C0,?,00000000,00000000,000002C0,00000100,000002C0,00000100), ref: 009056AC
_wcschr.LIBVCRUNTIME ref: 009058B4
LeaveCriticalSection.KERNEL32(000002C0,00000000,00000000,00000000,00000000,00000000,00000001,?,009099BB,000002C0,?,00000000,00000000,000002C0,00000100,000002C0), ref: 00905B56

Strings

Failed to allocate buffer for format string., xrefs: 009056CA
variable.cpp, xrefs: 0090590A, 0090592B, 00905984, 009059D0, 00905A60, 00905A95, 00905B0D
*****, xrefs: 00905820
Failed to set record string., xrefs: 00905AA2
Failed to format placeholder string., xrefs: 00905963
Failed to determine variable visibility: '%ls'., xrefs: 00905946
Failed to append placeholder., xrefs: 00905959
Failed to get variable name., xrefs: 00905998
[%d], xrefs: 0090586F
Failed to append string., xrefs: 00905728
Failed to reallocate variable array., xrefs: 00905938
Failed to get formatted length., xrefs: 00905A6D
Failed to allocate variable array., xrefs: 00905991
Failed to allocate string., xrefs: 00905AD1
Failed to copy string., xrefs: 00905B3A
Failed to set record format string., xrefs: 009059DD
Failed to allocate record., xrefs: 00905917
Failed to format record., xrefs: 00905B1A
Failed to set variable value., xrefs: 0090596D

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterLeave_wcschrlstrlen
String ID: *****$Failed to allocate buffer for format string.$Failed to allocate record.$Failed to allocate string.$Failed to allocate variable array.$Failed to append placeholder.$Failed to append string.$Failed to copy string.$Failed to determine variable visibility: '%ls'.$Failed to format placeholder string.$Failed to format record.$Failed to get formatted length.$Failed to get variable name.$Failed to reallocate variable array.$Failed to set record format string.$Failed to set record string.$Failed to set variable value.$[%d]$variable.cpp
API String ID: 1026845265-2050445661
Opcode ID: a417b6aace3a19e259a022b01108d1b70148c41b1f702a57e1fece58c6a29cbe
Instruction ID: b044f47cdc631edef5e65f5bb6b65d0a9445a8e39edf06ec9788e6e6984924bf
Opcode Fuzzy Hash: a417b6aace3a19e259a022b01108d1b70148c41b1f702a57e1fece58c6a29cbe
Instruction Fuzzy Hash: D8F1C3B5E01619EFDB209FA48841EAF7BA8EF84750F128529FD15E7280D7349E01DFA1

Function 0092CC24 Relevance: 40.5, APIs: 12, Strings: 11, Instructions: 235synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 009038D4: GetProcessHeap.KERNEL32(?,000001C7,?,00902284,000001C7,00000001,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 009038E5
Part of subcall function 009038D4: RtlAllocateHeap.NTDLL(00000000,?,00902284,000001C7,00000001,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 009038EC

CreateEventW.KERNEL32(00000000,00000000,00000000,?,00000000,00000018,00000001,?,00000000,?,?,0092D34C,?,?,?), ref: 0092CC6A
GetLastError.KERNEL32(?,?,0092D34C,?,?,?), ref: 0092CC77
ReleaseMutex.KERNEL32(?), ref: 0092CEDF

Strings

NetFxChainer.cpp, xrefs: 0092CC46, 0092CC98, 0092CCFD, 0092CD6C, 0092CDBE, 0092CE06
failed to allocate memory for event name, xrefs: 0092CCBD
%ls_mutex, xrefs: 0092CD18
failed to allocate memory for mutex name, xrefs: 0092CD2C
Failed to create event: %ls, xrefs: 0092CD0A
Failed to MapViewOfFile for %ls., xrefs: 0092CE13
Failed to create mutex: %ls, xrefs: 0092CD79
%ls_send, xrefs: 0092CCA9
failed to copy event name to shared memory structure., xrefs: 0092CE3D
Failed to allocate memory for NetFxChainer struct., xrefs: 0092CC50
Failed to memory map cabinet file: %ls, xrefs: 0092CDCB

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Heap$AllocateCreateErrorEventLastMutexProcessRelease
String ID: %ls_mutex$%ls_send$Failed to MapViewOfFile for %ls.$Failed to allocate memory for NetFxChainer struct.$Failed to create event: %ls$Failed to create mutex: %ls$Failed to memory map cabinet file: %ls$NetFxChainer.cpp$failed to allocate memory for event name$failed to allocate memory for mutex name$failed to copy event name to shared memory structure.
API String ID: 3944734951-2991465304
Opcode ID: 0a053d12e84c457848bec4f9f5be7efe4e05ae5a7731e648818a88834642cb4b
Instruction ID: f3fa681d0355de959031f9822f1745736fed4dd0ba903cabfa894fff27f13e1d
Opcode Fuzzy Hash: 0a053d12e84c457848bec4f9f5be7efe4e05ae5a7731e648818a88834642cb4b
Instruction Fuzzy Hash: B97111B6A80721BFE3219B699C49F9B7AE8FF59350F028125FD18A7290D774CD00C6E5

Function 0090E936 Relevance: 40.5, APIs: 4, Strings: 19, Instructions: 231COMMON

Download Yara Rule

APIs

Part of subcall function 009431C7: VariantInit.OLEAUT32(?), ref: 009431DD
Part of subcall function 009431C7: SysAllocString.OLEAUT32(?), ref: 009431F9
Part of subcall function 009431C7: VariantClear.OLEAUT32(?), ref: 00943280
Part of subcall function 009431C7: SysFreeString.OLEAUT32(00000000), ref: 0094328B

CompareStringW.KERNEL32(0000007F,00000000,000000FF,000000FF,Detect,000000FF,?,0094CA64,?,?,Action,?,?,?,00000000,0090533D), ref: 0090EA07
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,Upgrade,000000FF), ref: 0090EA51

Strings

comres.dll, xrefs: 0090EA1A
Failed to resize Upgrade code array in registration, xrefs: 0090EB29
Failed to resize Addon code array in registration, xrefs: 0090EB30
RelatedBundle, xrefs: 0090E944
Detect, xrefs: 0090E9F8
Failed to get RelatedBundle element count., xrefs: 0090E98B
Invalid value for @Action: %ls, xrefs: 0090EB46
Action, xrefs: 0090E9C4
cabinet.dll, xrefs: 0090EAAE
version.dll, xrefs: 0090EA64
Failed to get RelatedBundle nodes, xrefs: 0090E966
Failed to resize Patch code array in registration, xrefs: 0090EB37
Failed to resize Detect code array in registration, xrefs: 0090EB22
Addon, xrefs: 0090EA8E
Failed to get @Id., xrefs: 0090EB56
Upgrade, xrefs: 0090EA44
Failed to get next RelatedBundle element., xrefs: 0090EB64
Failed to get @Action., xrefs: 0090EB5D
Patch, xrefs: 0090EAD1

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: String$CompareVariant$AllocClearFreeInit
String ID: Action$Addon$Detect$Failed to get @Action.$Failed to get @Id.$Failed to get RelatedBundle element count.$Failed to get RelatedBundle nodes$Failed to get next RelatedBundle element.$Failed to resize Addon code array in registration$Failed to resize Detect code array in registration$Failed to resize Patch code array in registration$Failed to resize Upgrade code array in registration$Invalid value for @Action: %ls$Patch$RelatedBundle$Upgrade$cabinet.dll$comres.dll$version.dll
API String ID: 702752599-259800149
Opcode ID: 69b02319db440f52384d38d1a30d84c28faba01c1e24595ea51818f953a42507
Instruction ID: 8652d6b6eea06bd901fc737d17199b51956b14ca376c304fb370e44053bca947
Opcode Fuzzy Hash: 69b02319db440f52384d38d1a30d84c28faba01c1e24595ea51818f953a42507
Instruction Fuzzy Hash: 54719E71A0462ABFCB10DAA5C841FAAB7B8FF44725F204A55E912A76C0D734EE50CB90

Function 00908E48 Relevance: 37.2, APIs: 8, Strings: 13, Instructions: 433COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,560094DB,00000001,?,00909801,?,00000000,00000000), ref: 00908E8D

Strings

-, xrefs: 00908FF1
Failed to parse condition "%ls". Unexpected character at position %d., xrefs: 0090903A
Failed to parse condition "%ls". Unexpected '~' operator at position %d., xrefs: 009092C8
Failed to parse condition "%ls". Unterminated literal at position %d., xrefs: 00908F6F
condition.cpp, xrefs: 00908F5C, 00909027, 0090909C, 009090F9, 0090923A, 0090927A, 009092B5
Failed to parse condition "%ls". Invalid version format, at position %d., xrefs: 0090910C
Failed to parse condition "%ls". Version can have a maximum of 4 parts, at position %d., xrefs: 009090AF
Failed to parse condition "%ls". Identifier cannot start at a digit, at position %d., xrefs: 0090928D
Failed to parse condition "%ls". Constant too big, at position %d., xrefs: 0090924D
Failed to set symbol value., xrefs: 00908F35
@, xrefs: 00908E93
AND, xrefs: 00909187
NOT, xrefs: 009091A7

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: StringType
String ID: -$@$AND$Failed to parse condition "%ls". Constant too big, at position %d.$Failed to parse condition "%ls". Identifier cannot start at a digit, at position %d.$Failed to parse condition "%ls". Invalid version format, at position %d.$Failed to parse condition "%ls". Unexpected '~' operator at position %d.$Failed to parse condition "%ls". Unexpected character at position %d.$Failed to parse condition "%ls". Unterminated literal at position %d.$Failed to parse condition "%ls". Version can have a maximum of 4 parts, at position %d.$Failed to set symbol value.$NOT$condition.cpp
API String ID: 4177115715-3640792234
Opcode ID: 4226865df87ca83422ac44d53ef8f44baa337979d5058066ba99110c6cda16b9
Instruction ID: def60c8b71b2afaf69692a7c830f28cf30b437dfdfbf22d42e9780bf630e32a7
Opcode Fuzzy Hash: 4226865df87ca83422ac44d53ef8f44baa337979d5058066ba99110c6cda16b9
Instruction Fuzzy Hash: 85E120B6604205EFDB218F58C889FBA7BA9FF45704F144085F9459E2C6C7B9CAC1DB90

Function 009144E7 Relevance: 36.9, APIs: 10, Strings: 11, Instructions: 181fileCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,8000FFFF,feclient.dll,?,009149FE,0094B4D8,?,feclient.dll,00000000,?,?), ref: 009144FE
ReadFile.KERNEL32(feclient.dll,feclient.dll,00000004,?,00000000,?,009149FE,0094B4D8,?,feclient.dll,00000000,?,?), ref: 0091451F
GetLastError.KERNEL32(?,009149FE,0094B4D8,?,feclient.dll,00000000,?,?), ref: 00914525
WriteFile.KERNEL32(feclient.dll,?,00000004,009149FE,00000000,?,009149FE,0094B4D8,?,feclient.dll,00000000,?,?), ref: 0091468E
GetLastError.KERNEL32(?,009149FE,0094B4D8,?,feclient.dll,00000000,?,?), ref: 00914698

Strings

Verification secret from parent is too big., xrefs: 00914580
msasn1.dll, xrefs: 00914636
Verification process id from parent does not match., xrefs: 00914708
Failed to allocate buffer for verification secret., xrefs: 0091459C
Failed to read verification process id from parent pipe., xrefs: 0091466C
Failed to inform parent process that child is running., xrefs: 009146C6
Verification secret from parent does not match., xrefs: 00914621
feclient.dll, xrefs: 009144ED, 0091451D, 0091451E, 009145B2, 00914637, 0091468D
Failed to read verification secret from parent pipe., xrefs: 009145E7
Failed to read size of verification secret from parent pipe., xrefs: 00914553
pipe.cpp, xrefs: 00914549, 00914574, 009145DD, 00914615, 00914662, 009146BC, 009146FC

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorFileLast$CurrentProcessReadWrite
String ID: Failed to allocate buffer for verification secret.$Failed to inform parent process that child is running.$Failed to read size of verification secret from parent pipe.$Failed to read verification process id from parent pipe.$Failed to read verification secret from parent pipe.$Verification process id from parent does not match.$Verification secret from parent does not match.$Verification secret from parent is too big.$feclient.dll$msasn1.dll$pipe.cpp
API String ID: 3008747291-452622383
Opcode ID: 7a41bd2b51148cfd5fd6fa32ddad0fbd196a049e80516e3f30de89584b51da3f
Instruction ID: 825a386c6c6e49496249da0917340368ad84f9aa2e364ee91147daa0d8fd4f7b
Opcode Fuzzy Hash: 7a41bd2b51148cfd5fd6fa32ddad0fbd196a049e80516e3f30de89584b51da3f
Instruction Fuzzy Hash: 44511276B40319BBE710DAA58C81FAF77ACAB89759F114125FE00F7190D7348E4497E1

Function 009225AF Relevance: 36.9, APIs: 3, Strings: 18, Instructions: 145COMMON

Download Yara Rule

Strings

Failed to get @UninstallArguments., xrefs: 0092261C
Failed to get @Protocol., xrefs: 00922727
UninstallArguments, xrefs: 0092260B
burn, xrefs: 00922693
DetectCondition, xrefs: 009225C7
Failed to parse command lines., xrefs: 0092273B
none, xrefs: 009226E9
Repairable, xrefs: 0092264F
Failed to get @RepairArguments., xrefs: 0092263E
RepairArguments, xrefs: 0092262D
Failed to get @InstallArguments., xrefs: 009225FA
Failed to get @DetectCondition., xrefs: 009225D8
netfx4, xrefs: 009226C8
InstallArguments, xrefs: 009225E9
Invalid protocol type: %ls, xrefs: 0092270F
Protocol, xrefs: 00922676
Failed to get @Repairable., xrefs: 00922668
Failed to parse exit codes., xrefs: 009226BF

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: DetectCondition$Failed to get @DetectCondition.$Failed to get @InstallArguments.$Failed to get @Protocol.$Failed to get @RepairArguments.$Failed to get @Repairable.$Failed to get @UninstallArguments.$Failed to parse command lines.$Failed to parse exit codes.$InstallArguments$Invalid protocol type: %ls$Protocol$RepairArguments$Repairable$UninstallArguments$burn$netfx4$none
API String ID: 760788290-1911311241
Opcode ID: bf96d1e1fdb6fd1c36189e8948662047e255e981da5305a94d5979b87445f0aa
Instruction ID: 7bb47240716002f8aa2cb495e20cb14c4c075eae44c1e7e7a2bab9316026a0f2
Opcode Fuzzy Hash: bf96d1e1fdb6fd1c36189e8948662047e255e981da5305a94d5979b87445f0aa
Instruction Fuzzy Hash: 84416B33A8877576C7219370AC42FAEB66CAB94B35F200712FD10B62D4C7A4BD0C9395

Function 00921970 Relevance: 35.2, APIs: 4, Strings: 16, Instructions: 212COMMON

Download Yara Rule

APIs

Part of subcall function 009038D4: GetProcessHeap.KERNEL32(?,000001C7,?,00902284,000001C7,00000001,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 009038E5
Part of subcall function 009038D4: RtlAllocateHeap.NTDLL(00000000,?,00902284,000001C7,00000001,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 009038EC

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,success,000000FF,?,Type,00000000,?,?,00000000,?,00000001,?), ref: 00921A77
CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,error,000000FF), ref: 00921A95

Strings

scheduleReboot, xrefs: 00921AA4
Failed to get @Type., xrefs: 00921B76
Failed to get @Code., xrefs: 00921B57
Failed to allocate memory for exit code structs., xrefs: 00921A02
Failed to get exit code node count., xrefs: 009219C2
Failed to select exit code nodes., xrefs: 0092199D
Failed to get next node., xrefs: 00921B7D
Invalid exit code type: %ls, xrefs: 00921B66
ExitCode, xrefs: 0092197E
success, xrefs: 00921A68
exeengine.cpp, xrefs: 009219F8
Failed to parse @Code value: %ls, xrefs: 00921B50
Type, xrefs: 00921A4F
Code, xrefs: 00921AE4
error, xrefs: 00921A88
forceReboot, xrefs: 00921AC2

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CompareHeapString$AllocateProcess
String ID: Code$ExitCode$Failed to allocate memory for exit code structs.$Failed to get @Code.$Failed to get @Type.$Failed to get exit code node count.$Failed to get next node.$Failed to parse @Code value: %ls$Failed to select exit code nodes.$Invalid exit code type: %ls$Type$error$exeengine.cpp$forceReboot$scheduleReboot$success
API String ID: 2664528157-1714101571
Opcode ID: 1ab028d7c8936c61b8e65e0859ee3d1d4edfc1aa8446e7a6a03efa33ddf2e5dc
Instruction ID: 656d8206b04a34473abae70abe9de4f3ff06337658ba7e5f17685d1ef962ea58
Opcode Fuzzy Hash: 1ab028d7c8936c61b8e65e0859ee3d1d4edfc1aa8446e7a6a03efa33ddf2e5dc
Instruction Fuzzy Hash: 3D611335A0522ABBCB10DFA4DC41EAEBBB8EF94720F204255F814AB2D9D7709E10D780

Function 0090F09D Relevance: 33.4, APIs: 3, Strings: 16, Instructions: 180registryCOMMON

Download Yara Rule

APIs

Part of subcall function 009439CD: GetVersionExW.KERNEL32(?,?,00000000,?), ref: 00943A1A

RegCloseKey.ADVAPI32(00000000,?,00020006,00020006,00000000,?,?,00000002,00000000,?,00000000,00000001,00000002), ref: 0090F2CB

Part of subcall function 00941344: RegSetValueExW.ADVAPI32(?,?,00000000,00000004,?,00000004,SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce,?,0090F11A,00000005,Resume,?,?,?,00000002,00000000), ref: 00941359

Strings

Installed, xrefs: 0090F132
Failed to delete run key value., xrefs: 0090F25A
Failed to write Installed value., xrefs: 0090F143
Failed to delete resume command line value., xrefs: 0090F2A7
Failed to create run key., xrefs: 0090F1AA
registration.cpp, xrefs: 0090F250, 0090F29D
BundleResumeCommandLine, xrefs: 0090F1D5, 0090F267
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 0090F0FA
Failed to write run key value., xrefs: 0090F1C8
burn.runonce, xrefs: 0090F167
Failed to write Resume value., xrefs: 0090F120
Failed to format resume command line for RunOnce., xrefs: 0090F186
"%ls" /%ls, xrefs: 0090F172
Failed to write resume command line value., xrefs: 0090F1EA
Resume, xrefs: 0090F10F
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 0090F0AE

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CloseValueVersion
String ID: "%ls" /%ls$BundleResumeCommandLine$Failed to create run key.$Failed to delete resume command line value.$Failed to delete run key value.$Failed to format resume command line for RunOnce.$Failed to write Installed value.$Failed to write Resume value.$Failed to write resume command line value.$Failed to write run key value.$Installed$Resume$SOFTWARE\Microsoft\Windows\CurrentVersion\Run$SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce$burn.runonce$registration.cpp
API String ID: 2348918689-3140388177
Opcode ID: 75a2e12a1712851d3dea966ae0a59f53475bbfe6e9ee01f87340b39e2a382fce
Instruction ID: 3ca89e4c6b27e6c547fdaf258fac525c7ebcdc95f8e1b01680c9e921b3c3cb83
Opcode Fuzzy Hash: 75a2e12a1712851d3dea966ae0a59f53475bbfe6e9ee01f87340b39e2a382fce
Instruction Fuzzy Hash: BE51ED36A40729FFCF21AAA9CC42BAE7AA8AF84744F004535FD10F6991D771DE549BC0

Function 00947FEC Relevance: 31.8, APIs: 9, Strings: 9, Instructions: 309COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000000,00000000,00000000,000002C0), ref: 00948019
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,application,000000FF), ref: 00948034
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,upgrade,000000FF), ref: 009480D7
CompareStringW.KERNEL32(0000007F,00000000,00700079,000000FF,version,000000FF,00000018,0094B508,00000000), ref: 00948116
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exclusive,000000FF), ref: 00948169
CompareStringW.KERNEL32(0000007F,00000000,0094B508,000000FF,true,000000FF), ref: 00948187
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,version,000000FF), ref: 009481BF
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,enclosure,000000FF), ref: 00948303

Strings

type, xrefs: 0094805F
enclosure, xrefs: 009482F1
apuputil.cpp, xrefs: 00948226
exclusive, xrefs: 0094815B
version, xrefs: 00948108, 009481B1
true, xrefs: 00948179
application, xrefs: 00948026
upgrade, xrefs: 009480C9
http://appsyndication.org/2006/appsyn, xrefs: 0094800C

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CompareString
String ID: application$apuputil.cpp$enclosure$exclusive$http://appsyndication.org/2006/appsyn$true$type$upgrade$version
API String ID: 1825529933-3037633208
Opcode ID: d7af91cfc7d23685d18a47bfb6e658f6d96afb95c799db420fffb6ea8f11e69d
Instruction ID: 5a050e8715c7548de93a3cf2af45c79f6fd4b0602d1b880a561e03aae88f4eb2
Opcode Fuzzy Hash: d7af91cfc7d23685d18a47bfb6e658f6d96afb95c799db420fffb6ea8f11e69d
Instruction Fuzzy Hash: D9B18C71958606AFDB219F64CC85F5F77BAAB48720F244A19F939EB2D1DB70E840CB00

Function 009476A1 Relevance: 31.7, APIs: 8, Strings: 10, Instructions: 210COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,rel,000000FF,?,?,?,00000000), ref: 00947703
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,href,000000FF), ref: 00947727
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,length,000000FF), ref: 00947746
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,title,000000FF), ref: 0094777D
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,type,000000FF), ref: 00947798
SysFreeString.OLEAUT32(00000000), ref: 009477C3
SysFreeString.OLEAUT32(00000000), ref: 00947842
SysFreeString.OLEAUT32(00000000), ref: 0094788E

Strings

comres.dll, xrefs: 00947750
title, xrefs: 00947770
type, xrefs: 0094778B
msi.dll, xrefs: 0094782A
rel, xrefs: 009476F4
msasn1.dll, xrefs: 0094787C
version.dll, xrefs: 009477A7
href, xrefs: 0094771A
length, xrefs: 00947739
feclient.dll, xrefs: 00947734

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: String$Compare$Free
String ID: comres.dll$feclient.dll$href$length$msasn1.dll$msi.dll$rel$title$type$version.dll
API String ID: 318886736-3944986760
Opcode ID: ce07e42ca5370d084e69429c7e58e1f8290bb78c9954e5d6110060cff309499f
Instruction ID: a36bc2d4ea973691874a575ae9fec6756563840bf1ab3e4af5dd9e4c30c1c9bd
Opcode Fuzzy Hash: ce07e42ca5370d084e69429c7e58e1f8290bb78c9954e5d6110060cff309499f
Instruction Fuzzy Hash: E5714D3590921DBBCF15DBE4CC85EAEBBB8AF04720F2142A4E925A7291D7319E04DB90

Function 0091E177 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0091E05E: LoadBitmapW.USER32(?,00000001), ref: 0091E094
Part of subcall function 0091E05E: GetLastError.KERNEL32 ref: 0091E0A0

LoadCursorW.USER32(00000000,00007F00), ref: 0091E1D8
RegisterClassW.USER32(?), ref: 0091E1EC
GetLastError.KERNEL32 ref: 0091E1F7
UnregisterClassW.USER32(WixBurnSplashScreen,?), ref: 0091E2FC
DeleteObject.GDI32(00000000), ref: 0091E30B

Strings

splashscreen.cpp, xrefs: 0091E21B, 0091E284
Unexpected return value from message pump., xrefs: 0091E2E6
WixBurnSplashScreen, xrefs: 0091E1E5, 0091E2F7
Failed to load splash screen., xrefs: 0091E1B0
Failed to create window., xrefs: 0091E28E
Failed to register window., xrefs: 0091E225

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ClassErrorLastLoad$BitmapCursorDeleteObjectRegisterUnregister
String ID: Failed to create window.$Failed to load splash screen.$Failed to register window.$Unexpected return value from message pump.$WixBurnSplashScreen$splashscreen.cpp
API String ID: 164797020-2188509422
Opcode ID: a4bb4a7dc6818d40522e79bfd6a524e8f6eae588f29e78f75db7a3db6df78d67
Instruction ID: 2f23ae6b7c712981b3242322ea129609462e898c70e7fc48c2bd302c5a2bf125
Opcode Fuzzy Hash: a4bb4a7dc6818d40522e79bfd6a524e8f6eae588f29e78f75db7a3db6df78d67
Instruction Fuzzy Hash: 0641BA76A04219FFEB109BE5DC49EEAB7ADFF08300F100525FE15E60A0E7309D449BA1

Function 00929BB3 Relevance: 30.0, APIs: 4, Strings: 13, Instructions: 230threadCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000001,?,00000000,000000FF,00000001,00000000,00000000,?,0092BA53,00000001), ref: 00929C18
GetLastError.KERNEL32(?,0092BA53,00000001), ref: 00929D88
GetExitCodeThread.KERNEL32(00000001,00000000,?,0092BA53,00000001), ref: 00929DC8
GetLastError.KERNEL32(?,0092BA53,00000001), ref: 00929DD2

Strings

apply.cpp, xrefs: 00929DAC, 00929DF6
Failed to execute package provider registration action., xrefs: 00929CE9
Failed to wait for cache check-point., xrefs: 00929DB9
Failed to execute dependency action., xrefs: 00929D08
Failed to execute EXE package., xrefs: 00929C4F
Failed to execute compatible package action., xrefs: 00929D45
Failed to get cache thread exit code., xrefs: 00929E03
Cache thread exited unexpectedly., xrefs: 00929E14
Invalid execute action., xrefs: 00929E23
Failed to execute MSP package., xrefs: 00929C9D
Failed to load compatible package on per-machine package., xrefs: 00929D2E
Failed to execute MSU package., xrefs: 00929CCD
Failed to execute MSI package., xrefs: 00929C78

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorLast$CodeExitMultipleObjectsThreadWait
String ID: Cache thread exited unexpectedly.$Failed to execute EXE package.$Failed to execute MSI package.$Failed to execute MSP package.$Failed to execute MSU package.$Failed to execute compatible package action.$Failed to execute dependency action.$Failed to execute package provider registration action.$Failed to get cache thread exit code.$Failed to load compatible package on per-machine package.$Failed to wait for cache check-point.$Invalid execute action.$apply.cpp
API String ID: 3703294532-2662572847
Opcode ID: e2c7c5cd7caa7f75ec552efed8deabee4c35eebd0198ceaad62fdb981caf5b26
Instruction ID: 54a339017b7755faf99ae93a1b8ebd7764caac308d79b46b47265475d03450e0
Opcode Fuzzy Hash: e2c7c5cd7caa7f75ec552efed8deabee4c35eebd0198ceaad62fdb981caf5b26
Instruction Fuzzy Hash: 16719C71A01229EFDB14DF65D941EBEB7F8EB48710F11456AFC09F7284D274AE009BA0

Function 0092CA34 Relevance: 29.9, APIs: 7, Strings: 10, Instructions: 173processCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(74DE8FB0,00000002,00000000), ref: 0092CA40

Part of subcall function 00914B96: UuidCreate.RPCRT4(?), ref: 00914BC9

CreateProcessW.KERNEL32(?,?,00000000,00000000,00000001,08000000,00000000,00000000,?,009221A5,?,?,00000000,?,?,?), ref: 0092CB1E
GetLastError.KERNEL32(?,?,00000000,?,?,?,?), ref: 0092CB28
GetProcessId.KERNEL32(009221A5,?,?,00000000,?,?,?,?), ref: 0092CB60

Part of subcall function 009152E3: lstrlenW.KERNEL32(?,?,00000000,?,0094B4F0,?,00000000,?,0090442A,?,0094B4F0), ref: 00915304
Part of subcall function 009152E3: GetCurrentProcessId.KERNEL32(?,0090442A,?,0094B4F0), ref: 0091530F
Part of subcall function 009152E3: SetNamedPipeHandleState.KERNEL32(?,000000FF,00000000,00000000,?,0090442A,?,0094B4F0), ref: 00915346
Part of subcall function 009152E3: ConnectNamedPipe.KERNEL32(?,00000000,?,0090442A,?,0094B4F0), ref: 0091535B
Part of subcall function 009152E3: GetLastError.KERNEL32(?,0090442A,?,0094B4F0), ref: 00915365
Part of subcall function 009152E3: Sleep.KERNEL32(00000064,?,0090442A,?,0094B4F0), ref: 00915396
Part of subcall function 009152E3: SetNamedPipeHandleState.KERNEL32(?,00000000,00000000,00000000,?,0090442A,?,0094B4F0), ref: 009153B9
Part of subcall function 009152E3: WriteFile.KERNEL32(?,crypt32.dll,00000004,00000000,00000000,?,0090442A,?,0094B4F0), ref: 009153D4
Part of subcall function 009152E3: WriteFile.KERNEL32(?,0090442A,0094B4F0,00000000,00000000,?,0090442A,?,0094B4F0), ref: 009153EF
Part of subcall function 009152E3: WriteFile.KERNEL32(?,?,00000004,00000000,00000000,?,0090442A,?,0094B4F0), ref: 0091540A

Part of subcall function 00940917: WaitForSingleObject.KERNEL32(000000FF,?,00000000,?,?,00904E16,?,000000FF,?,?,?,?,?,00000000,?,?), ref: 00940927
Part of subcall function 00940917: GetLastError.KERNEL32(?,?,00904E16,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?), ref: 00940935

CloseHandle.KERNEL32(00000000,?,000000FF,00000000,?,0092C992,?,?,?,?,?,00000000,?,?,?,?), ref: 0092CBE4
CloseHandle.KERNEL32(00000000,?,000000FF,00000000,?,0092C992,?,?,?,?,?,00000000,?,?,?,?), ref: 0092CBF3
CloseHandle.KERNEL32(00000000,?,?,000000FF,00000000,?,0092C992,?,?,?,?,?,00000000,?,?,?), ref: 0092CC0A

Strings

%ls -%ls %ls %ls %u, xrefs: 0092CAE3
Failed to wait for embedded process to connect to pipe., xrefs: 0092CB82
Failed to process messages from embedded message., xrefs: 0092CBA7
Failed to create embedded process at path: %ls, xrefs: 0092CB56
Failed to allocate embedded command., xrefs: 0092CAF7
burn.embedded, xrefs: 0092CADB
Failed to create embedded pipe name and client token., xrefs: 0092CAA3
Failed to create embedded pipe., xrefs: 0092CACA
embedded.cpp, xrefs: 0092CB49
Failed to wait for embedded executable: %ls, xrefs: 0092CBC7

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Handle$Process$CloseErrorFileLastNamedPipeWrite$CreateCurrentState$ConnectObjectSingleSleepUuidWaitlstrlen
String ID: %ls -%ls %ls %ls %u$Failed to allocate embedded command.$Failed to create embedded pipe name and client token.$Failed to create embedded pipe.$Failed to create embedded process at path: %ls$Failed to process messages from embedded message.$Failed to wait for embedded executable: %ls$Failed to wait for embedded process to connect to pipe.$burn.embedded$embedded.cpp
API String ID: 875070380-3803182736
Opcode ID: 20e64f235e937049a86d6ab2c049f72ee3081b430b6be0de77d8302a25110e1c
Instruction ID: 73f4a28bdfc9ef9faf8790fc3f3838024fb5218fc4e547969c2570bfd4bb173d
Opcode Fuzzy Hash: 20e64f235e937049a86d6ab2c049f72ee3081b430b6be0de77d8302a25110e1c
Instruction Fuzzy Hash: 46515C72E4422DBBDF11EBA4DC42FDEBBB8AF48711F100121FA04B6290D7759A41DB90

Function 00947E36 Relevance: 29.9, APIs: 8, Strings: 9, Instructions: 153stringCOMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,msi.dll,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000000,00000000,00000000,?,00948320,00000001,?), ref: 00947E56
CompareStringW.KERNEL32(0000007F,00000000,digest,000000FF,002E0069,000000FF,?,00948320,00000001,?), ref: 00947E71
CompareStringW.KERNEL32(0000007F,00000000,name,000000FF,002E0069,000000FF,?,00948320,00000001,?), ref: 00947E8C
CompareStringW.KERNEL32(0000007F,00000000,algorithm,000000FF,?,000000FF,?,00948320,00000001,?), ref: 00947EF8
CompareStringW.KERNEL32(0000007F,00000001,md5,000000FF,?,000000FF,?,00948320,00000001,?), ref: 00947F1C
CompareStringW.KERNEL32(0000007F,00000001,sha1,000000FF,?,000000FF,?,00948320,00000001,?), ref: 00947F40
CompareStringW.KERNEL32(0000007F,00000001,sha256,000000FF,?,000000FF,?,00948320,00000001,?), ref: 00947F60
lstrlenW.KERNEL32(006C0064,?,00948320,00000001,?), ref: 00947F7B

Strings

name, xrefs: 00947E83
md5, xrefs: 00947F13
sha1, xrefs: 00947F37
apuputil.cpp, xrefs: 00947F93
msi.dll, xrefs: 00947E50
algorithm, xrefs: 00947EEF
sha256, xrefs: 00947F57
digest, xrefs: 00947E68
http://appsyndication.org/2006/appsyn, xrefs: 00947E49

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CompareString$lstrlen
String ID: algorithm$apuputil.cpp$digest$http://appsyndication.org/2006/appsyn$md5$msi.dll$name$sha1$sha256
API String ID: 1657112622-2492263259
Opcode ID: 738437fb881367779b31fb8c3f028b264a1adac9f06a3ff2002fca3d291a7330
Instruction ID: 18494dbba231c50dc8e2b600890a8361804ff0320782a265cf541ca023f36297
Opcode Fuzzy Hash: 738437fb881367779b31fb8c3f028b264a1adac9f06a3ff2002fca3d291a7330
Instruction Fuzzy Hash: DB51D13165C216BBDB204F94CC46F26BB65AB05734F204794FA34BE2E5C7A0EC80D790

Function 00909F2B Relevance: 28.2, APIs: 1, Strings: 15, Instructions: 216COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00909FA3

Strings

Unsupported product search type: %u, xrefs: 00909F6B
MsiProductSearch failed: ID '%ls', HRESULT 0x%x, xrefs: 0090A141
VersionString, xrefs: 00909F93, 0090A01E, 0090A034, 0090A048, 0090A061, 0090A075
Trying per-user extended info for property '%ls' for product: %ls, xrefs: 0090A062
Failed to get product info., xrefs: 0090A0D5
AssignmentType, xrefs: 00909F7E
Failed to copy upgrade code., xrefs: 0090A003
Failed to format GUID string., xrefs: 00909FAE
Failed to change value type., xrefs: 0090A10F
State, xrefs: 00909F85
Product or related product not found: %ls, xrefs: 0090A08E
Language, xrefs: 00909F8C
Trying per-machine extended info for property '%ls' for product: %ls, xrefs: 0090A035
Failed to set variable., xrefs: 0090A12E
Failed to enumerate related products for upgrade code., xrefs: 00909FDE

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Open@16
String ID: AssignmentType$Failed to change value type.$Failed to copy upgrade code.$Failed to enumerate related products for upgrade code.$Failed to format GUID string.$Failed to get product info.$Failed to set variable.$Language$MsiProductSearch failed: ID '%ls', HRESULT 0x%x$Product or related product not found: %ls$State$Trying per-machine extended info for property '%ls' for product: %ls$Trying per-user extended info for property '%ls' for product: %ls$Unsupported product search type: %u$VersionString
API String ID: 3613110473-2134270738
Opcode ID: e79551b5ef447d91dcca3dd477a5a73ec8b7ca6e22ef61b7e07d99a947c5d56f
Instruction ID: 083d4ce28307c179fcbc3d230d0493cf2daa21c0a3f5e67d64589d88eb5e2d18
Opcode Fuzzy Hash: e79551b5ef447d91dcca3dd477a5a73ec8b7ca6e22ef61b7e07d99a947c5d56f
Instruction Fuzzy Hash: E061E432D4421DBFCB219EA8C945EEE7BB9EB89714F104265F504BB2D1C236DE4097D2

Function 0092DC0D Relevance: 28.2, APIs: 3, Strings: 13, Instructions: 204stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00929751,75C08550,?,?,00000000,?,?,?,00000001,00000000,?), ref: 0092DC28

Strings

Failed to add file to BITS job., xrefs: 0092DCF5
Failed to set credentials for BITS job., xrefs: 0092DCD6
Failed to download BITS job., xrefs: 0092DDBF
Failed to set callback interface for BITS job., xrefs: 0092DD60
Failed to copy download URL., xrefs: 0092DC6F
Failed while waiting for BITS download., xrefs: 0092DDD9
Failed to complete BITS job., xrefs: 0092DDD2
Failed to create BITS job callback., xrefs: 0092DD3B
Falied to start BITS job., xrefs: 0092DDE0
bitsengine.cpp, xrefs: 0092DC3E, 0092DD31
Invalid BITS engine URL: %ls, xrefs: 0092DC4A
Failed to initialize BITS job callback., xrefs: 0092DD49
Failed to create BITS job., xrefs: 0092DCB7

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: lstrlen
String ID: Failed to add file to BITS job.$Failed to complete BITS job.$Failed to copy download URL.$Failed to create BITS job callback.$Failed to create BITS job.$Failed to download BITS job.$Failed to initialize BITS job callback.$Failed to set callback interface for BITS job.$Failed to set credentials for BITS job.$Failed while waiting for BITS download.$Falied to start BITS job.$Invalid BITS engine URL: %ls$bitsengine.cpp
API String ID: 1659193697-2382896028
Opcode ID: a2db5d2c01f323dcdcb8edbc3a4234397cd183f7c9cf57cfb74e491bdabbdff7
Instruction ID: ef5b906c68fa4a6fa92411fd189fd5039ea23552285bccd7088b87d9f3fddb0d
Opcode Fuzzy Hash: a2db5d2c01f323dcdcb8edbc3a4234397cd183f7c9cf57cfb74e491bdabbdff7
Instruction Fuzzy Hash: 3B61F531A02639EBCB119F94E885E6E7BB8EF88B50F124155FC04AB299D774DD00DB91

Function 0090EBB2 Relevance: 28.2, APIs: 2, Strings: 14, Instructions: 173COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 0090ED40

Part of subcall function 009038D4: GetProcessHeap.KERNEL32(?,000001C7,?,00902284,000001C7,00000001,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 009038E5
Part of subcall function 009038D4: RtlAllocateHeap.NTDLL(00000000,?,00902284,000001C7,00000001,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 009038EC

SysFreeString.OLEAUT32(?), ref: 0090ECF8

Strings

Failed to get @Filename., xrefs: 0090ED9D
registration.cpp, xrefs: 0090EC35
Failed to get @Regid., xrefs: 0090ED93
Failed to get SoftwareTag text., xrefs: 0090ED7F
Path, xrefs: 0090ECA6
Filename, xrefs: 0090EC73
Failed to get software tag count., xrefs: 0090EC07
Regid, xrefs: 0090EC8E
Failed to get @Path., xrefs: 0090ED89
Failed to get next node., xrefs: 0090EDA7
Failed to select software tag nodes., xrefs: 0090EBE2
Failed to convert SoftwareTag text to UTF-8, xrefs: 0090ED75
SoftwareTag, xrefs: 0090EBC1
Failed to allocate memory for software tag structs., xrefs: 0090EC3F

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: FreeHeapString$AllocateProcess
String ID: Failed to allocate memory for software tag structs.$Failed to convert SoftwareTag text to UTF-8$Failed to get @Filename.$Failed to get @Path.$Failed to get @Regid.$Failed to get SoftwareTag text.$Failed to get next node.$Failed to get software tag count.$Failed to select software tag nodes.$Filename$Path$Regid$SoftwareTag$registration.cpp
API String ID: 336948655-1068704183
Opcode ID: 20b0c5c916fb40a078422fce03812fa1aba7deffaebca3da6644a19be9ff9822
Instruction ID: 434b8e1fa713333345e5818624e4cec2098b24a7734644519d955699a3a6bd7e
Opcode Fuzzy Hash: 20b0c5c916fb40a078422fce03812fa1aba7deffaebca3da6644a19be9ff9822
Instruction Fuzzy Hash: DA51AF75A01329BFDB15DF65C891FAEBBA8EF44754F104969F806AB2C0DB70DE009B90

Function 00914933 Relevance: 28.2, APIs: 7, Strings: 9, Instructions: 155sleepfileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?), ref: 0091498D
GetLastError.KERNEL32 ref: 0091499B
Sleep.KERNEL32(00000064), ref: 009149BF

Strings

Failed to allocate name of parent cache pipe., xrefs: 00914A34
\\.\pipe\%ls, xrefs: 00914945
Failed to verify parent pipe: %ls, xrefs: 00914A07
Failed to open parent pipe: %ls, xrefs: 009149E5
Failed to open companion process with PID: %u, xrefs: 00914AE7
Failed to allocate name of parent pipe., xrefs: 00914959
\\.\pipe\%ls.Cache, xrefs: 00914A20
feclient.dll, xrefs: 009149F2, 00914A8D, 00914AA1, 00914AE5
pipe.cpp, xrefs: 009149D8, 00914ADB

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CreateErrorFileLastSleep
String ID: Failed to allocate name of parent cache pipe.$Failed to allocate name of parent pipe.$Failed to open companion process with PID: %u$Failed to open parent pipe: %ls$Failed to verify parent pipe: %ls$\\.\pipe\%ls$\\.\pipe\%ls.Cache$feclient.dll$pipe.cpp
API String ID: 408151869-3212458075
Opcode ID: f11e4d93736f2e903dfde4d865865d9f08d01469e7383fac4c68a95af420bd6d
Instruction ID: 0cd654e05c035629dca2eb0f1b501c0d3a01643a30d79e838cc0294661143cbc
Opcode Fuzzy Hash: f11e4d93736f2e903dfde4d865865d9f08d01469e7383fac4c68a95af420bd6d
Instruction Fuzzy Hash: 3F414836F80329BBEB219AA48C02F9B76A8EF08B65F114221FD14F61D0D7749E90D7D4

Function 0090F410 Relevance: 28.2, APIs: 1, Strings: 15, Instructions: 152registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000000,00910348,InstallerVersion,InstallerVersion,00000000,00910348,InstallerName,InstallerName,00000000,00910348,Date,InstalledDate,00000000,00910348,LogonUser), ref: 0090F5BE

Part of subcall function 00941392: RegSetValueExW.ADVAPI32(00020006,00020006,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,0090F1C2,00000000,?,00020006), ref: 009413C5

Strings

PackageName, xrefs: 0090F48A, 0090F49D
PublishingGroup, xrefs: 0090F4F2, 0090F505
ReleaseType, xrefs: 0090F515, 0090F51A, 0090F529
InstallerName, xrefs: 0090F56F, 0090F574, 0090F575, 0090F585
Failed to write %ls value., xrefs: 0090F5A7
InstalledDate, xrefs: 0090F54F, 0090F568
Failed to create the key for update registration., xrefs: 0090F45E
InstallerVersion, xrefs: 0090F58C, 0090F591, 0090F592, 0090F5A2
PackageVersion, xrefs: 0090F4AA, 0090F4BD
Date, xrefs: 0090F554
Failed to get the formatted key path for update registration., xrefs: 0090F432
InstalledBy, xrefs: 0090F52F, 0090F548
LogonUser, xrefs: 0090F534
Publisher, xrefs: 0090F4CA, 0090F4DD
ThisVersionInstalled, xrefs: 0090F46A, 0090F47D

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CloseValue
String ID: Date$Failed to create the key for update registration.$Failed to get the formatted key path for update registration.$Failed to write %ls value.$InstalledBy$InstalledDate$InstallerName$InstallerVersion$LogonUser$PackageName$PackageVersion$Publisher$PublishingGroup$ReleaseType$ThisVersionInstalled
API String ID: 3132538880-2703781546
Opcode ID: c399e73e061f79764faacf200ed836a2296613fc0971e591b1fea58e2cbb33ba
Instruction ID: a7bb992394155f05bc4d51a20712cc30b33e7e78bd47d528926b289418cd3bbe
Opcode Fuzzy Hash: c399e73e061f79764faacf200ed836a2296613fc0971e591b1fea58e2cbb33ba
Instruction Fuzzy Hash: 3D41C532A46629BFCB329B61CC12F7E7A65EB81B19F104570FC00B66D1D7709F14A780

Function 0091E563 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 135registryCOMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,?), ref: 0091E5AE
RegisterClassW.USER32(?), ref: 0091E5DA
GetLastError.KERNEL32 ref: 0091E5E5
CreateWindowExW.USER32(00000080,00959CC4,00000000,90000000,80000000,00000008,00000000,00000000,00000000,00000000,?,?), ref: 0091E64C
GetLastError.KERNEL32 ref: 0091E656
UnregisterClassW.USER32(WixBurnMessageWindow,?), ref: 0091E6F4

Strings

Unexpected return value from message pump., xrefs: 0091E6DF
uithread.cpp, xrefs: 0091E609, 0091E67A
WixBurnMessageWindow, xrefs: 0091E5D3, 0091E6EF
Failed to create window., xrefs: 0091E684
Failed to register window., xrefs: 0091E613

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ClassErrorLast$CreateRegisterUnregisterValueWindow
String ID: Failed to create window.$Failed to register window.$Unexpected return value from message pump.$WixBurnMessageWindow$uithread.cpp
API String ID: 213125376-288575659
Opcode ID: ae72ae60ea3dbf30da7899b018c88396d7b8e083273a70e39add3364ff6ae456
Instruction ID: cf9be981d9f609c7f33e2ef045ae3c69ac2babd6288d5fbfe39c44a99c8eae79
Opcode Fuzzy Hash: ae72ae60ea3dbf30da7899b018c88396d7b8e083273a70e39add3364ff6ae456
Instruction Fuzzy Hash: 5741AE76A04218EBEB20DFA5DC44EDABFE8FF19790F104126FD09E6190E7319940DBA1

Function 0092C517 Relevance: 26.5, APIs: 1, Strings: 14, Instructions: 272COMMON

Download Yara Rule

Strings

Failed to allocate memory for pseudo bundle payload hash., xrefs: 0092C750
Failed to allocate space for burn package payload inside of passthrough bundle., xrefs: 0092C557
Failed to copy key for passthrough pseudo bundle payload., xrefs: 0092C768
Failed to allocate space for burn payload inside of related bundle struct, xrefs: 0092C78A
Failed to copy key for passthrough pseudo bundle., xrefs: 0092C72B
Failed to copy install arguments for passthrough bundle package, xrefs: 0092C805
Failed to copy uninstall arguments for passthrough bundle package, xrefs: 0092C84F
Failed to recreate command-line arguments., xrefs: 0092C7E6
pseudobundle.cpp, xrefs: 0092C54B, 0092C744, 0092C77E
Failed to copy download source for passthrough pseudo bundle., xrefs: 0092C732
Failed to copy filename for passthrough pseudo bundle., xrefs: 0092C761
Failed to copy cache id for passthrough pseudo bundle., xrefs: 0092C7A8
Failed to copy local source path for passthrough pseudo bundle., xrefs: 0092C75A
Failed to copy related arguments for passthrough bundle package, xrefs: 0092C825

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID: Failed to allocate memory for pseudo bundle payload hash.$Failed to allocate space for burn package payload inside of passthrough bundle.$Failed to allocate space for burn payload inside of related bundle struct$Failed to copy cache id for passthrough pseudo bundle.$Failed to copy download source for passthrough pseudo bundle.$Failed to copy filename for passthrough pseudo bundle.$Failed to copy install arguments for passthrough bundle package$Failed to copy key for passthrough pseudo bundle payload.$Failed to copy key for passthrough pseudo bundle.$Failed to copy local source path for passthrough pseudo bundle.$Failed to copy related arguments for passthrough bundle package$Failed to copy uninstall arguments for passthrough bundle package$Failed to recreate command-line arguments.$pseudobundle.cpp
API String ID: 1357844191-115096447
Opcode ID: 79976dddeddac9428f8b075b52f25dca4fb783e23111a7974ade8eddb9a1858c
Instruction ID: 03e0bd1827385a1e9efb85f1601238919d9b45528a3ab6fa95605e6fdb482723
Opcode Fuzzy Hash: 79976dddeddac9428f8b075b52f25dca4fb783e23111a7974ade8eddb9a1858c
Instruction Fuzzy Hash: F1B16CB5A00626EFDB11DF29D881F5ABBA5BF48710F118169FD14AB365C731E810DF90

Function 0090BB30 Relevance: 26.4, APIs: 6, Strings: 9, Instructions: 189processCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 0090BB82
CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,00000200,00000000,?,00000044,?,?,?,?,?), ref: 0090BC8F
GetLastError.KERNEL32(?,?,?,?), ref: 0090BC99
WaitForInputIdle.USER32(?,?), ref: 0090BCED
CloseHandle.KERNEL32(?,?,?), ref: 0090BD38
CloseHandle.KERNEL32(?,?,?), ref: 0090BD45

Strings

"%ls" %s, xrefs: 0090BBA8, 0090BBE9
Failed to format argument string., xrefs: 0090BB8D
approvedexe.cpp, xrefs: 0090BCBD
Failed to CreateProcess on path: %ls, xrefs: 0090BCCA
Failed to format obfuscated argument string., xrefs: 0090BBD9
Failed to create obfuscated executable command., xrefs: 0090BC2D
D, xrefs: 0090BC6E
Failed to create executable command., xrefs: 0090BBBC
"%ls", xrefs: 0090BBFF, 0090BC19

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CloseHandle$CreateErrorIdleInputLastOpen@16ProcessWait
String ID: "%ls"$"%ls" %s$D$Failed to CreateProcess on path: %ls$Failed to create executable command.$Failed to create obfuscated executable command.$Failed to format argument string.$Failed to format obfuscated argument string.$approvedexe.cpp
API String ID: 155678114-2737401750
Opcode ID: 6862245463c9424673e94b12fc9e300d9be83f652c4f28594ac1819fa76b5123
Instruction ID: fc79cbdce6f6ea38356af62b7e62c4da57a7d7227398878be1aacbb2c4b77c16
Opcode Fuzzy Hash: 6862245463c9424673e94b12fc9e300d9be83f652c4f28594ac1819fa76b5123
Instruction Fuzzy Hash: 41514B72D0062ABFDF11AFA4CC42EAEBBB9FF44344B104569FA04B61A1D7319E509B91

Function 0092678F Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 150serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,?,?,00000000,?,?,?,?,?,?,?,?,00926CE1,?), ref: 009267C8
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00926CE1,?,?,?), ref: 009267D5
OpenServiceW.ADVAPI32(00000000,wuauserv,00000027,?,?,?,?,?,?,?,?,00926CE1,?,?,?), ref: 0092681D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00926CE1,?,?,?), ref: 00926829
QueryServiceStatus.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,00926CE1,?,?,?), ref: 00926863
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00926CE1,?,?,?), ref: 0092686D
CloseServiceHandle.ADVAPI32(00000000), ref: 00926924
CloseServiceHandle.ADVAPI32(?), ref: 0092692E

Strings

Failed to open service control manager., xrefs: 00926803
wuauserv, xrefs: 00926817
Failed to mark WU service to start on demand., xrefs: 009268F5
Failed to query status of WU service., xrefs: 0092689B
Failed to open WU service., xrefs: 00926857
msuengine.cpp, xrefs: 009267F9, 0092684D, 00926891
Failed to read configuration for WU service., xrefs: 009268D4

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Service$ErrorLast$CloseHandleOpen$ManagerQueryStatus
String ID: Failed to mark WU service to start on demand.$Failed to open WU service.$Failed to open service control manager.$Failed to query status of WU service.$Failed to read configuration for WU service.$msuengine.cpp$wuauserv
API String ID: 971853308-301359130
Opcode ID: 6fe6b02e507e9b4648bc1d6cd9f29934bf86847d9e918b7e7291e8f1e750c037
Instruction ID: e0ea82a2631fa0c4d7a94d97f1782f9d8d698f624c9bd220aef871cdfbb1dfb2
Opcode Fuzzy Hash: 6fe6b02e507e9b4648bc1d6cd9f29934bf86847d9e918b7e7291e8f1e750c037
Instruction Fuzzy Hash: E941B176B01324ABEB20DBB99C45AAE77E8EB88751F014429FD05F7694DB34DC4487A0

Function 0090B106 Relevance: 24.6, APIs: 3, Strings: 11, Instructions: 136COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,?,0090B9F7,00000008,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0090B10E
GetLastError.KERNEL32(?,0090B9F7,00000008,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0090B11A
_memcmp.LIBVCRUNTIME ref: 0090B1C2

Strings

Failed to get module handle to process., xrefs: 0090B148
Failed to find valid NT image header in buffer., xrefs: 0090B1A6
Bundle guid didn't match the guid in the PE Header in memory., xrefs: 0090B299
section.cpp, xrefs: 0090B13E, 0090B16F, 0090B19A, 0090B203, 0090B224, 0090B24D, 0090B28D
burn, xrefs: 0090B1E9
Failed to read section info, data to short: %u, xrefs: 0090B212
Failed to read section info, unsupported version: %08x, xrefs: 0090B25C
.wixburn, xrefs: 0090B1BC
.wix, xrefs: 0090B1E1
Failed to find Burn section., xrefs: 0090B230
Failed to find valid DOS image header in buffer., xrefs: 0090B17B

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorHandleLastModule_memcmp
String ID: .wix$.wixburn$Bundle guid didn't match the guid in the PE Header in memory.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get module handle to process.$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$burn$section.cpp
API String ID: 3888311042-926796631
Opcode ID: 8414d75df64e2b19b9cab694a3964fd1f46158e4be6870e24bd83a2d4a61d86d
Instruction ID: 8171b9a42020ac44771e7e85fd8509167b689f7cd5506264480ae1f4c898ea72
Opcode Fuzzy Hash: 8414d75df64e2b19b9cab694a3964fd1f46158e4be6870e24bd83a2d4a61d86d
Instruction Fuzzy Hash: 44415A76788311BFD7205A54DC92F2B2269BFD0B25F258029F9066F5C1D778C901C3E6

Function 00912DDC Relevance: 23.1, APIs: 1, Strings: 12, Instructions: 303COMMON

Download Yara Rule

Strings

Unexpected relation type encountered during plan: %d, xrefs: 009130FE
Failed to copy self to related bundle ancestors., xrefs: 0091312E
UX aborted plan related bundle., xrefs: 00913127
plan.cpp, xrefs: 0091311D
Failed to create dictionary from ancestors array., xrefs: 00912E46
%ls;%ls, xrefs: 00912EDE
crypt32.dll, xrefs: 00912E0E
Failed to copy ancestors and self to related bundle ancestors., xrefs: 00912EF6
Failed to add the package provider key "%ls" to the planned list., xrefs: 00913107
Failed to lookup the bundle ID in the ancestors dictionary., xrefs: 009130F0
feclient.dll, xrefs: 009130BB
Failed to create string array from ancestors., xrefs: 00912E1A

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID:
String ID: %ls;%ls$Failed to add the package provider key "%ls" to the planned list.$Failed to copy ancestors and self to related bundle ancestors.$Failed to copy self to related bundle ancestors.$Failed to create dictionary from ancestors array.$Failed to create string array from ancestors.$Failed to lookup the bundle ID in the ancestors dictionary.$UX aborted plan related bundle.$Unexpected relation type encountered during plan: %d$crypt32.dll$feclient.dll$plan.cpp
API String ID: 0-794096528
Opcode ID: cd0684c80bd1c1c22585688ed7951265ac7830a5f7300f3bd16f3363cef453f0
Instruction ID: 7f77d26207baa662d8b72378ff33d0b8bb0e8eac0495f0c36504ca9ef2c7e24c
Opcode Fuzzy Hash: cd0684c80bd1c1c22585688ed7951265ac7830a5f7300f3bd16f3363cef453f0
Instruction Fuzzy Hash: 5EB1BE31B0461AFFDB15DF65C841AEABBB9FF49310F108569E804AB251D731AAE1CB90

Function 0090A17D Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 138registryCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 0090A1A8
_MREFOpen@16.MSPDB140-MSVCRT ref: 0090A204
RegQueryValueExW.ADVAPI32(000002C0,00000000,00000000,000002C0,00000000,00000000,000002C0,?,00000000,00000000,?,00000000,00000101,000002C0,000002C0,?), ref: 0090A226
RegCloseKey.ADVAPI32(00000000,00000000,00000000,000002C0,00000100,00000000,000002C0), ref: 0090A300

Strings

Registry key not found. Key = '%ls', xrefs: 0090A291
Failed to format key string., xrefs: 0090A1B3
Failed to query registry key value., xrefs: 0090A265
Registry value not found. Key = '%ls', Value = '%ls', xrefs: 0090A275
Failed to set variable., xrefs: 0090A2B8
Failed to open registry key. Key = '%ls', xrefs: 0090A2C2
search.cpp, xrefs: 0090A25B
RegistrySearchExists failed: ID '%ls', HRESULT 0x%x, xrefs: 0090A2D8
Failed to format value string., xrefs: 0090A20F

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Open@16$CloseQueryValue
String ID: Failed to format key string.$Failed to format value string.$Failed to open registry key. Key = '%ls'$Failed to query registry key value.$Failed to set variable.$Registry key not found. Key = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchExists failed: ID '%ls', HRESULT 0x%x$search.cpp
API String ID: 2702208347-46557908
Opcode ID: 1e23568aeb2f52ea154611d945675bc1c1f1c51dbaa5c609a09ae10095eef737
Instruction ID: 834ac5ca0e7e26026e6f47e5c23efe0a195789356b01ac59d71355d80c88973e
Opcode Fuzzy Hash: 1e23568aeb2f52ea154611d945675bc1c1f1c51dbaa5c609a09ae10095eef737
Instruction Fuzzy Hash: C741E432E44318BFDF216AA8CC06FAEBA69EF84710F104165FD14AA2D1D7728E1096D2

Function 009067E5 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 131libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,ntdll,?), ref: 00906835
GetLastError.KERNEL32 ref: 0090683F
GetProcAddress.KERNEL32(?,RtlGetVersion), ref: 00906882
GetLastError.KERNEL32 ref: 0090688C
FreeLibrary.KERNEL32(00000000,00000000,?), ref: 0090699D

Strings

ntdll, xrefs: 0090682F
variable.cpp, xrefs: 00906863, 009068B0
Failed to locate RtlGetVersion., xrefs: 009068BA
Failed to get OS info., xrefs: 009068DD
Failed to set variant value., xrefs: 00906981
RtlGetVersion, xrefs: 00906877
Failed to locate NTDLL., xrefs: 0090686D

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorLast$AddressFreeHandleLibraryModuleProc
String ID: Failed to get OS info.$Failed to locate NTDLL.$Failed to locate RtlGetVersion.$Failed to set variant value.$RtlGetVersion$ntdll$variable.cpp
API String ID: 3057421322-109962352
Opcode ID: ff8aba16535c5077802a0d5a183e156d1b01ae472ad9566a77a1378252027f77
Instruction ID: e63982b3e82264d2218fdabca1244a93032de185bea133f370257a80ea8291e8
Opcode Fuzzy Hash: ff8aba16535c5077802a0d5a183e156d1b01ae472ad9566a77a1378252027f77
Instruction Fuzzy Hash: EE41D476E052389FDB319B25CC45BEAB7F8EB48754F000199F948F61D0D7748E60CA90

Function 009047E9 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 128memorysynchronizationCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32(?,00000001,00000001,00000000,00000000,?,?,?,0090535E,?,?,?,?), ref: 0090481A
GetLastError.KERNEL32(?,?,?,0090535E,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0090482B
ReleaseMutex.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00904968
CloseHandle.KERNEL32(?,?,?,?,0090535E,?,?,?,?,?,?,?,?,?,?,?), ref: 00904971

Strings

comres.dll, xrefs: 009048D7
Failed to connect to unelevated process., xrefs: 00904810
Failed to allocate thread local storage for logging., xrefs: 00904859
Failed to pump messages from parent process., xrefs: 0090493C
Failed to create the message window., xrefs: 009048C6
engine.cpp, xrefs: 0090484F, 00904898
Failed to set elevated pipe into thread local storage for logging., xrefs: 009048A2

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: AllocCloseErrorHandleLastMutexRelease
String ID: Failed to allocate thread local storage for logging.$Failed to connect to unelevated process.$Failed to create the message window.$Failed to pump messages from parent process.$Failed to set elevated pipe into thread local storage for logging.$comres.dll$engine.cpp
API String ID: 687263955-1790235126
Opcode ID: 7435e3f32ab3a052124bd289019aa588133d0a1d5d00484be2836fd5cb8dfc98
Instruction ID: 88b2a16cee3818ea7caa76fd0f1595507a7dc5eac634d541e314a1b16699ff70
Opcode Fuzzy Hash: 7435e3f32ab3a052124bd289019aa588133d0a1d5d00484be2836fd5cb8dfc98
Instruction Fuzzy Hash: B34174B2A40619BFDB119BB5CC45FEBB6ACFF85714F000226FB19E2190DB70A95097E1

Function 009139FD Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 128COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,?,00000000,crypt32.dll), ref: 00913A51
GetLastError.KERNEL32(?,00000000,crypt32.dll), ref: 00913A5B
GetCurrentProcessId.KERNEL32(?,?,?,00000104,?,?,00000000,crypt32.dll), ref: 00913AC4
ProcessIdToSessionId.KERNEL32(00000000,?,00000000,crypt32.dll), ref: 00913ACB

Strings

Failed to copy temp folder., xrefs: 00913B7A
Failed to format session id as a string., xrefs: 00913AF9
Failed to get temp folder., xrefs: 00913A89
Failed to get length of session id string., xrefs: 00913B1D
logging.cpp, xrefs: 00913A7F
crypt32.dll, xrefs: 00913A10
%u\, xrefs: 00913AE5
Failed to get length of temp folder., xrefs: 00913AB5

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Process$CurrentErrorLastPathSessionTemp
String ID: %u\$Failed to copy temp folder.$Failed to format session id as a string.$Failed to get length of session id string.$Failed to get length of temp folder.$Failed to get temp folder.$crypt32.dll$logging.cpp
API String ID: 1726527325-3274134579
Opcode ID: defe13f94e3bf075b8e1551d1eb373b4dc5d60221c098436c5dbaef4ce56046e
Instruction ID: c4dd7aae4e8997e44036547f47a38f3aa6ae247f7286b0532724693ea0ab53e9
Opcode Fuzzy Hash: defe13f94e3bf075b8e1551d1eb373b4dc5d60221c098436c5dbaef4ce56046e
Instruction Fuzzy Hash: 7A41C576E8423DABDB209B649C49FEAB7B8EF54710F104295FD08B7181E6749F848BD0

Function 00907E7C Relevance: 21.2, APIs: 2, Strings: 12, Instructions: 214COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,00000000,?,000000B9,00000002,?,00000000,00000000), ref: 00907E99
LeaveCriticalSection.KERNEL32(?,?,?), ref: 009080C1

Strings

Failed to write literal flag., xrefs: 0090809A
Failed to write variable value type., xrefs: 009080A1
Failed to write variable name., xrefs: 009080A8
Failed to write variable value as string., xrefs: 00908085
Failed to get numeric., xrefs: 00908093
Unsupported variable type., xrefs: 0090807E
Failed to write variable value as number., xrefs: 0090806B
Failed to get version., xrefs: 00908072
Failed to write included flag., xrefs: 009080AF
Failed to write variable count., xrefs: 00907EB4
Failed to get string., xrefs: 0090808C
feclient.dll, xrefs: 00907F74, 00907FCA, 0090800B

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get numeric.$Failed to get string.$Failed to get version.$Failed to write included flag.$Failed to write literal flag.$Failed to write variable count.$Failed to write variable name.$Failed to write variable value as number.$Failed to write variable value as string.$Failed to write variable value type.$Unsupported variable type.$feclient.dll
API String ID: 3168844106-2118673349
Opcode ID: d23468e62f6ceae13333712d2d885bc77058a3ed676f0151cb7d5eb5f96f6d98
Instruction ID: 2273fccdd0e207b58b94f54a816d5b7b2367cc2f91af96ea50dd2b1c70016a5d
Opcode Fuzzy Hash: d23468e62f6ceae13333712d2d885bc77058a3ed676f0151cb7d5eb5f96f6d98
Instruction Fuzzy Hash: 9461D232E0561AEFCB229EA4C850BEFBBB9BF44364F104161FA40671D1CB34DD589B91

Function 009195AC Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000005,00000000,00000003,08000000,00000000,?,00000000,?,0091A63D,?,00000000,?,?,0092B049), ref: 009195C7
GetLastError.KERNEL32(?,0091A63D,?,00000000,?,?,0092B049,?,00000000,?,00000000,?,?,0092B049,?), ref: 009195D7
CloseHandle.KERNEL32(?,0092B049,00000001,00000003,000007D0,?,?,0092B049,?), ref: 009196E4

Strings

%ls payload from working path '%ls' to path '%ls', xrefs: 0091968F
Failed to open payload in working path: %ls, xrefs: 00919606
Failed to verify payload signature: %ls, xrefs: 00919632
Copying, xrefs: 00919679
Failed to copy %ls to %ls, xrefs: 009196D2
cache.cpp, xrefs: 009195FB
Failed to move %ls to %ls, xrefs: 009196BC
Failed to verify payload hash: %ls, xrefs: 0091966F
Moving, xrefs: 00919686, 0091968E

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: %ls payload from working path '%ls' to path '%ls'$Copying$Failed to copy %ls to %ls$Failed to move %ls to %ls$Failed to open payload in working path: %ls$Failed to verify payload hash: %ls$Failed to verify payload signature: %ls$Moving$cache.cpp
API String ID: 2528220319-1604654059
Opcode ID: 674a51a8857051e110e6a8c501c7a31be9bc258186458e089c13a4d49432924a
Instruction ID: 13b5880b185c8b212903f1bdeb75244cd4b34540b2bbbcdbf062ef9f5a9250a6
Opcode Fuzzy Hash: 674a51a8857051e110e6a8c501c7a31be9bc258186458e089c13a4d49432924a
Instruction Fuzzy Hash: 66315671B447287BE7325A269C1AFAB7A6CDFC1F95F010219FD04BB280D6609E4096F1

Function 00913E47 Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 220sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00913955: RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000001,feclient.dll,?,?,?,00913E61,feclient.dll,?,00000000,?,?,?,00904A0C), ref: 009139F1

Sleep.KERNEL32(000007D0,00000001,feclient.dll,?,00000000,?,?,?,00904A0C,?,?,0094B478,?,00000001,00000000,00000000), ref: 00913EF8

Strings

Failed to copy log path to prefix., xrefs: 0091401A
Failed to copy log extension to extension., xrefs: 0091403D
log, xrefs: 00913E9F
msasn1.dll, xrefs: 0091400E, 0091404F
Setup, xrefs: 00913EA5
Failed to open log: %ls, xrefs: 00913F74
crypt32.dll, xrefs: 00913E9E, 00913F03, 00913F0B, 00913F72, 00913FAC, 00913FED, 0091400C, 0091404A, 00914074
Failed to copy full log path to prefix., xrefs: 0091405B
clbcatq.dll, xrefs: 00914031
Failed to get current directory., xrefs: 00913EDA
Failed to get non-session specific TEMP folder., xrefs: 00913FA2
feclient.dll, xrefs: 00913E5B, 00913F08

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CloseSleep
String ID: Failed to copy full log path to prefix.$Failed to copy log extension to extension.$Failed to copy log path to prefix.$Failed to get current directory.$Failed to get non-session specific TEMP folder.$Failed to open log: %ls$Setup$clbcatq.dll$crypt32.dll$feclient.dll$log$msasn1.dll
API String ID: 2834455192-2673269691
Opcode ID: 569986fd7714ac830e2f1aa0fb25c4c143efe38af1d606174fd8b6329f71f44c
Instruction ID: f8400c8b5f4cb85661ef2ebf7c75b4d22743901ec442e101b4e039ebd7cd277d
Opcode Fuzzy Hash: 569986fd7714ac830e2f1aa0fb25c4c143efe38af1d606174fd8b6329f71f44c
Instruction Fuzzy Hash: 2661C071B0021DBFEB229B65C846FAA77BCEF48340B048569F905DB241E771EED08791

Function 00906C5D Relevance: 19.7, APIs: 2, Strings: 11, Instructions: 167COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000001,?,00000000,0090533D,00000000,00000001), ref: 00906C6E

Part of subcall function 009055B6: CompareStringW.KERNELBASE(0000007F,00001000,?,000000FF,version.dll,000000FF,?,00000000,00000007,0090648B,0090648B,?,0090554A,?,?,00000000), ref: 009055F2
Part of subcall function 009055B6: GetLastError.KERNEL32(?,0090554A,?,?,00000000,?,00000000,0090648B,?,00907DDC,?,?,?,?,?), ref: 00905621

LeaveCriticalSection.KERNEL32(00000001,?,00000001), ref: 00906E02

Strings

variable.cpp, xrefs: 00906CF1
Setting hidden variable '%ls', xrefs: 00906D2C
Unsetting variable '%ls', xrefs: 00906DBE
Setting numeric variable '%ls' to value %lld, xrefs: 00906DA3
Failed to find variable value '%ls'., xrefs: 00906C89
Setting variable failed: ID '%ls', HRESULT 0x%x, xrefs: 00906E14
Failed to set value of variable: %ls, xrefs: 00906DEA
Attempt to set built-in variable value: %ls, xrefs: 00906CFC
Failed to insert variable '%ls'., xrefs: 00906CB3
Setting version variable '%ls' to value '%hu.%hu.%hu.%hu', xrefs: 00906D79
Setting string variable '%ls' to value '%ls', xrefs: 00906D96

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CriticalSection$CompareEnterErrorLastLeaveString
String ID: Attempt to set built-in variable value: %ls$Failed to find variable value '%ls'.$Failed to insert variable '%ls'.$Failed to set value of variable: %ls$Setting hidden variable '%ls'$Setting numeric variable '%ls' to value %lld$Setting string variable '%ls' to value '%ls'$Setting variable failed: ID '%ls', HRESULT 0x%x$Setting version variable '%ls' to value '%hu.%hu.%hu.%hu'$Unsetting variable '%ls'$variable.cpp
API String ID: 2716280545-445000439
Opcode ID: ce0aea04e59e420087c7ae0ef7f54c012c6d8d69d28b577829eb2888e35b12d2
Instruction ID: fe0b58bc5c566450ab2a0eac7d5e1f38d1f003a2746f2147711e7bba393b0a8c
Opcode Fuzzy Hash: ce0aea04e59e420087c7ae0ef7f54c012c6d8d69d28b577829eb2888e35b12d2
Instruction Fuzzy Hash: 6451F371B00229AFDB309E14CD8AF6B3AADEBD5714F110529F8895A2C1D374DD70CAE1

Function 00912A60 Relevance: 19.5, APIs: 1, Strings: 10, Instructions: 298COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000001,006C0064,000000FF,002C002B,000000FF,?,00000000,?,wininet.dll,?,crypt32.dll,?,?,?,00000000), ref: 00912ACD

Strings

Failed to add registration action for self dependent., xrefs: 00912D9E
Failed to check for remaining dependents during planning., xrefs: 00912C73
Failed to add dependent bundle provider key to ignore dependents., xrefs: 00912C37
Failed to add self-dependent to ignore dependents., xrefs: 00912B51
Failed to add registration action for dependent related bundle., xrefs: 00912DD5
crypt32.dll, xrefs: 00912B18, 00912C16, 00912D0B, 00912D80
Failed to create the string dictionary., xrefs: 00912B06
Failed to add dependents ignored from command-line., xrefs: 00912B82
Failed to allocate registration action., xrefs: 00912B36
wininet.dll, xrefs: 00912D1E

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CompareString
String ID: Failed to add dependent bundle provider key to ignore dependents.$Failed to add dependents ignored from command-line.$Failed to add registration action for dependent related bundle.$Failed to add registration action for self dependent.$Failed to add self-dependent to ignore dependents.$Failed to allocate registration action.$Failed to check for remaining dependents during planning.$Failed to create the string dictionary.$crypt32.dll$wininet.dll
API String ID: 1825529933-1705955799
Opcode ID: d7fb6624fbee1dd96e20415d7767e3958d7c55d03f64ef8aa8ef085a57a58988
Instruction ID: def105d280155de8515681bb8e392eb6c01d3d8ef99c3761d2b1dcfa02716d9b
Opcode Fuzzy Hash: d7fb6624fbee1dd96e20415d7767e3958d7c55d03f64ef8aa8ef085a57a58988
Instruction Fuzzy Hash: E0B18C70B0062EEFCB25EF54D841BEEBBA9BF45310F008569F904AA291D770D9A1DBD1

Function 009049DF Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 144windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00904B5E
PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00904B6F

Strings

Failed to set layout directory variable to value provided from command-line., xrefs: 00904B00
Failed to check global conditions, xrefs: 00904A43
Failed to query registration., xrefs: 00904AA8
Failed while running , xrefs: 00904B24
WixBundleLayoutDirectory, xrefs: 00904AEF
Failed to set action variables., xrefs: 00904ABE
Failed to create the message window., xrefs: 00904A92
Failed to open log., xrefs: 00904A12
Failed to set registration variables., xrefs: 00904AD8

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: MessagePostWindow
String ID: Failed to check global conditions$Failed to create the message window.$Failed to open log.$Failed to query registration.$Failed to set action variables.$Failed to set layout directory variable to value provided from command-line.$Failed to set registration variables.$Failed while running $WixBundleLayoutDirectory
API String ID: 3618638489-3051724725
Opcode ID: 4dea4c57ff50dfbbfbcd556697b532e7a19179e95e3a571088571708a9e40860
Instruction ID: d255b0dc8ae7035bc28e142cd1c234f14ff173cff762f74b257a0255234e8caa
Opcode Fuzzy Hash: 4dea4c57ff50dfbbfbcd556697b532e7a19179e95e3a571088571708a9e40860
Instruction Fuzzy Hash: 3141C0F1B40A2ABFDB269A64CC45FBBBA6CFF40754F000225BA04A61D0EB60ED5097D0

Function 0091EDFE Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 009038D4: GetProcessHeap.KERNEL32(?,000001C7,?,00902284,000001C7,00000001,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 009038E5
Part of subcall function 009038D4: RtlAllocateHeap.NTDLL(00000000,?,00902284,000001C7,00000001,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 009038EC

EnterCriticalSection.KERNEL32(?,00000014,00000001), ref: 0091EE1B
LeaveCriticalSection.KERNEL32(?), ref: 0091EF48

Strings

EngineForApplication.cpp, xrefs: 0091EF29
Failed to post launch approved exe message., xrefs: 0091EF33
Failed to copy the arguments., xrefs: 0091EEDA
UX requested unknown approved exe with id: %ls, xrefs: 0091EE7B
Failed to copy the id., xrefs: 0091EEAD
Engine is active, cannot change engine state., xrefs: 0091EE36

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CriticalHeapSection$AllocateEnterLeaveProcess
String ID: Engine is active, cannot change engine state.$EngineForApplication.cpp$Failed to copy the arguments.$Failed to copy the id.$Failed to post launch approved exe message.$UX requested unknown approved exe with id: %ls
API String ID: 1367039788-528931743
Opcode ID: bc0e6e9ac6383f89a619e759d44addb181b63b95c946d4f84dfd76befb468be3
Instruction ID: 23ec4e15f290ab4f9e9c5a697eaa8d8514f85ec07304220105bfaab7d69c3048
Opcode Fuzzy Hash: bc0e6e9ac6383f89a619e759d44addb181b63b95c946d4f84dfd76befb468be3
Instruction Fuzzy Hash: AA31D136B54229AFDB11DF25DC45EAB77A8EF84720B058165FD08EB291D730DC80D7A1

Function 00919496 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000005,00000000,00000003,08000000,00000000,?,00000000,?,0091A5CE,?,00000000,?,?,0092B041), ref: 009194B1
GetLastError.KERNEL32(?,0091A5CE,?,00000000,?,?,0092B041,?,00000000,?,00000000,?,?,0092B041,?), ref: 009194BF
CloseHandle.KERNEL32(?,0092B041,00000001,00000003,000007D0,?,?,0092B041,?), ref: 0091959E

Strings

%ls container from working path '%ls' to path '%ls', xrefs: 00919549
Copying, xrefs: 00919533
Failed to copy %ls to %ls, xrefs: 0091958C
cache.cpp, xrefs: 009194E3
Failed to open container in working path: %ls, xrefs: 009194EE
Failed to move %ls to %ls, xrefs: 00919576
Failed to verify container hash: %ls, xrefs: 00919520
Moving, xrefs: 00919540, 00919548

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: %ls container from working path '%ls' to path '%ls'$Copying$Failed to copy %ls to %ls$Failed to move %ls to %ls$Failed to open container in working path: %ls$Failed to verify container hash: %ls$Moving$cache.cpp
API String ID: 2528220319-1187406825
Opcode ID: f9a32cb791614c09780cb739516b6b8ca2cbe940a3b2c056aa2895d553c07b6c
Instruction ID: c42b7ed37ffba60f93b0522dfb2e54070d6b1cd106837d95041b3f6b9f3b60e6
Opcode Fuzzy Hash: f9a32cb791614c09780cb739516b6b8ca2cbe940a3b2c056aa2895d553c07b6c
Instruction Fuzzy Hash: 11217972B847283BE7225A699C46FAB765DDFD5B15F000118FD05BA2C0D6B1DE41D2E0

Function 00906E5A Relevance: 18.2, APIs: 2, Strings: 10, Instructions: 227COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00906E89
LeaveCriticalSection.KERNEL32(?), ref: 00907095

Strings

Failed to read variable value as string., xrefs: 00907062
Unsupported variable type., xrefs: 0090705B
Failed to read variable literal flag., xrefs: 00907070
Failed to set variable., xrefs: 00907069
Failed to read variable included flag., xrefs: 00907085
Failed to read variable name., xrefs: 0090707E
Failed to read variable value as number., xrefs: 0090704F
Failed to read variable value type., xrefs: 00907077
Failed to read variable count., xrefs: 00906EA9
Failed to set variable value., xrefs: 00907048

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to read variable count.$Failed to read variable included flag.$Failed to read variable literal flag.$Failed to read variable name.$Failed to read variable value as number.$Failed to read variable value as string.$Failed to read variable value type.$Failed to set variable value.$Failed to set variable.$Unsupported variable type.
API String ID: 3168844106-528957463
Opcode ID: f1f8b71ca5219f411bdd1865f65957bdfa3656be8380112978693b65124b6629
Instruction ID: 8d4fac7bd589da9a95b7b89aaf608ab76c62bca04d33929940a407e97c573d7a
Opcode Fuzzy Hash: f1f8b71ca5219f411bdd1865f65957bdfa3656be8380112978693b65124b6629
Instruction Fuzzy Hash: 45718172D0521EBFDB21DEA4DC45FAEBBB9EF44720F104222F900A6190D735EE159B90

Function 009443A6 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 247fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000080,00000000,?,?,00000000,?,00000000,?,?,?), ref: 00944425
GetLastError.KERNEL32 ref: 0094443B
GetFileSizeEx.KERNEL32(00000000,?), ref: 00944486
GetLastError.KERNEL32 ref: 00944490
CloseHandle.KERNEL32(?), ref: 00944650

Strings

fileutil.cpp, xrefs: 009443C6, 0094446F, 009444B0, 00944633

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleSize
String ID: fileutil.cpp
API String ID: 3555958901-2967768451
Opcode ID: e06f164e6681d7cf0c683a69328cb3709dade8e34c8f7297475e54aa37146785
Instruction ID: 34aef14b7b4fbe66aec492998dbf88e7cb88ec31a6fb6a7223e15c237deb00df
Opcode Fuzzy Hash: e06f164e6681d7cf0c683a69328cb3709dade8e34c8f7297475e54aa37146785
Instruction Fuzzy Hash: FE71F371A40215EFEF219E698C44F6B76ECEF40764F11462AFD15EB290D778CE008BA4

Function 00914B96 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 122COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 00914BC9
StringFromGUID2.OLE32(?,?,00000027), ref: 00914BF8
UuidCreate.RPCRT4(?), ref: 00914C43
StringFromGUID2.OLE32(?,?,00000027), ref: 00914C6F

Strings

Failed to create pipe guid., xrefs: 00914BD6
Failed to allocate pipe name., xrefs: 00914C38
Failed to allocate pipe secret., xrefs: 00914C98
BurnPipe.%s, xrefs: 00914C24
pipe.cpp, xrefs: 00914C09, 00914C56
Failed to convert pipe guid into string., xrefs: 00914C15

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CreateFromStringUuid
String ID: BurnPipe.%s$Failed to allocate pipe name.$Failed to allocate pipe secret.$Failed to convert pipe guid into string.$Failed to create pipe guid.$pipe.cpp
API String ID: 4041566446-2510341293
Opcode ID: d4c1fd6da0b373e28b69e81286c4c86a7465cdbb3cc94feb42674134a0aee120
Instruction ID: 65b7a2b45b50773cec4c3b712aff5c7e6ecdd92177bc798eb71ad8f5b42fcf2e
Opcode Fuzzy Hash: d4c1fd6da0b373e28b69e81286c4c86a7465cdbb3cc94feb42674134a0aee120
Instruction Fuzzy Hash: EC41C072E4530CABDB10DBE5CD45FDEB7BCAB88715F20412AE905BB240D6749A88CB90

Function 00905F14 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 105timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00905F3F
GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,00000000,00000000), ref: 00905F53
GetLastError.KERNEL32 ref: 00905F65
GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,?,00000000,?,00000000), ref: 00905FB8
GetLastError.KERNEL32 ref: 00905FC2

Strings

variable.cpp, xrefs: 00905F7F, 00905FDC
Failed to get the Date., xrefs: 00905FE6
Failed to allocate the buffer for the Date., xrefs: 00905FA0
Failed to get the required buffer length for the Date., xrefs: 00905F89
Failed to set variant value., xrefs: 00905FFF

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: DateErrorFormatLast$SystemTime
String ID: Failed to allocate the buffer for the Date.$Failed to get the Date.$Failed to get the required buffer length for the Date.$Failed to set variant value.$variable.cpp
API String ID: 2700948981-3682088697
Opcode ID: 9d7a0a88e15300bbc2c4ce9ba29a3107b9dd051155765e68fa1296b837dc69d2
Instruction ID: c952b708f00a8209b2da931ef13a743e58e73f877844d826e4d28a3e5c0c7a86
Opcode Fuzzy Hash: 9d7a0a88e15300bbc2c4ce9ba29a3107b9dd051155765e68fa1296b837dc69d2
Instruction Fuzzy Hash: D131D776A4562AAFDB21AAE5CC45FAF76B8AB44710F014025FB00F61C0DA749D0086A1

Function 0091E82A Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 99threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,?,00905386,?,?), ref: 0091E84A
GetLastError.KERNEL32(?,00905386,?,?), ref: 0091E857
CreateThread.KERNEL32(00000000,00000000,0091E563,?,00000000,00000000), ref: 0091E8B0
GetLastError.KERNEL32(?,00905386,?,?), ref: 0091E8BD
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,00905386,?,?), ref: 0091E8F8
CloseHandle.KERNEL32(00000000,?,00905386,?,?), ref: 0091E917
CloseHandle.KERNEL32(?,?,00905386,?,?), ref: 0091E924

Strings

Failed to create initialization event., xrefs: 0091E882
Failed to create the UI thread., xrefs: 0091E8E8
uithread.cpp, xrefs: 0091E878, 0091E8DE

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
String ID: Failed to create initialization event.$Failed to create the UI thread.$uithread.cpp
API String ID: 2351989216-3599963359
Opcode ID: 67e3fee1a44f075bdb24145dbf5e4c6f20cf9e22dc30216a4470c1459509bcf1
Instruction ID: f7f28e69bcb766426c5e5ebc239e6d17f3878fee1c31a36a68ed474f9a0accc1
Opcode Fuzzy Hash: 67e3fee1a44f075bdb24145dbf5e4c6f20cf9e22dc30216a4470c1459509bcf1
Instruction Fuzzy Hash: 8E314175E00219BFEB10DFA99D84AAFBAECEB48351F114166FD05E3150D6708E009BA1

Function 0091E3F4 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 95threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,00000000,?,?,00905386,?,?), ref: 0091E415
GetLastError.KERNEL32(?,?,00905386,?,?), ref: 0091E422
CreateThread.KERNEL32(00000000,00000000,0091E177,00000000,00000000,00000000), ref: 0091E481
GetLastError.KERNEL32(?,?,00905386,?,?), ref: 0091E48E
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,00905386,?,?), ref: 0091E4C9
CloseHandle.KERNEL32(?,?,?,00905386,?,?), ref: 0091E4DD
CloseHandle.KERNEL32(?,?,?,00905386,?,?), ref: 0091E4EA

Strings

splashscreen.cpp, xrefs: 0091E443, 0091E4AF
Failed to create UI thread., xrefs: 0091E4B9
Failed to create modal event., xrefs: 0091E44D

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
String ID: Failed to create UI thread.$Failed to create modal event.$splashscreen.cpp
API String ID: 2351989216-1977201954
Opcode ID: 44512d55d3373d09be2f697c25eb11694a6c9bb02825bde46de4fdf04d90b364
Instruction ID: 14ec0d01bac5d44ec39e4b929e63caf86a3ed81fa169fd11a5c1a0efcdf74e5a
Opcode Fuzzy Hash: 44512d55d3373d09be2f697c25eb11694a6c9bb02825bde46de4fdf04d90b364
Instruction Fuzzy Hash: FF317E75E00219BEEB109BA99C05EAFBBF8EB85711F10812AFD14E2190D7748A40DBA1

Function 00921224 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 88threadCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,74DF2F60,?,?,009052FD,009052B5,00000000,0090533D), ref: 00921249
GetLastError.KERNEL32 ref: 0092125C
GetExitCodeThread.KERNEL32(0094B478,?), ref: 0092129E
GetLastError.KERNEL32 ref: 009212AC
ResetEvent.KERNEL32(0094B450), ref: 009212E7
GetLastError.KERNEL32 ref: 009212F1

Strings

cabextract.cpp, xrefs: 00921280, 009212D0, 00921315
Failed to wait for operation complete event., xrefs: 0092128D
Failed to reset operation complete event., xrefs: 00921322
Failed to get extraction thread exit code., xrefs: 009212DD

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorLast$CodeEventExitMultipleObjectsResetThreadWait
String ID: Failed to get extraction thread exit code.$Failed to reset operation complete event.$Failed to wait for operation complete event.$cabextract.cpp
API String ID: 2979751695-3400260300
Opcode ID: 85856c44c30e3afffb49f30ef654cea037d36a9922abf41b35c8ec7063686d27
Instruction ID: 1a4d3244c6d23353eb0ec75d7936b2d447d8ba19c0faaa8f28ac92fb16a6a27b
Opcode Fuzzy Hash: 85856c44c30e3afffb49f30ef654cea037d36a9922abf41b35c8ec7063686d27
Instruction Fuzzy Hash: 2621F274700304EFEB18DB3A9D05ABE7BF8EB48311F00412EF946D61A0E774CA00AB55

Function 00921341 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 80synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(685479F6,0090533D,00000000,?,0090C06D,0090533D,009052B5,00000000,?,0091763B,?,00905565,00905371,00905371,00000000,?), ref: 0092135E
GetLastError.KERNEL32(?,0090C06D,0090533D,009052B5,00000000,?,0091763B,?,00905565,00905371,00905371,00000000,?,00905381,FFF9E89D,00905381), ref: 00921368
WaitForSingleObject.KERNEL32(85F08BFF,000000FF,?,0090C06D,0090533D,009052B5,00000000,?,0091763B,?,00905565,00905371,00905371,00000000,?,00905381), ref: 009213A2
GetLastError.KERNEL32(?,0090C06D,0090533D,009052B5,00000000,?,0091763B,?,00905565,00905371,00905371,00000000,?,00905381,FFF9E89D,00905381), ref: 009213AC
CloseHandle.KERNEL32(85F08BFF,00905381,0090533D,00000000,?,0090C06D,0090533D,009052B5,00000000,?,0091763B,?,00905565,00905371,00905371,00000000), ref: 009213F7
CloseHandle.KERNEL32(685479F6,00905381,0090533D,00000000,?,0090C06D,0090533D,009052B5,00000000,?,0091763B,?,00905565,00905371,00905371,00000000), ref: 00921406
CloseHandle.KERNEL32(0094BA60,00905381,0090533D,00000000,?,0090C06D,0090533D,009052B5,00000000,?,0091763B,?,00905565,00905371,00905371,00000000), ref: 00921415

Strings

cabextract.cpp, xrefs: 0092138C, 009213D0
Failed to set begin operation event., xrefs: 00921396
Failed to wait for thread to terminate., xrefs: 009213DA

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CloseHandle$ErrorLast$EventObjectSingleWait
String ID: Failed to set begin operation event.$Failed to wait for thread to terminate.$cabextract.cpp
API String ID: 1206859064-226982402
Opcode ID: 980d8a1766a808a7c3d2a5003278405d3ef4f985f1975bc23c2fccf589ad8aff
Instruction ID: a38fc1561b28f3a9f2eb517442ec482bc0fc35d6f6234c193a3c0d662fd95f71
Opcode Fuzzy Hash: 980d8a1766a808a7c3d2a5003278405d3ef4f985f1975bc23c2fccf589ad8aff
Instruction Fuzzy Hash: 06210536210710DFE730AB26EC44B6776FAFFC8312F01462DE54A918A0D775D454DB25

Function 0090D5C0 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?,009046F8,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,00905386,?,?), ref: 0090D5CD
GetLastError.KERNEL32(?,009046F8,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,00905386,?,?), ref: 0090D5DA
GetProcAddress.KERNEL32(00000000,BootstrapperApplicationCreate), ref: 0090D612
GetLastError.KERNEL32(?,009046F8,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,00905386,?,?), ref: 0090D61E

Strings

BootstrapperApplicationCreate, xrefs: 0090D60C
Failed to get BootstrapperApplicationCreate entry-point, xrefs: 0090D649
Failed to create UX., xrefs: 0090D662
userexperience.cpp, xrefs: 0090D5FB, 0090D63F
Failed to load UX DLL., xrefs: 0090D605
wininet.dll, xrefs: 0090D5F8, 0090D63C, 0090D667

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID: BootstrapperApplicationCreate$Failed to create UX.$Failed to get BootstrapperApplicationCreate entry-point$Failed to load UX DLL.$userexperience.cpp$wininet.dll
API String ID: 1866314245-1140179540
Opcode ID: 4163dbdace374c7d772949a6f410f7767ce9fea145c57cd12dc4abddab342b8d
Instruction ID: cfbeeb73ae9a8674ca3ba2a6f501a3a78b74a62d60297b8a33a0b245b596010d
Opcode Fuzzy Hash: 4163dbdace374c7d772949a6f410f7767ce9fea145c57cd12dc4abddab342b8d
Instruction Fuzzy Hash: 6E112536A55722AFEB205AA89C04F6737D8EF45751F01412AFD09E31D0EB21CC009AE4

Function 009191F7 Relevance: 16.7, APIs: 2, Strings: 9, Instructions: 223COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(000007D0,000007D0,00000000,00000000,?,00000000,00000000,00000003,00000000,00000000), ref: 00919297
GetLastError.KERNEL32(000007D0,000007D0,00000000,00000000,000007D0,00000001), ref: 009192BB

Strings

Could not verify file %ls., xrefs: 00919400
$, xrefs: 00919396
Failed to allocate string., xrefs: 0091932D
cache.cpp, xrefs: 009192DB, 009193F3, 00919444
Failed to encode file hash., xrefs: 0091934A
Could not close verify handle., xrefs: 0091944E
0, xrefs: 00919357
Failed to get file hash., xrefs: 009192E5
Failed to allocate memory, xrefs: 00919268

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorLast
String ID: $$0$Could not close verify handle.$Could not verify file %ls.$Failed to allocate memory$Failed to allocate string.$Failed to encode file hash.$Failed to get file hash.$cache.cpp
API String ID: 1452528299-4263581490
Opcode ID: f47b75436f3a2263c8d8b8a79923ca57b66c7a4d79c640127336df8bd122a687
Instruction ID: 5ae3a01f5ce865e188c4ac9b1a3c18c9628d916fbcc16b145e45caee15cde38b
Opcode Fuzzy Hash: f47b75436f3a2263c8d8b8a79923ca57b66c7a4d79c640127336df8bd122a687
Instruction Fuzzy Hash: 54718271E0022DAEEB10DBE9CC55BEEB7F8AB48310F114126ED15FB291E77499458BA0

Function 0091E31B Relevance: 16.6, APIs: 11, Instructions: 86windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0091E326
DefWindowProcW.USER32(?,00000082,?,?), ref: 0091E364
SetWindowLongW.USER32(?,000000EB,00000000), ref: 0091E371
SetWindowLongW.USER32(?,000000EB,?), ref: 0091E380
DefWindowProcW.USER32(?,?,?,?), ref: 0091E38E
CreateCompatibleDC.GDI32(?), ref: 0091E39A
SelectObject.GDI32(00000000,00000000), ref: 0091E3AB
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0091E3CD
SelectObject.GDI32(00000000,00000000), ref: 0091E3D5
DeleteDC.GDI32(00000000), ref: 0091E3D8
PostQuitMessage.USER32(00000000), ref: 0091E3E6

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Window$Long$ObjectProcSelect$CompatibleCreateDeleteMessagePostQuitStretch
String ID:
API String ID: 409979828-0
Opcode ID: e0de356ba26a176d864ceeea62a6d46bf80c9ab6123778b95ab7f4546ecb3ab1
Instruction ID: 43b2ad2656693ffe90d1efe25823f843717c5d94529d99c1b638fc294ddd11c9
Opcode Fuzzy Hash: e0de356ba26a176d864ceeea62a6d46bf80c9ab6123778b95ab7f4546ecb3ab1
Instruction Fuzzy Hash: 5621B036218108BFCB145FA9DD5CEBB3FA9EF4A321B054518FA2687170D730C811EB60

Function 00919F36 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 220COMMON

Download Yara Rule

Strings

Failed to combine layout source with source., xrefs: 0091A0A0
WixBundleLayoutDirectory, xrefs: 0091A068
Failed to get current process directory., xrefs: 00919FEF
WixBundleOriginalSource, xrefs: 00919FB3
Failed to copy source path., xrefs: 0091A113
Failed to get bundle layout directory property., xrefs: 0091A083
Failed to combine last source with source., xrefs: 0091A00C
WixBundleLastUsedSource, xrefs: 00919F9D

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Find$CloseFileFirstlstrlen
String ID: Failed to combine last source with source.$Failed to combine layout source with source.$Failed to copy source path.$Failed to get bundle layout directory property.$Failed to get current process directory.$WixBundleLastUsedSource$WixBundleLayoutDirectory$WixBundleOriginalSource
API String ID: 2767606509-3003062821
Opcode ID: 5364b84b146817d7b89326cff55eb27853d05b33876e78737d54cc0d564441f2
Instruction ID: 6d5e383d950ad9569d925bba32f795a1a001d20bf8f46787bd81e7906e6006e9
Opcode Fuzzy Hash: 5364b84b146817d7b89326cff55eb27853d05b33876e78737d54cc0d564441f2
Instruction Fuzzy Hash: 81717C71E0521DAFDF12DFA4D841AFEBBB9AF49314F11012AF901B72A1D7359D808B62

Function 00903083 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000000,00000000,00000040,00000000,00000000), ref: 009030C7
GetLastError.KERNEL32 ref: 009030D1
ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00903129
GetLastError.KERNEL32 ref: 00903133
GetFullPathNameW.KERNEL32(00000000,00000040,00000000,00000000,00000000,00000040,00000000,00000000), ref: 009031EC
GetLastError.KERNEL32 ref: 009031F6
GetFullPathNameW.KERNEL32(00000000,00000007,00000000,00000000,00000000,00000007), ref: 0090324D
GetLastError.KERNEL32 ref: 00903257

Strings

pathutil.cpp, xrefs: 009030F5

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorLast$EnvironmentExpandFullNamePathStrings
String ID: pathutil.cpp
API String ID: 1547313835-741606033
Opcode ID: f02a03a86b1e32cfc6fc127e9e438dfe6a25535909a59bd5ec57569b3bceb3b3
Instruction ID: 7252fcca87a00bc131e08a37972be086054c5deada0c56b933644c6a121818d3
Opcode Fuzzy Hash: f02a03a86b1e32cfc6fc127e9e438dfe6a25535909a59bd5ec57569b3bceb3b3
Instruction Fuzzy Hash: 6E61A136E04229AFDF219AB98C49BAE7BECEF48751F018165ED15E7190E734CF009B90

Function 00902DE0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 198sleepfiletimeCOMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001,00000000,00000000), ref: 00902E7A
GetLastError.KERNEL32 ref: 00902E84
GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 00902F1F
CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000001,00000080,00000000), ref: 00902FAD
GetLastError.KERNEL32 ref: 00902FBA
Sleep.KERNEL32(00000064), ref: 00902FCC
CloseHandle.KERNEL32(?), ref: 0090302C

Strings

pathutil.cpp, xrefs: 00902EA8
%ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls, xrefs: 00902F7D

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorLast$CloseCreateFileHandleLocalPathSleepTempTime
String ID: %ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls$pathutil.cpp
API String ID: 3480017824-1101990113
Opcode ID: ba4d17b36905e24ca2e6af0bf381965c02715e386d4713500c94987beb43066d
Instruction ID: 0826f4a95b91d732399b524ae59e60ef800adb375de5b6e702b56269f473b623
Opcode Fuzzy Hash: ba4d17b36905e24ca2e6af0bf381965c02715e386d4713500c94987beb43066d
Instruction Fuzzy Hash: 5E715376941229AFDB309BA4DC48BAAB3FDAB48750F0041A5FA09E71D0D774DE80DF60

Function 00946BF6 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 166COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,label,000000FF,?,?,?,74DEDFD0,?,00947172,?,?), ref: 00946C4C
SysFreeString.OLEAUT32(00000000), ref: 00946CB7
SysFreeString.OLEAUT32(00000000), ref: 00946D2F
SysFreeString.OLEAUT32(00000000), ref: 00946D71

Strings

label, xrefs: 00946C3E
scheme, xrefs: 00946C5F
term, xrefs: 00946C7F

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: String$Free$Compare
String ID: label$scheme$term
API String ID: 1324494773-4117840027
Opcode ID: ddb79798fa18d64a98b81962a89475c78cfba4771fdb28a9e339921263d9e33b
Instruction ID: 8b06a7892852be08483ed6eda6cfc2f46e885e26c9b2c640d888520298989a28
Opcode Fuzzy Hash: ddb79798fa18d64a98b81962a89475c78cfba4771fdb28a9e339921263d9e33b
Instruction Fuzzy Hash: FA516DB5E01219FBCB15CFA4CC94FAEBBB8EF06721F204295E551AB1A0D7319E40DB51

Function 0090CABE Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 144COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,FFFEB88D,000000FF,?,000000FF,00905381,?,009052B5,00000000,00905381,FFF9E89D,00905381,009053B5,0090533D,?), ref: 0090CB15

Strings

Failed to find embedded payload: %ls, xrefs: 0090CB41
Payload was not found in container: %ls, xrefs: 0090CC22
Failed to extract file., xrefs: 0090CBE0
Failed to get next stream., xrefs: 0090CBFC
Failed to get directory portion of local file path, xrefs: 0090CBEE
Failed to ensure directory exists, xrefs: 0090CBE7
Failed to concat file paths., xrefs: 0090CBF5
payload.cpp, xrefs: 0090CC16

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CompareString
String ID: Failed to concat file paths.$Failed to ensure directory exists$Failed to extract file.$Failed to find embedded payload: %ls$Failed to get directory portion of local file path$Failed to get next stream.$Payload was not found in container: %ls$payload.cpp
API String ID: 1825529933-1711239286
Opcode ID: 79ee2f14a7180c94622471f70408a9aa3815f5a179b24e4b3f69cbee0263de49
Instruction ID: e6bf6e6b5870986c2080822513af940051f732c1c6810e460410c478c71a731a
Opcode Fuzzy Hash: 79ee2f14a7180c94622471f70408a9aa3815f5a179b24e4b3f69cbee0263de49
Instruction Fuzzy Hash: 7041C3B1D04229EFDF25DF84CD82E6EB779AF84710F108669E905AB2D1C7709D40EB90

Function 00904690 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 128windowthreadCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(00000000,00000000,00000400,00000400,00000000), ref: 009046B5
GetCurrentThreadId.KERNEL32 ref: 009046BB

Part of subcall function 0091FC51: new.LIBCMT ref: 0091FC58

GetMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00904749

Strings

Failed to create engine for UX., xrefs: 009046D5
Unexpected return value from message pump., xrefs: 0090479F
Failed to start bootstrapper application., xrefs: 00904717
Failed to load UX., xrefs: 009046FE
engine.cpp, xrefs: 00904795
wininet.dll, xrefs: 009046E8

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Message$CurrentPeekThread
String ID: Failed to create engine for UX.$Failed to load UX.$Failed to start bootstrapper application.$Unexpected return value from message pump.$engine.cpp$wininet.dll
API String ID: 673430819-2573580774
Opcode ID: c55c2ff3ba7ef5f2b932dbf78bcccd94e9655e736d52865881f36b35dffaa041
Instruction ID: 2439d9713785fda1db808f7936e9958e884f5ecbe9dd6640d152d1d838e549f2
Opcode Fuzzy Hash: c55c2ff3ba7ef5f2b932dbf78bcccd94e9655e736d52865881f36b35dffaa041
Instruction Fuzzy Hash: 4041B3B1601219BFEB149BA4CC85FBAB7ACEF49314F104529FA05EB1D0EB34ED4497A1

Function 00918CB5 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 127COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000,?,00000001,80000005,?,00000000,00000000,00000000,00000003,000007D0), ref: 00918E01

Strings

Failed to create ACL to secure cache path: %ls, xrefs: 00918DB7
Failed to secure cache path: %ls, xrefs: 00918DE4
Failed to allocate access for Users group to path: %ls, xrefs: 00918D6B
Failed to allocate access for Administrators group to path: %ls, xrefs: 00918D08
cache.cpp, xrefs: 00918DAC
Failed to allocate access for Everyone group to path: %ls, xrefs: 00918D4A
Failed to allocate access for SYSTEM group to path: %ls, xrefs: 00918D29

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: FreeLocal
String ID: Failed to allocate access for Administrators group to path: %ls$Failed to allocate access for Everyone group to path: %ls$Failed to allocate access for SYSTEM group to path: %ls$Failed to allocate access for Users group to path: %ls$Failed to create ACL to secure cache path: %ls$Failed to secure cache path: %ls$cache.cpp
API String ID: 2826327444-4113288589
Opcode ID: ecb3a50a6b44708c77828753d9163bc51dd8e89002d617ff7e0bfaf17805c73c
Instruction ID: 20a4cd5b645adccc81dd06acc0cbfd845ef78d6997865c113f3ac852c99aa5be
Opcode Fuzzy Hash: ecb3a50a6b44708c77828753d9163bc51dd8e89002d617ff7e0bfaf17805c73c
Instruction Fuzzy Hash: B7412871B4132DB7EB319A659D45FEB7A6CEF90B10F014065FD08BA1C1DE609E88E7A0

Function 00929A57 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 125COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,?,?,0092ADE5,?,00000001,00000000), ref: 00929AE1
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,0092ADE5,?,00000001,00000000,00000000,00000000,00000001,00000000), ref: 00929AEB
CopyFileExW.KERNEL32(00000000,00000000,0092993C,00000000,00000020,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000), ref: 00929B39
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,0092ADE5,?,00000001,00000000,00000000,00000000,00000001,00000000), ref: 00929B68

Strings

copy, xrefs: 00929AAF
apply.cpp, xrefs: 00929B0F, 00929B53, 00929B8C
Failed to clear readonly bit on payload destination path: %ls, xrefs: 00929B1A
Failed attempt to copy payload from: '%ls' to: %ls., xrefs: 00929B9A
BA aborted copy of payload from: '%ls' to: %ls., xrefs: 00929B61

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorFileLast$AttributesCopy
String ID: BA aborted copy of payload from: '%ls' to: %ls.$Failed attempt to copy payload from: '%ls' to: %ls.$Failed to clear readonly bit on payload destination path: %ls$apply.cpp$copy
API String ID: 1969131206-836986073
Opcode ID: 7342f93669544a6f245469b98b25a3eccf6cb5e6f2cf5b336e3e008e3ae863a9
Instruction ID: b8d4b2c73c68c49e4d7de1752a78e5642cdc329ed881562f424cb870c942c9cc
Opcode Fuzzy Hash: 7342f93669544a6f245469b98b25a3eccf6cb5e6f2cf5b336e3e008e3ae863a9
Instruction Fuzzy Hash: 06310271B40325BBEB249A66EC81F7BB3ADEF85755F108129BC09E7181E721CE0097E1

Function 0091E05E Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(?,00000001), ref: 0091E094
GetLastError.KERNEL32 ref: 0091E0A0
GetObjectW.GDI32(00000000,00000018,?), ref: 0091E0E7
GetCursorPos.USER32(?), ref: 0091E108
MonitorFromPoint.USER32(?,?,00000002), ref: 0091E11A
GetMonitorInfoW.USER32(00000000,?), ref: 0091E130

Strings

splashscreen.cpp, xrefs: 0091E0C4
(, xrefs: 0091E127
Failed to load splash screen bitmap., xrefs: 0091E0CE

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Monitor$BitmapCursorErrorFromInfoLastLoadObjectPoint
String ID: ($Failed to load splash screen bitmap.$splashscreen.cpp
API String ID: 2342928100-598475503
Opcode ID: 878079c3aac40330e6b97293c79619e77b25bf601bc7972ef13cea1ab49abf87
Instruction ID: fb051024443f1d9f2045577d15b75fe3daf5e830363a4fc9331a14eb95877006
Opcode Fuzzy Hash: 878079c3aac40330e6b97293c79619e77b25bf601bc7972ef13cea1ab49abf87
Instruction Fuzzy Hash: C8315E75A05209AFDB10CFB9D985A9EBBF5EF08701F408129FD04EB284EB70D904CBA0

Function 009064B6 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 93COMMON

Download Yara Rule

APIs

GetSystemWow64DirectoryW.KERNEL32(?,00000104), ref: 009064F7
GetLastError.KERNEL32 ref: 00906505
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00906546
GetLastError.KERNEL32 ref: 00906550

Strings

variable.cpp, xrefs: 00906535, 00906574
Failed to backslash terminate system folder., xrefs: 009065A2
Failed to get 64-bit system folder., xrefs: 0090657E
Failed to set system folder variant value., xrefs: 009065BE
Failed to get 32-bit system folder., xrefs: 0090653F

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: DirectoryErrorLastSystem$Wow64
String ID: Failed to backslash terminate system folder.$Failed to get 32-bit system folder.$Failed to get 64-bit system folder.$Failed to set system folder variant value.$variable.cpp
API String ID: 2634638900-1590374846
Opcode ID: 5e5161a0121568c510f762325320982d58bbdcbc273589664d617bf8fc5d8b86
Instruction ID: 3c3fcbe84b4e08bd6cf03358db673b486778867e26aa0d3da1a9d1f9894eaaf7
Opcode Fuzzy Hash: 5e5161a0121568c510f762325320982d58bbdcbc273589664d617bf8fc5d8b86
Instruction Fuzzy Hash: 1621E6B6A453386EEB20A7659C49FAA32EC9F41760F114169FC08F71C4EB64CE04C6E1

Function 00914ED2 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 84COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,?,?,0094B4F0), ref: 00914EDB
GetProcessId.KERNEL32(000000FF,?,?,open,00000000,00000000,?,000000FF,?,?), ref: 00914F79
CloseHandle.KERNEL32(00000000), ref: 00914F92

Strings

-q -%ls %ls %ls %u, xrefs: 00914F00
Failed to launch elevated child process: %ls, xrefs: 00914F66
Failed to allocate parameters for elevated process., xrefs: 00914F14
burn.elevated, xrefs: 00914EFB
runas, xrefs: 00914F39
open, xrefs: 00914F43, 00914F51

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Process$CloseCurrentHandle
String ID: -q -%ls %ls %ls %u$Failed to allocate parameters for elevated process.$Failed to launch elevated child process: %ls$burn.elevated$open$runas
API String ID: 2815245435-1352204306
Opcode ID: 8e5290faa855e56fbf212251711a3a7b3584511319aa65ffb0cf1e522b1f7a52
Instruction ID: ec70df5e8ea40d5efde35400cbb70c590870dc06a030a9ba12cd6841ba82eb8a
Opcode Fuzzy Hash: 8e5290faa855e56fbf212251711a3a7b3584511319aa65ffb0cf1e522b1f7a52
Instruction Fuzzy Hash: 95217775E0421DBFCF11DFA5C881DEEBBB8EF48359B10816AF914A2350D7319E91AB90

Function 0090671C Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(msi,DllGetVersion), ref: 00906746
GetProcAddress.KERNEL32(00000000), ref: 0090674D
GetLastError.KERNEL32 ref: 00906757

Strings

variable.cpp, xrefs: 0090677B
Failed to get msi.dll version info., xrefs: 0090679F
Failed to set variant value., xrefs: 009067C3
msi, xrefs: 0090673D
Failed to find DllGetVersion entry point in msi.dll., xrefs: 00906785
DllGetVersion, xrefs: 00906738

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: DllGetVersion$Failed to find DllGetVersion entry point in msi.dll.$Failed to get msi.dll version info.$Failed to set variant value.$msi$variable.cpp
API String ID: 4275029093-842451892
Opcode ID: e6cbdf53684f18c02d2b4228303e175915d5450a24553da0d4e7bc7f2d833762
Instruction ID: a7d1cc74b806fa0f46438d027382f7444dea16c79e07e94f06fe5cf3f10c715d
Opcode Fuzzy Hash: e6cbdf53684f18c02d2b4228303e175915d5450a24553da0d4e7bc7f2d833762
Instruction Fuzzy Hash: 3811D3B6A41724AEE720ABB8DC41EBFB7E8DB88B15F000519FD05F7180EA649D0492E1

Function 00901174 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 53libraryloadermemoryCOMMON

Download Yara Rule

APIs

HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,0090111A,cabinet.dll,00000009,?,?,00000000), ref: 00901185
GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,0090111A,cabinet.dll,00000009,?,?,00000000), ref: 00901190
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0090119E
GetLastError.KERNEL32(?,?,?,?,0090111A,cabinet.dll,00000009,?,?,00000000), ref: 009011B9
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 009011C1
GetLastError.KERNEL32(?,?,?,?,0090111A,cabinet.dll,00000009,?,?,00000000), ref: 009011D6

Strings

kernel32, xrefs: 0090118B
SetDllDirectoryW, xrefs: 009011BB
SetDefaultDllDirectories, xrefs: 00901198

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: AddressErrorLastProc$HandleHeapInformationModule
String ID: SetDefaultDllDirectories$SetDllDirectoryW$kernel32
API String ID: 3104334766-1824683568
Opcode ID: 5e207d15f7c6af3879f41cb309ffb07f453d592966660416beebb2a53d8da224
Instruction ID: 09656aece77e2c0add346087b3124989dab6a8bb65058879f47ffe0b21749b96
Opcode Fuzzy Hash: 5e207d15f7c6af3879f41cb309ffb07f453d592966660416beebb2a53d8da224
Instruction Fuzzy Hash: 5501A275618215BFDB246BAA9C49DAFBB6CFF85792B008015FE15D2180DB70DA00DBB1

Function 0091F3E6 Relevance: 15.2, APIs: 2, Strings: 8, Instructions: 155COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0091F3FB
LeaveCriticalSection.KERNEL32(?), ref: 0091F576

Strings

UX did not provide container or payload id., xrefs: 0091F565
Failed to set download password., xrefs: 0091F524
Failed to set download URL., xrefs: 0091F4D5
Failed to set download user., xrefs: 0091F4FE
UX denied while trying to set download URL on embedded payload: %ls, xrefs: 0091F466
Engine is active, cannot change engine state., xrefs: 0091F415
UX requested unknown container with id: %ls, xrefs: 0091F4A0
UX requested unknown payload with id: %ls, xrefs: 0091F450

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Engine is active, cannot change engine state.$Failed to set download URL.$Failed to set download password.$Failed to set download user.$UX denied while trying to set download URL on embedded payload: %ls$UX did not provide container or payload id.$UX requested unknown container with id: %ls$UX requested unknown payload with id: %ls
API String ID: 3168844106-2615595102
Opcode ID: f88c56239abfcd768101af8f1f3cf94de6feca0dbde2d055da1413c280c48cc2
Instruction ID: 07aa3d4a015fcb1e0f6dd5657ca6fd0030e65872eced8a9ee4073da0f6b7b5fe
Opcode Fuzzy Hash: f88c56239abfcd768101af8f1f3cf94de6feca0dbde2d055da1413c280c48cc2
Instruction Fuzzy Hash: 9541D271B0461DABDB119F25C825EBA77A9EF84721F158235F805AB291EB34DD80C790

Function 00945916 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 194filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(000000FF,C0000000,00000004,00000000,00000004,00000080,00000000,00000000,00000000,00000000,00000078,00000000,000000FF,?,00000000,00000000), ref: 00945955
GetLastError.KERNEL32 ref: 00945963
VirtualAlloc.KERNEL32(00000000,00010000,00003000,00000004), ref: 009459A4
GetLastError.KERNEL32 ref: 009459B1
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00945B26
CloseHandle.KERNEL32(?), ref: 00945B35

Strings

GET, xrefs: 00945A58
dlutil.cpp, xrefs: 00945987

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorLastVirtual$AllocCloseCreateFileFreeHandle
String ID: GET$dlutil.cpp
API String ID: 2028584396-3303425918
Opcode ID: fd60580ad9fda50056c0bba6d619cd3dd882d0c6d42f28bb0521d9503daf6970
Instruction ID: be7eab4a35dd211cf56e5adde6248da32aae824ea617c36e0338e3d690b75f06
Opcode Fuzzy Hash: fd60580ad9fda50056c0bba6d619cd3dd882d0c6d42f28bb0521d9503daf6970
Instruction Fuzzy Hash: E4616976A00619ABDF11DFA8CC80FAE7BB9EF48354F124219FE15B7251E770D8409BA0

Function 00910AAE Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 00910E7E: CompareStringW.KERNEL32(00000000,00000000,feclient.dll,000000FF,00000000,000000FF,00000000,00000000,?,?,00910ACD,?,00000000,?,00000000,00000000), ref: 00910EAD

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,00000000,?,00000000,00000001,?,?,00000000,?,00000000), ref: 00910C51
GetLastError.KERNEL32 ref: 00910C5E

Strings

plan.cpp, xrefs: 00910C82
Failed to append package start action., xrefs: 00910AF3
Failed to append cache action., xrefs: 00910BA8
Failed to append payload cache action., xrefs: 00910C08
Failed to create syncpoint event., xrefs: 00910C8C
Failed to append rollback cache action., xrefs: 00910B2D

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CompareCreateErrorEventLastString
String ID: Failed to append cache action.$Failed to append package start action.$Failed to append payload cache action.$Failed to append rollback cache action.$Failed to create syncpoint event.$plan.cpp
API String ID: 801187047-2489563283
Opcode ID: 5dbbe14a04290c6fd110589e3aae6f11affee61b6960b151013ad30511d12ead
Instruction ID: d659d2c539e6b9eaa612f4a0b3d07a51a6bfaf646d5feb32d8a531b22a562a3b
Opcode Fuzzy Hash: 5dbbe14a04290c6fd110589e3aae6f11affee61b6960b151013ad30511d12ead
Instruction Fuzzy Hash: 3C617F75604608EFDB05DF69C880AAAB7F9FFC4314F21845AE8159B211DBB2EEC1DB50

Function 00909DB4 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 147COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00909DDA
_MREFOpen@16.MSPDB140-MSVCRT ref: 00909DFF

Strings

Failed to set variable., xrefs: 00909EE3
Failed to format component id string., xrefs: 00909DE5
Failed to format product code string., xrefs: 00909E0A
Failed to get component path: %d, xrefs: 00909E63
MsiComponentSearch failed: ID '%ls', HRESULT 0x%x, xrefs: 00909EF3

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Open@16
String ID: Failed to format component id string.$Failed to format product code string.$Failed to get component path: %d$Failed to set variable.$MsiComponentSearch failed: ID '%ls', HRESULT 0x%x
API String ID: 3613110473-1671347822
Opcode ID: 9f0483afd895ba0994bf762affb97df0f9f63f7eeaca97a5aae1100cdcbe4bb3
Instruction ID: dc6aa17123c4fa2768dfed1742c5f55977c71cac5c63dacaf833c3f969f3d146
Opcode Fuzzy Hash: 9f0483afd895ba0994bf762affb97df0f9f63f7eeaca97a5aae1100cdcbe4bb3
Instruction Fuzzy Hash: 5C41F472900215BECB25EAA8CC46FBEB66DEF84310F244A26F115E51D3D7309E90D791

Function 00946ACD Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 116COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,74DEDFD0,000000FF,name,000000FF,74DEDFD0,?,74DEDFD0,?,74DEDFD0), ref: 00946B2B
CompareStringW.KERNEL32(0000007F,00000000,000000FF,000000FF,email,000000FF), ref: 00946B48
SysFreeString.OLEAUT32(00000000), ref: 00946B86
SysFreeString.OLEAUT32(00000000), ref: 00946BCD

Strings

name, xrefs: 00946B1D
email, xrefs: 00946B3A
uri, xrefs: 00946B56

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: String$CompareFree
String ID: email$name$uri
API String ID: 3589242889-1168628755
Opcode ID: 9905e24ad00beccdff069e5ed826d56ce0afcfe45df575c0060919cfc30bc838
Instruction ID: a300019adca99a96b218e8b5c9cc119d5ae8e315b2a7b1e9fdef7bff66baa071
Opcode Fuzzy Hash: 9905e24ad00beccdff069e5ed826d56ce0afcfe45df575c0060919cfc30bc838
Instruction Fuzzy Hash: FB416E75A09218BBCB11DBA4CC44FAEB7B8EF45720F2042A5E921EB2D0C730DE04DB91

Function 0091473A Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 115fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,?,00000008,00904740,00000000,?,00000000,00000000,?,00000000,00904740,?,?,00000000,?,00000000), ref: 00914765
GetLastError.KERNEL32 ref: 00914772
ReadFile.KERNEL32(?,00000000,?,?,00000000,?,00000000), ref: 0091481B
GetLastError.KERNEL32 ref: 00914825

Strings

Failed to allocate data for message., xrefs: 009147D9
Failed to read data for message., xrefs: 00914853
Failed to read message from pipe., xrefs: 009147F0
pipe.cpp, xrefs: 009147CF, 009147E6, 00914849

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: Failed to allocate data for message.$Failed to read data for message.$Failed to read message from pipe.$pipe.cpp
API String ID: 1948546556-3912962418
Opcode ID: d23141f42338ce26cdb2c503a5639a6464bf7205716e950b9ed042cd3f8dc00a
Instruction ID: 0a43d86490ef27dd3d75782a6e59b9c7d62633d275ebf9b70a4bdd6dff9804d0
Opcode Fuzzy Hash: d23141f42338ce26cdb2c503a5639a6464bf7205716e950b9ed042cd3f8dc00a
Instruction Fuzzy Hash: F5310376B40229BBEB10DE65CC45BAAB7ACEB49752F10C12AFC04E61C0D774DE808BD0

Function 0090F2DC Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 109stringCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 0090F315

Part of subcall function 00904013: CreateDirectoryW.KERNELBASE(0090533D,009053B5,00000000,00000000,?,00919EE4,00000000,00000000,0090533D,00000000,009052B5,00000000,?,?,0090D4AC,0090533D), ref: 00904021
Part of subcall function 00904013: GetLastError.KERNEL32(?,00919EE4,00000000,00000000,0090533D,00000000,009052B5,00000000,?,?,0090D4AC,0090533D,00000000,00000000), ref: 0090402F

lstrlenA.KERNEL32(0094B4F0,00000000,00000094,00000000,00000094,?,?,00910328,swidtag,00000094,?,0094B508,00910328,00000000,?,00000000), ref: 0090F368

Part of subcall function 00944C67: CreateFileW.KERNEL32(0094B4F0,40000000,00000001,00000000,00000002,00000080,00000000,00910328,00000000,?,0090F37F,?,00000080,0094B4F0,00000000), ref: 00944C7F
Part of subcall function 00944C67: GetLastError.KERNEL32(?,0090F37F,?,00000080,0094B4F0,00000000,?,00910328,?,00000094,?,?,?,?,?,00000000), ref: 00944C8C

Strings

swidtag, xrefs: 0090F328
Failed to format tag folder path., xrefs: 0090F3CE
Failed to allocate regid file path., xrefs: 0090F3C0
Failed to write tag xml to file: %ls, xrefs: 0090F3A6
Failed to create regid folder: %ls, xrefs: 0090F3B0
Failed to allocate regid folder path., xrefs: 0090F3C7

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CreateErrorLast$DirectoryFileOpen@16lstrlen
String ID: Failed to allocate regid file path.$Failed to allocate regid folder path.$Failed to create regid folder: %ls$Failed to format tag folder path.$Failed to write tag xml to file: %ls$swidtag
API String ID: 904508749-1201533908
Opcode ID: 7835f64e9344dd25aa517d26c661117d1a9020932443098294801fed36779ef0
Instruction ID: 0bd8dbb04751e43ee1b7ba06a3502a52f8d395abd543476874116615ab536f55
Opcode Fuzzy Hash: 7835f64e9344dd25aa517d26c661117d1a9020932443098294801fed36779ef0
Instruction Fuzzy Hash: 10318D32D04219BFCB21AB94DC51B9DBBB9EF44760F108176FD00AA6A0E7759F509B90

Function 009151E9 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 90synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0002BF20,?,F0000003,00000000,00000000,?,00000000,00000000,00000000,00905386,00000000,00000000,?,00000000), ref: 00915292
GetLastError.KERNEL32(?,?,?,00904B5B,?,?,00000000,?,?,?,?,?,?,0094B490,?,?), ref: 0091529D

Strings

Failed to write restart to message buffer., xrefs: 00915235
Failed to post terminate message to child process., xrefs: 0091527D
Failed to wait for child process exit., xrefs: 009152CB
Failed to write exit code to message buffer., xrefs: 0091520D
Failed to post terminate message to child process cache thread., xrefs: 00915261
pipe.cpp, xrefs: 009152C1

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: Failed to post terminate message to child process cache thread.$Failed to post terminate message to child process.$Failed to wait for child process exit.$Failed to write exit code to message buffer.$Failed to write restart to message buffer.$pipe.cpp
API String ID: 1211598281-2161881128
Opcode ID: d77cf16d77866bf44686789acf2372de7f7cafcf3a13dfabbfd67ae43a71c2fe
Instruction ID: 876aed4c8df9cf2e4d7526d27c44aa5bdcc1b8604ddee11c7934526bdd4814b7
Opcode Fuzzy Hash: d77cf16d77866bf44686789acf2372de7f7cafcf3a13dfabbfd67ae43a71c2fe
Instruction Fuzzy Hash: 3A21F533A40A2DFBDB129A959C01FDE7BA8EB84325F130615F924B6190D7749D9097E0

Function 00918E92 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 88fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,00000000,00000101,?,00919CFF,00000003,000007D0,00000003,?,000007D0), ref: 00918EAC
GetLastError.KERNEL32(?,00919CFF,00000003,000007D0,00000003,?,000007D0,00000000,000007D0,00000000,00000003,00000000,00000003,000007D0,00000000,-00000004), ref: 00918EB9
CloseHandle.KERNEL32(00000000,?,00919CFF,00000003,000007D0,00000003,?,000007D0,00000000,000007D0,00000000,00000003,00000000,00000003,000007D0,00000000), ref: 00918F80

Strings

Failed to open payload at path: %ls, xrefs: 00918EFC
cache.cpp, xrefs: 00918EEF
Failed to verify signature of payload: %ls, xrefs: 00918F28
Failed to verify catalog signature of payload: %ls, xrefs: 00918F47
Failed to verify hash of payload: %ls, xrefs: 00918F6B

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: Failed to open payload at path: %ls$Failed to verify catalog signature of payload: %ls$Failed to verify hash of payload: %ls$Failed to verify signature of payload: %ls$cache.cpp
API String ID: 2528220319-2757871984
Opcode ID: b58dd516c6a70bb4a8e0e3e4d820690436236494686eb3a50109c4d76af167c9
Instruction ID: bb12236d10e5419143886c197ff956573a65a3b3dd59f6644418ead7cfd933d4
Opcode Fuzzy Hash: b58dd516c6a70bb4a8e0e3e4d820690436236494686eb3a50109c4d76af167c9
Instruction Fuzzy Hash: D921003674462CBAD7222A648C49FDB7B1ABF45761F104210FD10663A0DB359DA2FBD1

Function 009069B8 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00906A03
GetLastError.KERNEL32 ref: 00906A0D
GetVolumePathNameW.KERNEL32(?,?,00000104), ref: 00906A51
GetLastError.KERNEL32 ref: 00906A5B

Strings

variable.cpp, xrefs: 00906A31, 00906A7F
Failed to get volume path name., xrefs: 00906A89
Failed to get windows directory., xrefs: 00906A3B
Failed to set variant value., xrefs: 00906AA5

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorLast$DirectoryNamePathVolumeWindows
String ID: Failed to get volume path name.$Failed to get windows directory.$Failed to set variant value.$variable.cpp
API String ID: 124030351-4026719079
Opcode ID: 42fe675a59d197a402faa6ab67d38b752c48d04098efa3b8586bdaccec98ee3e
Instruction ID: f4aee28e6ef7e798e1711073538c44ead4187bf98bb7090ab27cb923e93ae8d8
Opcode Fuzzy Hash: 42fe675a59d197a402faa6ab67d38b752c48d04098efa3b8586bdaccec98ee3e
Instruction Fuzzy Hash: 5F21C4B6F453286FEB20AA649C45FAB73ECDF85710F01416AFD09F7181E7349E4086A5

Function 00909B3F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 86COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00909B5A
GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,000002C0,00000100), ref: 00909B72
GetLastError.KERNEL32 ref: 00909B81

Strings

Failed get to file attributes. '%ls', xrefs: 00909BC0
Failed to set variable., xrefs: 00909C07
Failed to format variable string., xrefs: 00909B65
search.cpp, xrefs: 00909BB3
File search: %ls, did not find path: %ls, xrefs: 00909BD5

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Failed get to file attributes. '%ls'$Failed to format variable string.$Failed to set variable.$File search: %ls, did not find path: %ls$search.cpp
API String ID: 1811509786-2053429945
Opcode ID: 2ac12b7144abccacb138e2d6908b75fd96b86df9d6b1843a7052e63b5b22f22e
Instruction ID: 1d5e5944285234e46502a0bd41229d5b535b9c9de4d49eff707ef5e223502c16
Opcode Fuzzy Hash: 2ac12b7144abccacb138e2d6908b75fd96b86df9d6b1843a7052e63b5b22f22e
Instruction Fuzzy Hash: 73210832E44228BFEB116AA49D42F6EB7A9EF95320F104315FD04F51D1E7709D50D6D1

Function 0091AB3C Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,?), ref: 0091AB53
GetLastError.KERNEL32 ref: 0091AB5D
CoInitializeEx.OLE32(00000000,00000000), ref: 0091AB9C
CoUninitialize.OLE32(?,0091C4F4,?,?), ref: 0091ABD9

Strings

Failed to set elevated cache pipe into thread local storage for logging., xrefs: 0091AB8B
Failed to initialize COM., xrefs: 0091ABA8
Failed to pump messages in child process., xrefs: 0091ABC7
elevation.cpp, xrefs: 0091AB81

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorInitializeLastUninitializeValue
String ID: Failed to initialize COM.$Failed to pump messages in child process.$Failed to set elevated cache pipe into thread local storage for logging.$elevation.cpp
API String ID: 876858697-113251691
Opcode ID: 09efee25e14d0bf3aa3509a016fcef6cf8e30ce0ec914c19ba38717220b6e012
Instruction ID: a3bd545b14e294e2f6588776c95462968f695c69f087317c69e66da0d1976910
Opcode Fuzzy Hash: 09efee25e14d0bf3aa3509a016fcef6cf8e30ce0ec914c19ba38717220b6e012
Instruction Fuzzy Hash: B1115972B9E238BBA7115B6A9C05EEBBB9CEF45B21B004116FC04F3250EB709C40A7D1

Function 00905BF0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 54registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00940E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,00945699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 00940E52

RegCloseKey.ADVAPI32(00000000,?,00000000,CommonFilesDir,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00020119,00000000), ref: 00905C77

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion, xrefs: 00905C14
Failed to ensure path was backslash terminated., xrefs: 00905C61
CommonFilesDir, xrefs: 00905C03, 00905C33, 00905C42
Failed to read folder path for '%ls'., xrefs: 00905C43
Failed to open Windows folder key., xrefs: 00905C29
ProgramFilesDir, xrefs: 00905BF8
+, xrefs: 00905BFD

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CloseOpen
String ID: +$CommonFilesDir$Failed to ensure path was backslash terminated.$Failed to open Windows folder key.$Failed to read folder path for '%ls'.$ProgramFilesDir$SOFTWARE\Microsoft\Windows\CurrentVersion
API String ID: 47109696-3209209246
Opcode ID: 67de2a5c65ad772324ead00603bf2379f57f29b77b27c06b9057f1e6b325c0c1
Instruction ID: 8a2dfb648af3acca1893e973bc6ce3a043798d1291872e4cc4ced53bbde25c1b
Opcode Fuzzy Hash: 67de2a5c65ad772324ead00603bf2379f57f29b77b27c06b9057f1e6b325c0c1
Instruction Fuzzy Hash: 88016836A0573CBBDB226A50DD02F8F77A8DFD0B64F110169FC00B6280D670CE00A6C0

Function 0092A024 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 172COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(?,00000000,?,00000000,?,?,?,00000001,00000000,?), ref: 0092A0F1
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 0092A0FB

Strings

apply.cpp, xrefs: 0092A11F
Failed to clear readonly bit on payload destination path: %ls, xrefs: 0092A12A
download, xrefs: 0092A0BB
Failed attempt to download URL: '%ls' to: '%ls', xrefs: 0092A1D8
:, xrefs: 0092A174

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: :$Failed attempt to download URL: '%ls' to: '%ls'$Failed to clear readonly bit on payload destination path: %ls$apply.cpp$download
API String ID: 1799206407-1905830404
Opcode ID: 04b1bdab3dc8ba7a9301f2dba51e3a11e68ad59f5877c04e2f98484ac707ab77
Instruction ID: 2f13add21f832958560c32473d8ce46205661ab74d90a769d3915715084b7252
Opcode Fuzzy Hash: 04b1bdab3dc8ba7a9301f2dba51e3a11e68ad59f5877c04e2f98484ac707ab77
Instruction Fuzzy Hash: 7651A172A00225EFDB11DFA9D840FAAB7B9FF45710F108459E804EB255E335DE40CB92

Function 00946DA8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 159COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,74DEDFD0,000000FF,type,000000FF,?,74DEDFD0,74DEDFD0,74DEDFD0), ref: 00946DFE
SysFreeString.OLEAUT32(00000000), ref: 00946E49
SysFreeString.OLEAUT32(00000000), ref: 00946EC5
SysFreeString.OLEAUT32(00000000), ref: 00946F11

Strings

type, xrefs: 00946DF0
url, xrefs: 00946E11

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: String$Free$Compare
String ID: type$url
API String ID: 1324494773-1247773906
Opcode ID: ecb3030524084ad84b2d61dd549940f0a255403bb955d560dcc8744451309676
Instruction ID: 2b827888a32692a93b8ca2d81d011d6bec96a400c38ae954a9d7646d2f833f99
Opcode Fuzzy Hash: ecb3030524084ad84b2d61dd549940f0a255403bb955d560dcc8744451309676
Instruction Fuzzy Hash: 485168B6901219FBCF15CFA4C844EAEBBB8AF05725F1042A9E811EB2A0D7319E54DB51

Function 0094837F Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 156COMMON

Download Yara Rule

APIs

Part of subcall function 009038D4: GetProcessHeap.KERNEL32(?,000001C7,?,00902284,000001C7,00000001,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 009038E5
Part of subcall function 009038D4: RtlAllocateHeap.NTDLL(00000000,?,00902284,000001C7,00000001,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 009038EC

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000010,00000001,00000000,00000000,00000000,?,?,00928E1F,000002C0,00000100), ref: 009483AD
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,application,000000FF,?,?,00928E1F,000002C0,00000100,000002C0,000002C0,00000100,000002C0,00000410), ref: 009483C8

Strings

type, xrefs: 009483EF
apuputil.cpp, xrefs: 00948463
application, xrefs: 009483BA
http://appsyndication.org/2006/appsyn, xrefs: 009483A0

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CompareHeapString$AllocateProcess
String ID: application$apuputil.cpp$http://appsyndication.org/2006/appsyn$type
API String ID: 2664528157-4206478990
Opcode ID: 385f395c7081b7adfd7503d7f63bdc2b7ed01e05bf0e601b6d5d2cb86ae5d547
Instruction ID: 06fbff155a04862b451f816af6960e6066b85a7829db6b5d4bf7b5969095ea1f
Opcode Fuzzy Hash: 385f395c7081b7adfd7503d7f63bdc2b7ed01e05bf0e601b6d5d2cb86ae5d547
Instruction Fuzzy Hash: 2F51AF71A04306AFEB219F58CC81F2F77A9EB44764F208658F965EB2E1DB74E940DB10

Function 0094635A Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 009463B7
DeleteFileW.KERNEL32(00000000,00000000,00000000,?,?,00000078,000000FF,00000000,?,?,?,00000078,000000FF,?,?,00000078), ref: 009464AE
CloseHandle.KERNEL32(000000FF,00000000,00000000,?,?,00000078,000000FF,00000000,?,?,?,00000078,000000FF,?,?,00000078), ref: 009464BD

Strings

WiX\Burn, xrefs: 009463F5
dlutil.cpp, xrefs: 009463DB
Burn, xrefs: 009463A6
DownloadTimeout, xrefs: 009463F0

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CloseDeleteErrorFileHandleLast
String ID: Burn$DownloadTimeout$WiX\Burn$dlutil.cpp
API String ID: 3522763407-1704223933
Opcode ID: 15a908bbfe27cb6c50b5f960096ba0b872cb465e42a69e04798315e6197a7b2f
Instruction ID: e6c604aaa625ab9c6c25e0eca5569c1ad9394499d3eb83c2c96cba993c2f7749
Opcode Fuzzy Hash: 15a908bbfe27cb6c50b5f960096ba0b872cb465e42a69e04798315e6197a7b2f
Instruction Fuzzy Hash: 195157B2D00219BBDF129FA4CC41EAEBBBDEF49710F014165FA04E61A0E7348A50DBA1

Function 00919080 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 138COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 0091910E

Part of subcall function 00945587: GetLastError.KERNEL32(?,?,00919133,?,00000003,00000000,?), ref: 009455A6

_memcmp.LIBVCRUNTIME ref: 00919148
GetLastError.KERNEL32 ref: 009191C2

Strings

Failed to read certificate thumbprint., xrefs: 009191B6
Failed to get certificate public key identifier., xrefs: 009191F0
Failed to find expected public key in certificate chain., xrefs: 00919183
cache.cpp, xrefs: 009191E6

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorLast_memcmp
String ID: Failed to find expected public key in certificate chain.$Failed to get certificate public key identifier.$Failed to read certificate thumbprint.$cache.cpp
API String ID: 3428363238-3408201827
Opcode ID: d4674e743c055d3f88897ac222cc1d2add82cb64933343bb429cdacc00bdcb79
Instruction ID: 2176464a7466d37e4e068b39ce864e92efc7aa5ab66a7d2a46876987077bdc62
Opcode Fuzzy Hash: d4674e743c055d3f88897ac222cc1d2add82cb64933343bb429cdacc00bdcb79
Instruction Fuzzy Hash: D5417C72F0421AAFDB10DBA9D855EEAB3F9AF08710F004029F905E7241D774ED84CBA4

Function 00910419 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 133registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,?,?,00000000,?), ref: 0091054A
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,?,?,00000000,?), ref: 00910559

Part of subcall function 00940AD5: RegCreateKeyExW.ADVAPI32(00000001,00000000,00000000,00000000,00000000,00000001,00000000,?,00000000,00000001,?,?,00910491,?,00000000,00020006), ref: 00940AFA

Strings

Failed to update resume mode., xrefs: 0091052E
Failed to delete registration key: %ls, xrefs: 009104F8
Failed to write volatile reboot required registry key., xrefs: 00910495
%ls.RebootRequired, xrefs: 00910467
Failed to open registration key., xrefs: 00910591

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Close$Create
String ID: %ls.RebootRequired$Failed to delete registration key: %ls$Failed to open registration key.$Failed to update resume mode.$Failed to write volatile reboot required registry key.
API String ID: 359002179-2517785395
Opcode ID: 47a330762700c24ca1c18aacd33d58efef0b7aa7e2240a15102307f589f5d15e
Instruction ID: 0292244f431c7c85df424e3b3111a571bf8fbd4aef123d3b762c4523ffc62cb2
Opcode Fuzzy Hash: 47a330762700c24ca1c18aacd33d58efef0b7aa7e2240a15102307f589f5d15e
Instruction Fuzzy Hash: BC417031A0021CBBDB22AEA1DC02FEF77BAAFC4315F144429FA4562061D7729AD0DB51

Function 0090F69D Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 117registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 0090F7CD
RegCloseKey.ADVAPI32(00000000,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 0090F7DA

Strings

Failed to read Resume value., xrefs: 0090F763
Failed to format pending restart registry key to read., xrefs: 0090F6D1
%ls.RebootRequired, xrefs: 0090F6BA
Resume, xrefs: 0090F741
Failed to open registration key., xrefs: 0090F736

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Close
String ID: %ls.RebootRequired$Failed to format pending restart registry key to read.$Failed to open registration key.$Failed to read Resume value.$Resume
API String ID: 3535843008-3890505273
Opcode ID: 10ab7478a558630d121fc4f111fd0c5049fb63f8a32bfb2536e488910d2f6d50
Instruction ID: 11dfda3996eba92aad231ab1112ab27bab5a46322e3e859400060bccc9ae2bf6
Opcode Fuzzy Hash: 10ab7478a558630d121fc4f111fd0c5049fb63f8a32bfb2536e488910d2f6d50
Instruction Fuzzy Hash: AC418236900118EFCB219F98CC90BADBBB9FB45310F258176E904ABA90C3759F50DB82

Function 0091A7FA Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 111COMMON

Download Yara Rule

Strings

Failed to trim source folder., xrefs: 0091A88F
Failed to determine length of source path., xrefs: 0091A82A
Failed to determine length of relative path., xrefs: 0091A847
WixBundleLastUsedSource, xrefs: 0091A899, 0091A89F, 0091A8DB
Failed to set last source., xrefs: 0091A8EA

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID:
String ID: Failed to determine length of relative path.$Failed to determine length of source path.$Failed to set last source.$Failed to trim source folder.$WixBundleLastUsedSource
API String ID: 0-660234312
Opcode ID: 5a5ffd04ff3c9d6d1dba2fd6604b94f25dbd28b8a08d6624339695837fefd851
Instruction ID: 1069c5ce3a3acf9a2be3fcca169e5e24eecd940dc736a57ef6cfbbac1f81e05b
Opcode Fuzzy Hash: 5a5ffd04ff3c9d6d1dba2fd6604b94f25dbd28b8a08d6624339695837fefd851
Instruction Fuzzy Hash: BA31D632E0522DBBDF219A94CC05FEEB779AF44720F1142A5F920B71D1EB308E819791

Function 0092D677 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 106comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00960A84,00000000,00000017,00960A94,?,?,00000000,00000000,?,?,?,?,?,0092DCAE,00000000,00000000), ref: 0092D6AF

Strings

Failed to set progress timeout., xrefs: 0092D719
Failed to set BITS job to foreground., xrefs: 0092D730
Failed to create IBackgroundCopyManager., xrefs: 0092D6BB
WixBurn, xrefs: 0092D6DA
Failed to set notification flags for BITS job., xrefs: 0092D701
Failed to create BITS job., xrefs: 0092D6E9

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CreateInstance
String ID: Failed to create BITS job.$Failed to create IBackgroundCopyManager.$Failed to set BITS job to foreground.$Failed to set notification flags for BITS job.$Failed to set progress timeout.$WixBurn
API String ID: 542301482-468763447
Opcode ID: a586a1778ed96c585ae0e7db34b58c294757fd8e9674ed5531ecb845d5adfabd
Instruction ID: a7f921d0ef16782a4cd8bf8e03f6024e29a6823a05fbf210824fc768bab85b1c
Opcode Fuzzy Hash: a586a1778ed96c585ae0e7db34b58c294757fd8e9674ed5531ecb845d5adfabd
Instruction Fuzzy Hash: 7331B671B41229AFDB14CFA4D899E7FBBB8EF88714B100559F905EB350CA34EC018B91

Function 00945C68 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 98fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000004,00000000,00000004,00000080,00000000,00000000,?,?,?,?,?,WiX\Burn,DownloadTimeout,00000078), ref: 00945CB2
GetLastError.KERNEL32 ref: 00945CBF
ReadFile.KERNEL32(00000000,00000008,00000008,?,00000000), ref: 00945D06
CloseHandle.KERNEL32(00000000,dlutil.cpp,000000C8,00000000), ref: 00945D6E

Strings

%ls.R, xrefs: 00945C86
dlutil.cpp, xrefs: 00945CE3, 00945D5E

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastRead
String ID: %ls.R$dlutil.cpp
API String ID: 2136311172-657863730
Opcode ID: 31e084d2c72dc2f10259b0e89df036217f7d9653d90b3109984318ab1fb1c634
Instruction ID: 181c16c45f70144b7ee8553e70173a25b0e38b47d2e9b25d9d41eefdac7b3fe7
Opcode Fuzzy Hash: 31e084d2c72dc2f10259b0e89df036217f7d9653d90b3109984318ab1fb1c634
Instruction Fuzzy Hash: 7031C272A50614AFEB208FA8CC89FAA77E8EF45721F124219FE05EB1D1D7709D0197A1

Function 0090C7DF Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 97fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0090CC57: CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,0090E336,000000FF,00000000,00000000,0090E336,?,?,0090DADD,?,?,?,?), ref: 0090CC82

CreateFileW.KERNEL32(E90094BA,80000000,00000005,00000000,00000003,08000000,00000000,009052BD,0094B450,00000000,009053B5,04680A79,?,009052B5,00000000,00905381), ref: 0090C84F
GetLastError.KERNEL32(?,?,?,009175F7,00905565,00905371,00905371,00000000,?,00905381,FFF9E89D,00905381,009053B5,0090533D,?,0090533D), ref: 0090C894

Strings

Failed to get catalog local file path, xrefs: 0090C8D2
catalog.cpp, xrefs: 0090C8B5
Failed to find payload for catalog file., xrefs: 0090C8D9
Failed to verify catalog signature: %ls, xrefs: 0090C88D
Failed to open catalog in working path: %ls, xrefs: 0090C8C2

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CompareCreateErrorFileLastString
String ID: Failed to find payload for catalog file.$Failed to get catalog local file path$Failed to open catalog in working path: %ls$Failed to verify catalog signature: %ls$catalog.cpp
API String ID: 1774366664-48089280
Opcode ID: 86a7db13e35da76d0ffaad7c92c5b7e95374d3ba0aa0efc56b1f3aab0ab1748c
Instruction ID: 7f79bdcaff06a59ddfffde91b4e4741d8a671696948e1cf76988106027d39054
Opcode Fuzzy Hash: 86a7db13e35da76d0ffaad7c92c5b7e95374d3ba0aa0efc56b1f3aab0ab1748c
Instruction Fuzzy Hash: 0131C2B2A40625BFD7119B64CC41F5ABBA4EF44710F218229FD08EB2D0E770AD509B94

Function 0092D12C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 92synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,74DF30B0,00000000,?,?,?,?,0092D439,?), ref: 0092D145
ReleaseMutex.KERNEL32(?,?,?,?,0092D439,?), ref: 0092D161
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0092D1A4
ReleaseMutex.KERNEL32(?), ref: 0092D1BB
SetEvent.KERNEL32(?), ref: 0092D1C4

Strings

Failed to send files in use message from netfx chainer., xrefs: 0092D20A
Failed to get message from netfx chainer., xrefs: 0092D1E5

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: MutexObjectReleaseSingleWait$Event
String ID: Failed to get message from netfx chainer.$Failed to send files in use message from netfx chainer.
API String ID: 2608678126-3424578679
Opcode ID: 9c550ccc7ff62af3bf65f132fdf56cab6357a939946d6d7b632c4d6560dd17cb
Instruction ID: b76e9b52d8c85fafa183184ce7ba617d805f2ff75cfc29c22a8a40f737d973a7
Opcode Fuzzy Hash: 9c550ccc7ff62af3bf65f132fdf56cab6357a939946d6d7b632c4d6560dd17cb
Instruction Fuzzy Hash: 35310731904619EFCB129FA4DC48EAFBBF9EF89320F108665F524A62A1C770D9009B90

Function 0094082D Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 89processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,00000000), ref: 0094089A
GetLastError.KERNEL32(?,?,?,?,00000000,00000000,00000000), ref: 009408A4
CloseHandle.KERNEL32(?,?,?,?,?,00000000,00000000,00000000), ref: 009408ED
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,00000000,00000000), ref: 009408FA

Strings

"%ls" %ls, xrefs: 00940863
D, xrefs: 00940882
procutil.cpp, xrefs: 009408C8

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CloseHandle$CreateErrorLastProcess
String ID: "%ls" %ls$D$procutil.cpp
API String ID: 161867955-2732225242
Opcode ID: fdfa6e256bda39f356aab865980dc1b343da71447489a40e5afe16dd2a0122f9
Instruction ID: 3b38935d72ef4152e134ee63f9568ea129bf12f06477fee69303707f114aeec4
Opcode Fuzzy Hash: fdfa6e256bda39f356aab865980dc1b343da71447489a40e5afe16dd2a0122f9
Instruction Fuzzy Hash: 8B214D75D0021EAFDB10DFE8CE40AAEB7B9EF44315F104126EA04B6261D7719E009BA1

Function 00909A6D Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00909A86
GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,00000000,?,0090A7A9,00000100,000002C0,000002C0,00000100), ref: 00909AA6
GetLastError.KERNEL32(?,0090A7A9,00000100,000002C0,000002C0,00000100), ref: 00909AB1

Strings

Directory search: %ls, did not find path: %ls, reason: 0x%x, xrefs: 00909B1C
Failed while searching directory search: %ls, for path: %ls, xrefs: 00909B06
Failed to set directory search path variable., xrefs: 00909AE1
Failed to format variable string., xrefs: 00909A91

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Directory search: %ls, did not find path: %ls, reason: 0x%x$Failed to format variable string.$Failed to set directory search path variable.$Failed while searching directory search: %ls, for path: %ls
API String ID: 1811509786-2966038646
Opcode ID: e5ffb4186bbd2a3516eb5c651044bba797667cf4ea60fd51f0780c50a9f9db9d
Instruction ID: 5287d9478ecdde63d29c86b9573877ad4f198ef6c3ac61c33f62e7f4a81f63c8
Opcode Fuzzy Hash: e5ffb4186bbd2a3516eb5c651044bba797667cf4ea60fd51f0780c50a9f9db9d
Instruction Fuzzy Hash: AA11E432A44128FFCB126A989D02F9EBB69EF94330F210225FD04761E2D7369E10A6D1

Function 00909C39 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00909C52
GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,000002C0,?,0090A781,00000100,000002C0,000002C0,?,000002C0,00000100), ref: 00909C72
GetLastError.KERNEL32(?,0090A781,00000100,000002C0,000002C0,?,000002C0,00000100,000002C0,000002C0,00000100), ref: 00909C7D

Strings

Failed while searching file search: %ls, for path: %ls, xrefs: 00909CAA
Failed to format variable string., xrefs: 00909C5D
Failed to set variable to file search path., xrefs: 00909CD4
File search: %ls, did not find path: %ls, xrefs: 00909CE0

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Failed to format variable string.$Failed to set variable to file search path.$Failed while searching file search: %ls, for path: %ls$File search: %ls, did not find path: %ls
API String ID: 1811509786-3425311760
Opcode ID: 2b62ae5f9b5fe587e8a6bf7d0176d3358fb7b6940ace69d8d962159710b3b54d
Instruction ID: 0cb787c547088a085ef31bace4bd64d6565c504712286a023ad3fa00d6adaae5
Opcode Fuzzy Hash: 2b62ae5f9b5fe587e8a6bf7d0176d3358fb7b6940ace69d8d962159710b3b54d
Instruction Fuzzy Hash: 53112432D04234BFEF122A948E42F9DBAA9AF51720F214211FD48B61E2D7359E10B7D0

Function 0091CCF4 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 53synchronizationthreadCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000001,000493E0,00000000,?,?,0091D134,00000000,?,?,0091C59C,00000001,?,?,?,?,?), ref: 0091CD06
GetLastError.KERNEL32(?,?,0091D134,00000000,?,?,0091C59C,00000001,?,?,?,?,?,00000000,00000000,?), ref: 0091CD10
GetExitCodeThread.KERNEL32(00000001,?,?,?,0091D134,00000000,?,?,0091C59C,00000001,?,?,?,?,?,00000000), ref: 0091CD4C
GetLastError.KERNEL32(?,?,0091D134,00000000,?,?,0091C59C,00000001,?,?,?,?,?,00000000,00000000,?), ref: 0091CD56

Strings

Failed to get cache thread exit code., xrefs: 0091CD84
Failed to wait for cache thread to terminate., xrefs: 0091CD3E
elevation.cpp, xrefs: 0091CD34, 0091CD7A

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectSingleThreadWait
String ID: Failed to get cache thread exit code.$Failed to wait for cache thread to terminate.$elevation.cpp
API String ID: 3686190907-1954264426
Opcode ID: d5deb64987bf1db4c17becbd0df763547f6145d2201afa1235cf3d633aacf3b3
Instruction ID: d2e81221e3c91ad323dad8d4bd3cc0ebfd9e55f28fcdc188f2a2f87af4b525f1
Opcode Fuzzy Hash: d5deb64987bf1db4c17becbd0df763547f6145d2201afa1235cf3d633aacf3b3
Instruction Fuzzy Hash: BD01F976B447347AEB20ABB9AC06F9B7ADCDF05791F014125FD05E6090E6508E0092E5

Function 009167B0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 52synchronizationthreadCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000001,000000FF,00000000,?,00916CFB,00904740,?,00000000,?,00000000,00000001), ref: 009167BD
GetLastError.KERNEL32(?,00916CFB,00904740,?,00000000,?,00000000,00000001), ref: 009167C7
GetExitCodeThread.KERNEL32(00000001,00000000,?,00916CFB,00904740,?,00000000,?,00000000,00000001), ref: 00916806
GetLastError.KERNEL32(?,00916CFB,00904740,?,00000000,?,00000000,00000001), ref: 00916810

Strings

Failed to get cache thread exit code., xrefs: 00916841
core.cpp, xrefs: 009167EB, 00916834
Failed to wait for cache thread to terminate., xrefs: 009167F8

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectSingleThreadWait
String ID: Failed to get cache thread exit code.$Failed to wait for cache thread to terminate.$core.cpp
API String ID: 3686190907-2546940223
Opcode ID: 574c7311d898bf2f8e2333cea10d6e51007501c67436d65b3318abd81197df37
Instruction ID: 8a747bc633a74be1f73dc8de505bc69d58bd1819eea8221bcfbcac824544cd25
Opcode Fuzzy Hash: 574c7311d898bf2f8e2333cea10d6e51007501c67436d65b3318abd81197df37
Instruction Fuzzy Hash: 95018B70744308BBEB08AB65DD16BBE76E9EB40715F10412DBC16D50E0EB75DA40A618

Function 0091F586 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 118COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0091F59B
LeaveCriticalSection.KERNEL32(?), ref: 0091F6A8

Strings

Failed to set source path for container., xrefs: 0091F68D
Failed to set source path for payload., xrefs: 0091F637
UX denied while trying to set source on embedded payload: %ls, xrefs: 0091F61D
Engine is active, cannot change engine state., xrefs: 0091F5B5
UX requested unknown container with id: %ls, xrefs: 0091F667
UX requested unknown payload with id: %ls, xrefs: 0091F607

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Engine is active, cannot change engine state.$Failed to set source path for container.$Failed to set source path for payload.$UX denied while trying to set source on embedded payload: %ls$UX requested unknown container with id: %ls$UX requested unknown payload with id: %ls
API String ID: 3168844106-4121889706
Opcode ID: 86406fc625b5e5cb48f03ebd413015be133d56759edf033f55a904d648ae9f4f
Instruction ID: c706dcc22253be2a1bfe812ca1771e2e5f3db4a132e3b1ed4fe422760ec1588e
Opcode Fuzzy Hash: 86406fc625b5e5cb48f03ebd413015be133d56759edf033f55a904d648ae9f4f
Instruction Fuzzy Hash: 1E313772B1461DAFCB108B59CC25EDB73ACEF94761B04412AFC04E7290DB74EC808794

Function 009070D4 Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 99stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000), ref: 009070E7

Strings

Failed to format escape sequence., xrefs: 00907181
Failed to append characters., xrefs: 00907173
Failed to copy string., xrefs: 0090719B
[\%c], xrefs: 00907146
Failed to append escape sequence., xrefs: 0090717A
[]{}, xrefs: 00907111
Failed to allocate buffer for escaped string., xrefs: 009070FE

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: lstrlen
String ID: Failed to allocate buffer for escaped string.$Failed to append characters.$Failed to append escape sequence.$Failed to copy string.$Failed to format escape sequence.$[\%c]$[]{}
API String ID: 1659193697-3250950999
Opcode ID: df8283dba955ff3077c33113501ee28eda5dc8c0fa73c086d6147ac6b728535d
Instruction ID: 32332e5a051d591ab69480da75fe8aef0b76f0c54d75fd157fc22d64be2186bb
Opcode Fuzzy Hash: df8283dba955ff3077c33113501ee28eda5dc8c0fa73c086d6147ac6b728535d
Instruction Fuzzy Hash: 0E21D273D4D229BEDB6156D4CC02FAEB6AD9B84734F200156F900B61C1EB78BE409294

Function 009259B0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 207COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,0094B4F0,000000FF,feclient.dll,000000FF,00000000,00000000,?,?,?,0092659B,?,00000001,?,0094B490), ref: 00925A19

Strings

Failed to plan action for target product., xrefs: 00925AC4
Failed to copy target product code., xrefs: 00925B4C
feclient.dll, xrefs: 00925A0F, 00925B39
Failed grow array of ordered patches., xrefs: 00925AB2
Failed to insert execute action., xrefs: 00925A6E

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CompareString
String ID: Failed grow array of ordered patches.$Failed to copy target product code.$Failed to insert execute action.$Failed to plan action for target product.$feclient.dll
API String ID: 1825529933-3477540455
Opcode ID: 2e33bbbbce99f70a54b24eca279d357e4aca445584ed8a64201b6055db818483
Instruction ID: a30f0697ecbd3e3658f2a16041e81bc041de58abd26a4790fc7fa8c6ceb2e78f
Opcode Fuzzy Hash: 2e33bbbbce99f70a54b24eca279d357e4aca445584ed8a64201b6055db818483
Instruction Fuzzy Hash: 8F8145B560072A9FCB14CF58D881AAA77A8FF48324B128A69EC158B356D730EC51CF90

Function 00929039 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 171COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000001,?,000000FF,?,000000FF,00000000,00000100,00000000,?,?,?,00916F20,000000B8,0000001C,00000100), ref: 00929068
CompareStringW.KERNEL32(00000000,00000001,?,000000FF,0094B4A8,000000FF,?,?,?,00916F20,000000B8,0000001C,00000100,00000100,00000100,000000B0), ref: 00929101

Strings

comres.dll, xrefs: 00929187
detect.cpp, xrefs: 00929163
BA aborted detect forward compatible bundle., xrefs: 0092916D
Failed to initialize update bundle., xrefs: 009291A9

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CompareString
String ID: BA aborted detect forward compatible bundle.$Failed to initialize update bundle.$comres.dll$detect.cpp
API String ID: 1825529933-439563586
Opcode ID: 40c94d3139b5703118f96de57af19503208ef28f4a8044aed23de906130a1c4b
Instruction ID: a438cad4d14a4557300233d9c78cde8106a78b6bd6bac3cb86e772cac7a9c7b6
Opcode Fuzzy Hash: 40c94d3139b5703118f96de57af19503208ef28f4a8044aed23de906130a1c4b
Instruction Fuzzy Hash: 8C51E171604226BFDB199F74DC85E6AB7AAFF09310F104668F819DA199D731EC60CB90

Function 0093C9BD Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,0093D132,?,00000000,?,00000000,00000000), ref: 0093C9FF
__fassign.LIBCMT ref: 0093CA7A
__fassign.LIBCMT ref: 0093CA95
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 0093CABB
WriteFile.KERNEL32(?,?,00000000,0093D132,00000000,?,?,?,?,?,?,?,?,?,0093D132,?), ref: 0093CADA
WriteFile.KERNEL32(?,?,00000001,0093D132,00000000,?,?,?,?,?,?,?,?,?,0093D132,?), ref: 0093CB13

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 4d1e0c83a2eeb6e2b25b5e03829d1c0142d836ed1036ba06ad7859db221213bd
Instruction ID: 30dbc50f9a1bd690dcd6cc9aceec4932df6dabf3b3731d29b235f704f075aa26
Opcode Fuzzy Hash: 4d1e0c83a2eeb6e2b25b5e03829d1c0142d836ed1036ba06ad7859db221213bd
Instruction Fuzzy Hash: 625191B5A14649AFDB10CFA8DC85AEEBBF8EF09300F14411AE555F7291E770A941CFA0

Function 0091A998 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 138COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,000000FF,00AAC56B,?,009052B5,00000000,0090533D), ref: 0091AA90
GetLastError.KERNEL32(00000000,00000000,00000000,00000000,?,000000FF,00AAC56B,?,009052B5,00000000,0090533D), ref: 0091AAD4

Strings

Failed to get provider state from authenticode certificate., xrefs: 0091AABE
Failed authenticode verification of payload: %ls, xrefs: 0091AA71
cache.cpp, xrefs: 0091AA66, 0091AAB4, 0091AAF8
Failed to get signer chain from authenticode certificate., xrefs: 0091AB02
Failed to verify expected payload against actual certificate chain., xrefs: 0091AB1A

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorLast
String ID: Failed authenticode verification of payload: %ls$Failed to get provider state from authenticode certificate.$Failed to get signer chain from authenticode certificate.$Failed to verify expected payload against actual certificate chain.$cache.cpp
API String ID: 1452528299-2590768268
Opcode ID: c57c14927c3ff8ca691c9168d124a49ca9fd8e0662fa77948f136af76230416f
Instruction ID: 1cc606113d52ee85d34b904d7c7dcd8dca73275a0d00e3996220c05eff9df984
Opcode Fuzzy Hash: c57c14927c3ff8ca691c9168d124a49ca9fd8e0662fa77948f136af76230416f
Instruction Fuzzy Hash: 4F418271E45228AAEB10DBA9DD45BEFBAF8EF48310F00012AFD05F7191E7709D458AA5

Function 009401F0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 123COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000001,00000000,00000000), ref: 00940234
GetComputerNameW.KERNEL32(?,?), ref: 0094028C

Strings

Computer : %ls, xrefs: 009402FA
=== Logging started: %ls ===, xrefs: 009402B7
--- logging level: %hs ---, xrefs: 0094034C
Executable: %ls v%d.%d.%d.%d, xrefs: 009402E8

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Name$ComputerFileModule
String ID: --- logging level: %hs ---$=== Logging started: %ls ===$Computer : %ls$Executable: %ls v%d.%d.%d.%d
API String ID: 2577110986-3153207428
Opcode ID: 47fce892d739400bc0a14ec1f0b025f6490e511251d02e54ba4da4fdda9a0b41
Instruction ID: 6ddf426b9ece6a0a1954bbd6464cf8f49877e5f79106764398ada95df82d45dd
Opcode Fuzzy Hash: 47fce892d739400bc0a14ec1f0b025f6490e511251d02e54ba4da4fdda9a0b41
Instruction Fuzzy Hash: 494160F2D0412CABCB209F64DC89EAA77BCEBD5304F0041E9FA09E7141D674AE859F65

Function 0094143C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 123stringregistryCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00000000,00000000,BundleUpgradeCode,?,00020006,00000000,?,?,?,00000001), ref: 00941479
lstrlenW.KERNEL32(?,00000000,00000000,?,00000000,00000001,00000000,00000000,BundleUpgradeCode,?,00020006,00000000,?,?,?,00000001), ref: 009414F1
lstrlenW.KERNEL32(?,?,?,?,00000001), ref: 009414FD
RegSetValueExW.ADVAPI32(00020006,?,00000000,00000007,00000000,?,00000000,?,?,00000000,00000001,00000000,00000000,BundleUpgradeCode,?,00020006), ref: 0094153D

Strings

BundleUpgradeCode, xrefs: 00941442
regutil.cpp, xrefs: 00941565

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: lstrlen$Value
String ID: BundleUpgradeCode$regutil.cpp
API String ID: 198323757-1648651458
Opcode ID: 75ea0e7dbaf77a2480df9fb6faa18a220aa773aa20876bfe6d2107ef564701cd
Instruction ID: f2dc15bf33fda92307a0d16295aa09de2739e94c8a91368b0b7e2e94300eafe4
Opcode Fuzzy Hash: 75ea0e7dbaf77a2480df9fb6faa18a220aa773aa20876bfe6d2107ef564701cd
Instruction Fuzzy Hash: A8419432E0022AAFCB21DFA8D851EAE7BA9AF44710F114169FD05A7251D770DD518B90

Function 0091D206 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,?,00000001,0094B4F0,?,00000001,000000FF,?,?,75C0B390,00000000,00000001,00000000,?,009172F3), ref: 0091D32F

Strings

Failed to create pipe name and client token., xrefs: 0091D270
Failed to connect to elevated child process., xrefs: 0091D318
Failed to elevate., xrefs: 0091D311
Failed to create pipe and cache pipe., xrefs: 0091D28C
elevation.cpp, xrefs: 0091D23A
UX aborted elevation requirement., xrefs: 0091D244

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CloseHandle
String ID: Failed to connect to elevated child process.$Failed to create pipe and cache pipe.$Failed to create pipe name and client token.$Failed to elevate.$UX aborted elevation requirement.$elevation.cpp
API String ID: 2962429428-3003415917
Opcode ID: 0168c8672d9c7240c3918ab7bdebcb3dbda70219f2b62092cf8590b662ab17a5
Instruction ID: 6d19f81ac7ecd5844d3c8db3ad193b81055a036d8a97a2c93a89058c3b4af334
Opcode Fuzzy Hash: 0168c8672d9c7240c3918ab7bdebcb3dbda70219f2b62092cf8590b662ab17a5
Instruction Fuzzy Hash: 85316872B4672A7FE725A2A09C46FEFA34CEF41724F100205F925B61C1DA60EE8082E5

Function 0094041B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0096B60C,00000000,?,?,?,00905407,00000000,Setup,_Failed,txt,00000000,00000000,00000000,?,?,?), ref: 0094042B
CreateFileW.KERNEL32(40000000,00000001,00000000,00000002,00000080,00000000,?,00000000,?,?,?,0096B604,?,00905407,00000000,Setup), ref: 009404CC
GetLastError.KERNEL32(?,00905407,00000000,Setup,_Failed,txt,00000000,00000000,00000000,?,?,?), ref: 009404DC
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,00905407,00000000,Setup,_Failed,txt,00000000,00000000,00000000,?,?,?), ref: 00940515

Part of subcall function 00902DE0: GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 00902F1F

LeaveCriticalSection.KERNEL32(0096B60C,?,?,0096B604,?,00905407,00000000,Setup,_Failed,txt,00000000,00000000,00000000,?,?,?), ref: 0094056E

Strings

logutil.cpp, xrefs: 009404FA

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CriticalFileSection$CreateEnterErrorLastLeaveLocalPointerTime
String ID: logutil.cpp
API String ID: 4111229724-3545173039
Opcode ID: 2a20a4eecc894747174eec1f390946833b6dc5b85ef831d60b774d7c717f8781
Instruction ID: a39687d38c0396512beb7d159951bcdb1fa9b70a30618ee0ab2a35aeef2607cc
Opcode Fuzzy Hash: 2a20a4eecc894747174eec1f390946833b6dc5b85ef831d60b774d7c717f8781
Instruction Fuzzy Hash: 92319A71E05219BFDB21AF61DD45F5A366CEB807A5F014529FB04E61A0E770CD50AFA0

Function 0091D01A Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 117threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,0091AB3C,?,00000000,00000000), ref: 0091D0B8
GetLastError.KERNEL32(?,?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0091D0C4
CloseHandle.KERNEL32(00000000,00000000,?,?,0091C59C,00000001,?,?,?,?,?,00000000,00000000,?,?,?), ref: 0091D145

Strings

Failed to pump messages in child process., xrefs: 0091D11C
elevation.cpp, xrefs: 0091D0E8
Failed to create elevated cache thread., xrefs: 0091D0F2

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CloseCreateErrorHandleLastThread
String ID: Failed to create elevated cache thread.$Failed to pump messages in child process.$elevation.cpp
API String ID: 747004058-4134175193
Opcode ID: 947cf54c2a7bee9f9159e18057ffad9d4e851491aad891904e40081a7660605f
Instruction ID: a4fc0f8a4626ef8ed2cff367429f4d354ac80b2f9e37d559f007367361784f96
Opcode Fuzzy Hash: 947cf54c2a7bee9f9159e18057ffad9d4e851491aad891904e40081a7660605f
Instruction Fuzzy Hash: E941E3B5E0521CAF9B05DFA9D8819EEBBF8FF48310F10412AF908E7340D774A9418BA4

Function 00923750 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 112COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 009237B7

Strings

Failed to format property string part., xrefs: 00923832
%s%="%s", xrefs: 009237EA
Failed to format property value., xrefs: 00923840
Failed to escape string., xrefs: 00923839
Failed to append property string part., xrefs: 0092382B

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Open@16
String ID: %s%="%s"$Failed to append property string part.$Failed to escape string.$Failed to format property string part.$Failed to format property value.
API String ID: 3613110473-515423128
Opcode ID: d3089a34bc58051f14e612aa4dfd2a94836fd992ba63d319e4c47c78771b6edb
Instruction ID: 9143a9e443048a05ea14ffae83dd095978334bb4d24a3aaf34a19cfc5fc0586a
Opcode Fuzzy Hash: d3089a34bc58051f14e612aa4dfd2a94836fd992ba63d319e4c47c78771b6edb
Instruction Fuzzy Hash: 7831B2B2D05229FFCF159F94EC41AAEB7A8EF40B10F10816AF91166281D778AF149B90

Function 00907203 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,00000000,?,?,?,0090583F,000002C0,000002C0,00000000,00000100,00000001,00000000,000002C0,00000002), ref: 00907215
LeaveCriticalSection.KERNEL32(00000000,00000000,00000002,00000000,?,?,?,0090583F,000002C0,000002C0,00000000,00000100,00000001,00000000,000002C0,00000002), ref: 009072F4

Strings

*****, xrefs: 009072B0, 009072BD
Failed to get variable: %ls, xrefs: 00907256
Failed to get value as string for variable: %ls, xrefs: 009072E3
Failed to format value '%ls' of variable: %ls, xrefs: 009072BE
Failed to get unformatted string., xrefs: 00907285

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: *****$Failed to format value '%ls' of variable: %ls$Failed to get unformatted string.$Failed to get value as string for variable: %ls$Failed to get variable: %ls
API String ID: 3168844106-2873099529
Opcode ID: b06710b6eb44d7547ff4cd5278311a53b22918662644c02f32a53ec644e986fd
Instruction ID: 93b9a54d7c093e7b6c9f80f4c3fd606cc43aef24f829b3ec1e30414def2c9f86
Opcode Fuzzy Hash: b06710b6eb44d7547ff4cd5278311a53b22918662644c02f32a53ec644e986fd
Instruction Fuzzy Hash: 9331AD32D0862AFFCF219A98CC05FAEBB69AF54334F104125F91466190D735BE609BC0

Function 00918BE5 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

InitializeAcl.ADVAPI32(?,00000008,00000002,0000001A,00000000,?,00000000,00000000,?,?,00000000,00000000,?,?,-00000004,00000000), ref: 00918C30
GetLastError.KERNEL32(?,?,?,00000001), ref: 00918C3A
SetFileAttributesW.KERNEL32(?,00000080,?,00000001,20000004,00000000,00000000,?,00000000,00000003,000007D0,?,00000000,00000000,?,?), ref: 00918C9A

Strings

Failed to initialize ACL., xrefs: 00918C68
Failed to allocate administrator SID., xrefs: 00918C16
cache.cpp, xrefs: 00918C5E

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: AttributesErrorFileInitializeLast
String ID: Failed to allocate administrator SID.$Failed to initialize ACL.$cache.cpp
API String ID: 669721577-1117388985
Opcode ID: 7469a0bdc62d72e95a07c588243bb2e558812302c8c80ea3adbb7ae5290e1dd5
Instruction ID: a89bb27b8dacac3f18acc6f8ed06691ef8c972849b0a979aa918aac93a7958a6
Opcode Fuzzy Hash: 7469a0bdc62d72e95a07c588243bb2e558812302c8c80ea3adbb7ae5290e1dd5
Instruction Fuzzy Hash: 5721EB72F45318BBEB109A999C85FDBB7ADEB44751F114029FD04F7180EA709E40A7E0

Function 0090410D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00000000,00000000,?,00000000,crypt32.dll,?,?,00913ED4,00000001,feclient.dll,?,00000000,?,?,?,00904A0C), ref: 00904148
GetLastError.KERNEL32(?,?,00913ED4,00000001,feclient.dll,?,00000000,?,?,?,00904A0C,?,?,0094B478,?,00000001), ref: 00904154
GetCurrentDirectoryW.KERNEL32(00000000,?,?,00000000,?,?,00913ED4,00000001,feclient.dll,?,00000000,?,?,?,00904A0C,?), ref: 0090418F
GetLastError.KERNEL32(?,?,00913ED4,00000001,feclient.dll,?,00000000,?,?,?,00904A0C,?,?,0094B478,?,00000001), ref: 00904199

Strings

dirutil.cpp, xrefs: 009041BD
crypt32.dll, xrefs: 00904111

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CurrentDirectoryErrorLast
String ID: crypt32.dll$dirutil.cpp
API String ID: 152501406-1104880720
Opcode ID: 3d41a576ff4f11e6d5294dc19cdc62fa23c28975e34587338ed2ce3f5af0fa98
Instruction ID: 1ba4fa6c6ae10259d882c52c1b9101b6bc8a4b4a7a48ccd8a2fbad2cf05b420f
Opcode Fuzzy Hash: 3d41a576ff4f11e6d5294dc19cdc62fa23c28975e34587338ed2ce3f5af0fa98
Instruction Fuzzy Hash: AE11ECB6E04726AFE7609AA98CC4B6BB6ECDF65751B110135FE04E7290E760CC409AE0

Function 0090999B Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 75COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 009099B6
GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,000002C0,00000100), ref: 009099CE
GetLastError.KERNEL32 ref: 009099D9

Strings

Failed to set variable., xrefs: 00909A4E
Failed while searching directory search: %ls, for path: %ls, xrefs: 00909A16
Failed to format variable string., xrefs: 009099C1

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Failed to format variable string.$Failed to set variable.$Failed while searching directory search: %ls, for path: %ls
API String ID: 1811509786-402580132
Opcode ID: 44aba8c7f9730a46aadc3d047f39070309c0f57642495eba442da11dfcc08eec
Instruction ID: b70aaf6cd6645703a295b3e0746ab29cc8f406466a576b72f58878efc738e3c8
Opcode Fuzzy Hash: 44aba8c7f9730a46aadc3d047f39070309c0f57642495eba442da11dfcc08eec
Instruction Fuzzy Hash: 7D21F932E54228BFCB119AA4CC41BAEB769EF95320F208315F814B61D1D7705E5096D1

Function 009208F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 72fileCOMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 00920940
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 0092095F
GetLastError.KERNEL32 ref: 00920969

Strings

cabextract.cpp, xrefs: 0092098D
Failed to write during cabinet extraction., xrefs: 00920997
Unexpected call to CabWrite()., xrefs: 00920923

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorFileLastWrite_memcpy_s
String ID: Failed to write during cabinet extraction.$Unexpected call to CabWrite().$cabextract.cpp
API String ID: 1970631241-3111339858
Opcode ID: 67c9939c2680629b9c982974ef2764eb38ee164bdcf6e7c81ed6d974d050adb5
Instruction ID: f605701aac18f7341a4f6d0a7a0632720f1926d26355c58c76dc69f0f759f4d8
Opcode Fuzzy Hash: 67c9939c2680629b9c982974ef2764eb38ee164bdcf6e7c81ed6d974d050adb5
Instruction Fuzzy Hash: 4221CD7A604204AFEB00DF6DED84EAA37E9FFC8310B110159FE09C725AE631DA009B54

Function 009209B8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 70timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 00920A25
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00920A37
SetFileTime.KERNEL32(?,?,?,?), ref: 00920A4A
CloseHandle.KERNEL32(000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00920616,?,?), ref: 00920A59

Strings

cabextract.cpp, xrefs: 009209F4
Invalid operation for this state., xrefs: 009209FE

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Time$File$CloseDateHandleLocal
String ID: Invalid operation for this state.$cabextract.cpp
API String ID: 609741386-1751360545
Opcode ID: 0e7e0d2930f9e6aa8c50463249534a5821d227e823ea6f058e7dc7ba8ff08a57
Instruction ID: 568f11f76cf09c3659566eda8efc43d13ab496597cadbe0076d7c19324a6abd0
Opcode Fuzzy Hash: 0e7e0d2930f9e6aa8c50463249534a5821d227e823ea6f058e7dc7ba8ff08a57
Instruction Fuzzy Hash: 12210572814229AB8B10CF6CEC4CDAABBBCFF44720B404216F864D65D5D770DA11CBD0

Function 0091444C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 009038D4: GetProcessHeap.KERNEL32(?,000001C7,?,00902284,000001C7,00000001,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 009038E5
Part of subcall function 009038D4: RtlAllocateHeap.NTDLL(00000000,?,00902284,000001C7,00000001,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 009038EC

_memcpy_s.LIBCMT ref: 0091449E
_memcpy_s.LIBCMT ref: 009144B1
_memcpy_s.LIBCMT ref: 009144CC

Strings

Failed to allocate memory for message., xrefs: 00914487
feclient.dll, xrefs: 00914466, 0091449C
pipe.cpp, xrefs: 0091447D

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: _memcpy_s$Heap$AllocateProcess
String ID: Failed to allocate memory for message.$feclient.dll$pipe.cpp
API String ID: 886498622-766083570
Opcode ID: 2e3e4820daabf13a449ede1571bc98d778ba7249a38b44ed3189d8e7e01735bd
Instruction ID: 516b612eecf942726b23a993794e102bc72ff214523fab5e0b744c1367fda445
Opcode Fuzzy Hash: 2e3e4820daabf13a449ede1571bc98d778ba7249a38b44ed3189d8e7e01735bd
Instruction Fuzzy Hash: C31191B260031DABDB01DF91DC82EDBB3ACEF98714B00442AFA049B151E774DA64C7E0

Function 00943B4A Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 00943B98
GetLastError.KERNEL32(?,?,00000000), ref: 00943BA2
CloseHandle.KERNEL32(?,?,?,00000000), ref: 00943BD5

Strings

PDu, xrefs: 00943B98
<, xrefs: 00943B8A
shelutil.cpp, xrefs: 00943BC3

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CloseErrorExecuteHandleLastShell
String ID: <$PDu$shelutil.cpp
API String ID: 3023784893-2418939910
Opcode ID: 1448814cc32e80e8cc3cabbee867f64c1e39aadc60dd145f45401e31dac73d94
Instruction ID: 43af59e4d8fdf68cbb6c3e8d4b2198a4c13f2f2aefa058fc90326e2b6af0e6ef
Opcode Fuzzy Hash: 1448814cc32e80e8cc3cabbee867f64c1e39aadc60dd145f45401e31dac73d94
Instruction Fuzzy Hash: 5D11E7B5E01218AFDB50DFA9D845A9EBBF8EF08750F10812AFD05E7350E7349A00CBA4

Function 00949555 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

Strings

KERNEL32.DLL, xrefs: 0094956F
AcquireSRWLockExclusive, xrefs: 00949584
ReleaseSRWLockExclusive, xrefs: 00949594

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID:
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 0-1718035505
Opcode ID: 98c09376ddef2c16fa9dd2d7eb049d0271fbe0f32508d934baebc689d1994a0e
Instruction ID: 6b223c78fe9cfb07379a1f54c164db4386f8685381b9ecad3eafc182e21281bf
Opcode Fuzzy Hash: 98c09376ddef2c16fa9dd2d7eb049d0271fbe0f32508d934baebc689d1994a0e
Instruction Fuzzy Hash: 7101C2B53662225B4F339E755CA4DAB27CC9B82756330453AFD11C3280E762CC95E7E0

Function 009409BB Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00905D8F,00000000), ref: 009409CF
GetProcAddress.KERNEL32(00000000), ref: 009409D6
GetLastError.KERNEL32(?,?,?,00905D8F,00000000), ref: 009409ED

Strings

kernel32, xrefs: 009409C7
procutil.cpp, xrefs: 00940A0E
IsWow64Process, xrefs: 009409C0

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: IsWow64Process$kernel32$procutil.cpp
API String ID: 4275029093-1586155540
Opcode ID: 2a9394fe580360f0738923d310ce19080a84560dc3d1941dcc18c00f407fee81
Instruction ID: e2dd445b7b997600af03b48b03f5b2842aa4f862c3bc7a3ce75d92ea54d57520
Opcode Fuzzy Hash: 2a9394fe580360f0738923d310ce19080a84560dc3d1941dcc18c00f407fee81
Instruction Fuzzy Hash: AEF04F76A14325ABD720ABA59D09E6BBBA8EF45751B008115BD05E7280E774DE00D7E0

Function 0093A059 Relevance: 9.2, APIs: 6, Instructions: 216COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00933382,00933382,?,?,?,0093A2AA,00000001,00000001,E3E85006), ref: 0093A0B3
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0093A2AA,00000001,00000001,E3E85006,?,?,?), ref: 0093A139
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,E3E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0093A233
__freea.LIBCMT ref: 0093A240

Part of subcall function 00935154: HeapAlloc.KERNEL32(00000000,?,?,?,00931E90,?,0000015D,?,?,?,?,009332E9,000000FF,00000000,?,?), ref: 00935186

__freea.LIBCMT ref: 0093A249
__freea.LIBCMT ref: 0093A26E

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocHeap
String ID:
API String ID: 3147120248-0
Opcode ID: da282e6e4849b5f3b27407b516f6c066839add5283658c823a5fc9b57ede554a
Instruction ID: b68970e5fca9d137062d3e321237008e274fcbf4a8c12ced9a62433805660e76
Opcode Fuzzy Hash: da282e6e4849b5f3b27407b516f6c066839add5283658c823a5fc9b57ede554a
Instruction Fuzzy Hash: 6D511372610206AFDB258FA4CC81FBB77AEEB85760F154628FC64E6190EB75DC40CE51

Function 0091F6B8 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 138COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0091F6D0
LeaveCriticalSection.KERNEL32(?,?), ref: 0091F81D

Strings

Failed to set update bundle., xrefs: 0091F7F3
Failed to default local update source, xrefs: 0091F742
update\%ls, xrefs: 0091F72E
Failed to recreate command-line for update bundle., xrefs: 0091F79C

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to default local update source$Failed to recreate command-line for update bundle.$Failed to set update bundle.$update\%ls
API String ID: 3168844106-1266646976
Opcode ID: 261705b7034ffb0f4f085a18c1c6e11778faabfb50291dbeb8e51dd1a350915d
Instruction ID: 913c851a1e9460c9e925fe1367695d59688f34060553d9b9c579dcf1edcd84e4
Opcode Fuzzy Hash: 261705b7034ffb0f4f085a18c1c6e11778faabfb50291dbeb8e51dd1a350915d
Instruction Fuzzy Hash: 9B416A32A4021EEFDF128F94CC55EEAB7A9EF04354F0182B5F909A71A1D771ED909B90

Function 00918AA3 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 122sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0,00000000,00000000), ref: 00918B0F

Strings

Failed to get %hs package cache root directory., xrefs: 00918B70
per-user, xrefs: 00918B67, 00918BA8
Failed to get old %hs package cache root directory., xrefs: 00918BB1
per-machine, xrefs: 00918B62, 00918B6F, 00918BA3, 00918BB0
Failed to calculate cache path., xrefs: 00918ACC

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Sleep
String ID: Failed to calculate cache path.$Failed to get %hs package cache root directory.$Failed to get old %hs package cache root directory.$per-machine$per-user
API String ID: 3472027048-398165853
Opcode ID: f027e0f8ed4dda35a31a058fa17a386668abfc9abeb888f9f5fac93ac9e5df48
Instruction ID: 0c05c9aa6c4de6d3852deaddfc2537db28af2f126bd1fcaf0190f474357e7bff
Opcode Fuzzy Hash: f027e0f8ed4dda35a31a058fa17a386668abfc9abeb888f9f5fac93ac9e5df48
Instruction Fuzzy Hash: F93158B2B8821DBBEB21AA608C47FFFB66CDF80715F414029FD05E7181DB748D8066A1

Function 0091E705 Relevance: 9.1, APIs: 6, Instructions: 85windowCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000082,?,?), ref: 0091E734
SetWindowLongW.USER32(?,000000EB,00000000), ref: 0091E743
SetWindowLongW.USER32(?,000000EB,?), ref: 0091E757
DefWindowProcW.USER32(?,?,?,?), ref: 0091E767
GetWindowLongW.USER32(?,000000EB), ref: 0091E781
PostQuitMessage.USER32(00000000), ref: 0091E7DE

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Window$Long$Proc$MessagePostQuit
String ID:
API String ID: 3812958022-0
Opcode ID: 35e712e820723167bcc4c7199f6906ef509d2c2c8508d67e1438c120950b1a09
Instruction ID: 7b60f40a4094ebac2abd601dd7f7586b304e1128a6ababea7cacbbb6ff528404
Opcode Fuzzy Hash: 35e712e820723167bcc4c7199f6906ef509d2c2c8508d67e1438c120950b1a09
Instruction Fuzzy Hash: 6121A13621811CBFEB115FA4DD49EAA3BA9FF45750F148514FD0AAA1A0C731DD50EB60

Function 0091C59C Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 163synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32(?), ref: 0091C5E4
CloseHandle.KERNEL32(?), ref: 0091C5EC

Strings

Failed to save state., xrefs: 0091C661
Unexpected elevated message sent to child process, msg: %u, xrefs: 0091C794
elevation.cpp, xrefs: 0091C788

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CloseHandleMutexRelease
String ID: Failed to save state.$Unexpected elevated message sent to child process, msg: %u$elevation.cpp
API String ID: 4207627910-1576875097
Opcode ID: bd9d7ecaaa1d211004938b728795abf09ffe96ab1e6805ba644ebda6a38c0673
Instruction ID: 34eb3f2a78c639219e0413f950306cc7fc60a36df52c6a70b46b6b033fd37941
Opcode Fuzzy Hash: bd9d7ecaaa1d211004938b728795abf09ffe96ab1e6805ba644ebda6a38c0673
Instruction Fuzzy Hash: FD61077A240608EFCB125F94CD45D96BBF2FF48314711C958FAA95A672C732E960EF40

Function 009410C5 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 149registrystringCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,000002C0,00000000,000002C0,00000000,00000000,000002C0,BundleUpgradeCode,00000410,000002C0,00000000,00000000,00000000,00000100,00000000), ref: 009410ED
RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,?,?,?,?,00916EF3,00000100,000000B0,00000088,00000410,000002C0), ref: 00941126
lstrlenW.KERNEL32(?,?,?,00000000,?,-00000001,00000004,00000000), ref: 0094121A

Strings

BundleUpgradeCode, xrefs: 009410CC
regutil.cpp, xrefs: 00941161

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: QueryValue$lstrlen
String ID: BundleUpgradeCode$regutil.cpp
API String ID: 3790715954-1648651458
Opcode ID: 3e009bbb6109219d4897e32d3df73112fddd99200da9be37e8a484d91a8ab194
Instruction ID: 7a73d921035b5ea720494866f94a190ab706b2dd77368d6ae7b6ade1f4dbe7b1
Opcode Fuzzy Hash: 3e009bbb6109219d4897e32d3df73112fddd99200da9be37e8a484d91a8ab194
Instruction Fuzzy Hash: CD41B531A0421EEFDB25CFA5C884EAEB7B9EF48720F114169ED15EB210D770DD418B90

Function 009461FA Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009447D3: SetFilePointerEx.KERNELBASE(?,?,?,?,?,00000000,?,?,?,00918564,00000000,00000000,00000000,00000000,00000000), ref: 009447EB
Part of subcall function 009447D3: GetLastError.KERNEL32(?,?,?,00918564,00000000,00000000,00000000,00000000,00000000), ref: 009447F5

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,00945AC5,?,?,?,?,?,?,?,00010000,?), ref: 00946263
WriteFile.KERNEL32(000000FF,00000008,00000008,?,00000000,000000FF,00000000,00000000,00000000,00000000,?,00945AC5,?,?,?,?), ref: 009462B5
GetLastError.KERNEL32(?,00945AC5,?,?,?,?,?,?,?,00010000,?,00000001,?,GET,?,?), ref: 009462FB
GetLastError.KERNEL32(?,00945AC5,?,?,?,?,?,?,?,00010000,?,00000001,?,GET,?,?), ref: 00946321

Strings

dlutil.cpp, xrefs: 00946345

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorFileLast$Write$Pointer
String ID: dlutil.cpp
API String ID: 133221148-2067379296
Opcode ID: 88496a806fa5436d2f2dda43a7793a13d024b08835e465b0b95f47ac0598a1db
Instruction ID: 315725510a7d8ab7163b9e855bdeb98b7ba2dbd73e1a0a079254605b7b142e6a
Opcode Fuzzy Hash: 88496a806fa5436d2f2dda43a7793a13d024b08835e465b0b95f47ac0598a1db
Instruction Fuzzy Hash: 84415BB2A10219BFEF218EA8CD44FAA7BA8FF05351F150229FD14E6090D775DD60DBA1

Function 00902436 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,0093FEE7,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0093FEE7,?,00000000,00000000), ref: 0090247C
GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0093FEE7,?,00000000,00000000,0000FDE9), ref: 00902488

Part of subcall function 00903B51: GetProcessHeap.KERNEL32(00000000,000001C7,?,009021DC,000001C7,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 00903B59
Part of subcall function 00903B51: HeapSize.KERNEL32(00000000,?,009021DC,000001C7,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 00903B60

Strings

strutil.cpp, xrefs: 009024AC

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Heap$ByteCharErrorLastMultiProcessSizeWide
String ID: strutil.cpp
API String ID: 3662877508-3612885251
Opcode ID: aedfb742f6ae3231a06726dddbad900fbaeed0e616f3058952dcc8a0d338b4bf
Instruction ID: b1d0365b936b81c8d6743a886558bcf7cbfe503aebac2002fe7bbd62e54d5b19
Opcode Fuzzy Hash: aedfb742f6ae3231a06726dddbad900fbaeed0e616f3058952dcc8a0d338b4bf
Instruction Fuzzy Hash: 6531A271304219AFEB119F798CC8ABA73DDEB84768B10862AFD15DB1E0EB75CC409764

Function 0092AAE8 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 107COMMON

Download Yara Rule

Strings

Failed to extract all payloads from container: %ls, xrefs: 0092AB9C
Failed to skip the extraction of payload: %ls from container: %ls, xrefs: 0092ABEF
Failed to open container: %ls., xrefs: 0092AB2A
Failed to extract payload: %ls from container: %ls, xrefs: 0092ABE3

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CreateErrorFileLast
String ID: Failed to extract all payloads from container: %ls$Failed to extract payload: %ls from container: %ls$Failed to open container: %ls.$Failed to skip the extraction of payload: %ls from container: %ls
API String ID: 1214770103-3891707333
Opcode ID: b84dd6e2c2b96b9a9d914332ac22297838aa4fe2f60a0130b06b3a573e0338da
Instruction ID: 2e8ce0a2c7e715740d8e581ae6c50a04610303b59cd0ba4d0a9ca38a61b74a32
Opcode Fuzzy Hash: b84dd6e2c2b96b9a9d914332ac22297838aa4fe2f60a0130b06b3a573e0338da
Instruction Fuzzy Hash: B931F233C04229BBCF119AE4DC82F8E7779AF48711F200625FE11B61A5E735DA54DBA1

Function 009440C8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

MoveFileExW.KERNEL32(00000003,00000001,00000000,00000000,00000101,?,00944203,00000003,00000001,00000001,000007D0,00000003,00000000,?,00919E5F,00000000), ref: 009440ED
GetLastError.KERNEL32(00000001,?,00944203,00000003,00000001,00000001,000007D0,00000003,00000000,?,00919E5F,00000000,000007D0,00000001,00000001,00000003), ref: 009440FC
MoveFileExW.KERNEL32(00000003,00000001,000007D0,00000001,00000000,?,00944203,00000003,00000001,00000001,000007D0,00000003,00000000,?,00919E5F,00000000), ref: 0094417F
GetLastError.KERNEL32(?,00944203,00000003,00000001,00000001,000007D0,00000003,00000000,?,00919E5F,00000000,000007D0,00000001,00000001,00000003,000007D0), ref: 00944189

Strings

fileutil.cpp, xrefs: 009441A7

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorFileLastMove
String ID: fileutil.cpp
API String ID: 55378915-2967768451
Opcode ID: c7408bdc8dd56324bce14c3d28dec5c89fae07c84eec64cbcf144a5f07df0019
Instruction ID: 36584b8885490b18a18dcd54269a00719ac6bf28a32bbfc98a7cb832c9532e00
Opcode Fuzzy Hash: c7408bdc8dd56324bce14c3d28dec5c89fae07c84eec64cbcf144a5f07df0019
Instruction Fuzzy Hash: 4A21F6366487369BEB211E648C91F7F769DEFB97A1F024126FD05A7190DB30CC9192E0

Function 00944212 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 95registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00944315: FindFirstFileW.KERNEL32(00928FFA,?,000002C0,00000000,00000000), ref: 00944350
Part of subcall function 00944315: FindClose.KERNEL32(00000000), ref: 0094435C

RegCloseKey.ADVAPI32(?,00000000,?,00000000,?,00000000,?,00000000,?,wininet.dll), ref: 00944305

Part of subcall function 00940E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,00945699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 00940E52

Part of subcall function 009410C5: RegQueryValueExW.ADVAPI32(00000000,000002C0,00000000,000002C0,00000000,00000000,000002C0,BundleUpgradeCode,00000410,000002C0,00000000,00000000,00000000,00000100,00000000), ref: 009410ED
Part of subcall function 009410C5: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,?,?,?,?,00916EF3,00000100,000000B0,00000088,00000410,000002C0), ref: 00941126

Strings

\, xrefs: 0094428E
PendingFileRenameOperations, xrefs: 00944270
crypt32.dll, xrefs: 0094423D
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00944244

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CloseFindQueryValue$FileFirstOpen
String ID: PendingFileRenameOperations$SYSTEM\CurrentControlSet\Control\Session Manager$\$crypt32.dll
API String ID: 3397690329-3978359083
Opcode ID: 41d9a6fe8d374fc8b90863c9204b8a545e8e237db09cccdb48300f5f8a5c4f6a
Instruction ID: e3a3ae4120c90f20197d6db0437e4a30336c0860fccb4efbcb925cd3c0bc7c99
Opcode Fuzzy Hash: 41d9a6fe8d374fc8b90863c9204b8a545e8e237db09cccdb48300f5f8a5c4f6a
Instruction Fuzzy Hash: FF31EE35A00209ABDF20AFD1CC41FAEBBBDEF00750F24817AF920A6151D7B18A80CB50

Function 0090EEF9 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 92registryCOMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,00000001,000000FF,?,000000FF,00000001,PackageVersion,00000001,?,009104CB,00000001,00000001,00000001,009104CB,00000000), ref: 0090EF70
RegCloseKey.ADVAPI32(00000000,00000001,PackageVersion,00000001,?,009104CB,00000001,00000001,00000001,009104CB,00000000,00000001,00000002,009104CB,00000001), ref: 0090EF87

Strings

PackageVersion, xrefs: 0090EF51
Failed to format key for update registration., xrefs: 0090EF26
Failed to remove update registration key: %ls, xrefs: 0090EFB4

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CloseCompareString
String ID: Failed to format key for update registration.$Failed to remove update registration key: %ls$PackageVersion
API String ID: 446873843-3222553582
Opcode ID: 933cca8808176925e4e3d8be4d83507a391b65c2369f2efdccf11bb848e1499c
Instruction ID: cf804a9f9890a9268970192f034d15416ae4ac28572384b8098b34f03829c5a0
Opcode Fuzzy Hash: 933cca8808176925e4e3d8be4d83507a391b65c2369f2efdccf11bb848e1499c
Instruction Fuzzy Hash: C721E132A05219BFCB21DBA5CD45F9FBBB8EF84721F214579FA04A61A0D7309E409790

Function 0090EE0F Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 88COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 0090EE4A

Part of subcall function 00944038: SetFileAttributesW.KERNEL32(00928FFA,00000080,00000000,00928FFA,000000FF,00000000,?,?,00928FFA), ref: 00944067
Part of subcall function 00944038: GetLastError.KERNEL32(?,?,00928FFA), ref: 00944071

Part of subcall function 00903B6A: RemoveDirectoryW.KERNEL32(00000001,00000000,00000000,00000000,?,?,0090EE95,00000001,00000000,00000095,00000001,009104DA,00000095,00000000,swidtag,00000001), ref: 00903B87

Strings

swidtag, xrefs: 0090EE59
Failed to format tag folder path., xrefs: 0090EEB7
Failed to allocate regid file path., xrefs: 0090EEA9
Failed to allocate regid folder path., xrefs: 0090EEB0

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: AttributesDirectoryErrorFileLastOpen@16Remove
String ID: Failed to allocate regid file path.$Failed to allocate regid folder path.$Failed to format tag folder path.$swidtag
API String ID: 1428973842-4170906717
Opcode ID: 127f105a89508b3ef2f1ecd4b83cf3b341215688813c3974d9460209a2caa386
Instruction ID: 295cef7e014eff7ba81e6b4631e92162bc05b350151d9d0440d6585807f11905
Opcode Fuzzy Hash: 127f105a89508b3ef2f1ecd4b83cf3b341215688813c3974d9460209a2caa386
Instruction Fuzzy Hash: 94214932D00518FFCB15EB99C841B9EBBB9EF84710F14C4AAF914AA2A1D7319E509B50

Function 00928B73 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 86registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00940E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,00945699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 00940E52

CompareStringW.KERNEL32(00000000,00000001,00000000,000000FF,?,000000FF,00000000,00000000,00000000,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,00000000,00000100,00000100,000001B4), ref: 00928BF7
RegCloseKey.ADVAPI32(00000000,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,00000000,00000100,00000100,000001B4,?,?,?,0090F66B,00000001,00000100,000001B4,00000000), ref: 00928C45

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00928B94
Failed to open uninstall registry key., xrefs: 00928BBA
Failed to enumerate uninstall key for related bundles., xrefs: 00928C56

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CloseCompareOpenString
String ID: Failed to enumerate uninstall key for related bundles.$Failed to open uninstall registry key.$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 2817536665-2531018330
Opcode ID: f50eb8c5b3b326ac1fc0ed5413afecc4d9a21898e16cbd9fe76ca6cf7c19f520
Instruction ID: 1866e0e13dc1896b7ff111a5f36104a9ac69a7843cc5571a8b04a3cc83b1239f
Opcode Fuzzy Hash: f50eb8c5b3b326ac1fc0ed5413afecc4d9a21898e16cbd9fe76ca6cf7c19f520
Instruction Fuzzy Hash: 0C21E732902128FFDB15ABA0DC45FAFBB7DEB44325F244564F91076094CB354E90E790

Function 00943F04 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(00000000,00904CB6,00000000,?,?,00000000,?,00944012,00000000,00904CB6,00000000,00000000,?,009183E2,?,?), ref: 00943F1E
GetLastError.KERNEL32(?,00944012,00000000,00904CB6,00000000,00000000,?,009183E2,?,?,00000001,00000003,000007D0,?,?,?), ref: 00943F2C
CopyFileW.KERNEL32(00000000,00904CB6,00000000,00904CB6,00000000,?,00944012,00000000,00904CB6,00000000,00000000,?,009183E2,?,?,00000001), ref: 00943F92
GetLastError.KERNEL32(?,00944012,00000000,00904CB6,00000000,00000000,?,009183E2,?,?,00000001,00000003,000007D0,?,?,?), ref: 00943F9C

Strings

fileutil.cpp, xrefs: 00943FBA

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CopyErrorFileLast
String ID: fileutil.cpp
API String ID: 374144340-2967768451
Opcode ID: 0ce232e8addfc5a99d9f947bb5c0709738c5e53a3d3572b0e2cdfa58aeb3dc1e
Instruction ID: e43d3b1043c485f1fc5fe8c3fa97a9fe2d05a13cd1bef9040964bc5f24f79be2
Opcode Fuzzy Hash: 0ce232e8addfc5a99d9f947bb5c0709738c5e53a3d3572b0e2cdfa58aeb3dc1e
Instruction Fuzzy Hash: 1921F63AE246369AFB301E754C44F7B76BCEF50BA0B128166FD05DB150D720CE0592E1

Function 009431C7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 009431DD
SysAllocString.OLEAUT32(?), ref: 009431F9
VariantClear.OLEAUT32(?), ref: 00943280
SysFreeString.OLEAUT32(00000000), ref: 0094328B

Strings

xmlutil.cpp, xrefs: 00943210

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: xmlutil.cpp
API String ID: 760788290-1270936966
Opcode ID: 1bbde7de20e0b59d8b6e3d054933ffadddb9b579328106c81beb7b38d1882422
Instruction ID: 800651f4cdc53dee7669c3623e62b80fb9745fac418e75a3a7c3c682035eb07e
Opcode Fuzzy Hash: 1bbde7de20e0b59d8b6e3d054933ffadddb9b579328106c81beb7b38d1882422
Instruction Fuzzy Hash: 5D21A335901219EFCB14DFB8C848EAE7BB9AF84760F158158F915AB210DB71DE00DB90

Function 0092D047 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 80synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 009038D4: GetProcessHeap.KERNEL32(?,000001C7,?,00902284,000001C7,00000001,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 009038E5
Part of subcall function 009038D4: RtlAllocateHeap.NTDLL(00000000,?,00902284,000001C7,00000001,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 009038EC

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0092D0DC
ReleaseMutex.KERNEL32(?), ref: 0092D10A
SetEvent.KERNEL32(?), ref: 0092D113

Strings

NetFxChainer.cpp, xrefs: 0092D081
Failed to allocate buffer., xrefs: 0092D08B

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Heap$AllocateEventMutexObjectProcessReleaseSingleWait
String ID: Failed to allocate buffer.$NetFxChainer.cpp
API String ID: 944053411-3611226795
Opcode ID: 7c70b42dbaccf9e477c8b5c3112f00f675dcda75b1983b3212fd9e5726d5713e
Instruction ID: 27b8c4f0a9b97b0887566725973a9d0befb0948925b724946f88da8417211551
Opcode Fuzzy Hash: 7c70b42dbaccf9e477c8b5c3112f00f675dcda75b1983b3212fd9e5726d5713e
Instruction Fuzzy Hash: C721A1B4A0431ABFDB109F68D884E99B7F9FF48314F108669F924A73A1C775E950CB90

Function 009457BF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

QueryServiceConfigW.ADVAPI32(00000000,00000000,00000000,?,00000001,00000000,?,?,009268CE,00000000,?), ref: 009457D5
GetLastError.KERNEL32(?,?,009268CE,00000000,?,?,?,?,?,?,?,?,?,00926CE1,?,?), ref: 009457E3

Part of subcall function 009038D4: GetProcessHeap.KERNEL32(?,000001C7,?,00902284,000001C7,00000001,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 009038E5
Part of subcall function 009038D4: RtlAllocateHeap.NTDLL(00000000,?,00902284,000001C7,00000001,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 009038EC

QueryServiceConfigW.ADVAPI32(00000000,00000000,?,?,?,00000001,?,?,009268CE,00000000,?), ref: 0094581D
GetLastError.KERNEL32(?,?,009268CE,00000000,?,?,?,?,?,?,?,?,?,00926CE1,?,?), ref: 00945827

Strings

svcutil.cpp, xrefs: 00945806, 00945848

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ConfigErrorHeapLastQueryService$AllocateProcess
String ID: svcutil.cpp
API String ID: 355237494-1746323212
Opcode ID: fc06cbec54c37b9df6c6b4f043a7c960a2566a35b184591c3b7a8c879a106d46
Instruction ID: b475d405ae5c9ae81b27fb2fe80e07e50fc9fac65b5d364a1a571486a59a37fb
Opcode Fuzzy Hash: fc06cbec54c37b9df6c6b4f043a7c960a2566a35b184591c3b7a8c879a106d46
Instruction Fuzzy Hash: CE21E736A40624BFE7209AEA8D04FAB7AECDF55790F124115FD04EB251DB75CD00D6E0

Function 009096F4 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 00909783

Strings

Failed to parse condition '%ls' at position: %u, xrefs: 00909735
Failed to read next symbol., xrefs: 0090979F
Failed to find variable., xrefs: 00909770
condition.cpp, xrefs: 00909725, 00909766

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: _memcpy_s
String ID: Failed to find variable.$Failed to parse condition '%ls' at position: %u$Failed to read next symbol.$condition.cpp
API String ID: 2001391462-1605196437
Opcode ID: 8a45f9360c37bac585551ffe0cc9cbe06864948542b20794c6c0fb1eab2ddd2f
Instruction ID: c891a2126dd73ac37f9483de1252d6b3907bf3b6e695f968048f4aa8ce628be1
Opcode Fuzzy Hash: 8a45f9360c37bac585551ffe0cc9cbe06864948542b20794c6c0fb1eab2ddd2f
Instruction Fuzzy Hash: FC1136376902207FDB253D6CDC86F9B3A58EBC5724F044024FA086E6D3C6A2C95082E1

Function 00909D03 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 68COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00909D25

Strings

Failed to format path string., xrefs: 00909D30
Failed to set variable., xrefs: 00909D84
Failed get file version., xrefs: 00909D65
File search: %ls, did not find path: %ls, xrefs: 00909D90

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Open@16
String ID: Failed get file version.$Failed to format path string.$Failed to set variable.$File search: %ls, did not find path: %ls
API String ID: 3613110473-2458530209
Opcode ID: 0a9923054b036bc9ee57785ea80ccabe442f06e862d46d35b15d4db73ee09335
Instruction ID: 94e98b55c10c5791722d1f65b0209cd4f98f6c0b7fb65b9d0b65649582486cbd
Opcode Fuzzy Hash: 0a9923054b036bc9ee57785ea80ccabe442f06e862d46d35b15d4db73ee09335
Instruction Fuzzy Hash: 0C11D036D8012DBFCF126E94CC82DAEFB7DEF44724F104266F904A6192D2365E20ABD0

Function 00914880 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 67fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,009151A4), ref: 009148CC

Strings

Failed to write message type to pipe., xrefs: 0091490E
Failed to allocate message to write., xrefs: 009148AB
pipe.cpp, xrefs: 00914904

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: FileWrite
String ID: Failed to allocate message to write.$Failed to write message type to pipe.$pipe.cpp
API String ID: 3934441357-1996674626
Opcode ID: cc808fff260b770709c1b7867c6424338b12cbad2893905d71d3d07a33c8b441
Instruction ID: 71efe0d57a09ee623cf52e92f6242c97b911a70d81e6fd1a2c895fcd479bced1
Opcode Fuzzy Hash: cc808fff260b770709c1b7867c6424338b12cbad2893905d71d3d07a33c8b441
Instruction Fuzzy Hash: 39115972A00219BAEB21DF95DD09FDF7BE9EB88751F114166FC00A2150D7709E90EAA1

Function 00918003 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 009038D4: GetProcessHeap.KERNEL32(?,000001C7,?,00902284,000001C7,00000001,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 009038E5
Part of subcall function 009038D4: RtlAllocateHeap.NTDLL(00000000,?,00902284,000001C7,00000001,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 009038EC

CreateWellKnownSid.ADVAPI32(00000000,00000000,00000000,00000000,00000044,00000001,00000000,00000000,?,?,00918C10,0000001A,00000000,?,00000000,00000000), ref: 0091804C
GetLastError.KERNEL32(?,?,00918C10,0000001A,00000000,?,00000000,00000000,?,?,00000000,00000000,?,?,-00000004,00000000), ref: 00918056

Strings

Failed to create well known SID., xrefs: 00918084
cache.cpp, xrefs: 0091802A, 0091807A
Failed to allocate memory for well known SID., xrefs: 00918034

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Heap$AllocateCreateErrorKnownLastProcessWell
String ID: Failed to allocate memory for well known SID.$Failed to create well known SID.$cache.cpp
API String ID: 2186923214-2110050797
Opcode ID: 3a42902d6edf6b32c7f1a348c703bcdbc063da7c9e8baab18fbf9738ef7993ee
Instruction ID: 5edfcf34b09274ee274e403c4b414918dd96707d8a3c202bcf707ddc6177613f
Opcode Fuzzy Hash: 3a42902d6edf6b32c7f1a348c703bcdbc063da7c9e8baab18fbf9738ef7993ee
Instruction Fuzzy Hash: F5016F767543187EE720A66A5C06FDB7B9CCFC5B61F11401AFD04E7180EE748E45A2E0

Function 0092DB67 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 64windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000003E8,000004FF), ref: 0092DB95
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0092DBBF
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,0092DD8F,00000000,?,?,?,00000001,00000000), ref: 0092DBC7

Strings

Failed while waiting for download., xrefs: 0092DBF5
bitsengine.cpp, xrefs: 0092DBEB

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorLastMessageMultipleObjectsPeekWait
String ID: Failed while waiting for download.$bitsengine.cpp
API String ID: 435350009-228655868
Opcode ID: f7a0587c5902623a39e3c2046ed3785ab7412a96ff7f22419f6bb6187b9b5b10
Instruction ID: 911221db57b3538cc7e640bee8456c22b247358e8facc8c9d3866ac6677338a3
Opcode Fuzzy Hash: f7a0587c5902623a39e3c2046ed3785ab7412a96ff7f22419f6bb6187b9b5b10
Instruction Fuzzy Hash: AF110833B463357BE7209AB9AC49EEB7BACEB45720F010125FE04E61C8D6649E0095E4

Function 00905E0B Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32(?,00000010), ref: 00905E39
GetLastError.KERNEL32 ref: 00905E43

Strings

variable.cpp, xrefs: 00905E67
Failed to set variant value., xrefs: 00905E8A
Failed to get computer name., xrefs: 00905E71

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ComputerErrorLastName
String ID: Failed to get computer name.$Failed to set variant value.$variable.cpp
API String ID: 3560734967-484636765
Opcode ID: 02ed4446b0544f84bb1ddc80cff6bb0c0d81b92aaed5c8579c6c43c5f77d646a
Instruction ID: fade2abe217b79feae680c4f35bf0dbe6b7682e5632c2f2e2acdebedd7e6ec92
Opcode Fuzzy Hash: 02ed4446b0544f84bb1ddc80cff6bb0c0d81b92aaed5c8579c6c43c5f77d646a
Instruction Fuzzy Hash: B001A572A55628ABD710DAA4AC05FEF77E8EB89710F01411AFD05F7180DA74AE048AE5

Function 00909908 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 57COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 0090997F

Strings

Condition, xrefs: 0090991A
Failed to copy condition string from BSTR, xrefs: 00909969
Failed to select condition node., xrefs: 00909936
Failed to get Condition inner text., xrefs: 0090994F

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: FreeString
String ID: Condition$Failed to copy condition string from BSTR$Failed to get Condition inner text.$Failed to select condition node.
API String ID: 3341692771-3600577998
Opcode ID: 715904bf5b2c11a63cc3d69054bcbef00bd213a2fcc011e67dabb81098e0a82e
Instruction ID: 2d478876cc3b29851b51fda91247b2d0b48a62fd985e1e5b6b2ba12a6a4d3b18
Opcode Fuzzy Hash: 715904bf5b2c11a63cc3d69054bcbef00bd213a2fcc011e67dabb81098e0a82e
Instruction Fuzzy Hash: 8511A136D45228BFDB269BA0CD45FAEBB68AF40765F10415CF810BA291DB759E40E780

Function 00905D71 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 56COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?), ref: 00905D83

Part of subcall function 009409BB: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00905D8F,00000000), ref: 009409CF
Part of subcall function 009409BB: GetProcAddress.KERNEL32(00000000), ref: 009409D6
Part of subcall function 009409BB: GetLastError.KERNEL32(?,?,?,00905D8F,00000000), ref: 009409ED

Part of subcall function 00943BF7: SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 00943C24

Strings

variable.cpp, xrefs: 00905DAD
Failed to get 64-bit folder., xrefs: 00905DCD
Failed to get shell folder., xrefs: 00905DB7
Failed to set variant value., xrefs: 00905DE7

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: AddressCurrentErrorFolderHandleLastModulePathProcProcess
String ID: Failed to get 64-bit folder.$Failed to get shell folder.$Failed to set variant value.$variable.cpp
API String ID: 2084161155-3906113122
Opcode ID: e77afc4fcec6c2467eabf75bb7160c3f67a4ccd7531ba24f233ec6126d05ff37
Instruction ID: 510bfa9c1cade8c4f7f2f9ff3d44ee889af240b20db17cb3651bd32e774a02dd
Opcode Fuzzy Hash: e77afc4fcec6c2467eabf75bb7160c3f67a4ccd7531ba24f233ec6126d05ff37
Instruction Fuzzy Hash: 2701A131941628BFDF12A690CC0AF9F7A6CAB40764F128156F800BA1D1DBB49E409BA0

Function 00906644 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 55COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 0090667D
GetLastError.KERNEL32 ref: 00906687

Strings

variable.cpp, xrefs: 009066AB
Failed to get temp path., xrefs: 009066B5
Failed to set variant value., xrefs: 009066D1

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorLastPathTemp
String ID: Failed to get temp path.$Failed to set variant value.$variable.cpp
API String ID: 1238063741-2915113195
Opcode ID: 79d1f208ca1a4a1f3fd4399f958825228ce82d1a53074eedb1aa202b3dc8a561
Instruction ID: 5a078ef5c7617d7a9caae1cb32f64f4eefc09622f18c69575f28c21133ab554e
Opcode Fuzzy Hash: 79d1f208ca1a4a1f3fd4399f958825228ce82d1a53074eedb1aa202b3dc8a561
Instruction Fuzzy Hash: 2501F9B6E45338ABE720EB64AC06FAA739CEF44710F014169FD04F72C1EB619E0486D5

Function 00940917 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF,?,00000000,?,?,00904E16,?,000000FF,?,?,?,?,?,00000000,?,?), ref: 00940927
GetLastError.KERNEL32(?,?,00904E16,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?), ref: 00940935

Strings

procutil.cpp, xrefs: 00940959

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: procutil.cpp
API String ID: 1211598281-1178289305
Opcode ID: 81ee6ce909eb681c5531813b466215ba1eaf5e35542a977e2b04a3f67fbe28bc
Instruction ID: 4a2f259ad8b7c6e4e4c20414fbec7cf5de36ff306d5b82e9b4ab71109f5944d4
Opcode Fuzzy Hash: 81ee6ce909eb681c5531813b466215ba1eaf5e35542a977e2b04a3f67fbe28bc
Instruction Fuzzy Hash: A2118E36E00225EBEB209BA58C04FAB7BA8EB45360F114626FE15E7291D2748D00E6E5

Function 00944038 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 52fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00944315: FindFirstFileW.KERNEL32(00928FFA,?,000002C0,00000000,00000000), ref: 00944350
Part of subcall function 00944315: FindClose.KERNEL32(00000000), ref: 0094435C

SetFileAttributesW.KERNEL32(00928FFA,00000080,00000000,00928FFA,000000FF,00000000,?,?,00928FFA), ref: 00944067
GetLastError.KERNEL32(?,?,00928FFA), ref: 00944071
DeleteFileW.KERNEL32(00928FFA,00000000,00928FFA,000000FF,00000000,?,?,00928FFA), ref: 00944090
GetLastError.KERNEL32(?,?,00928FFA), ref: 0094409A

Strings

fileutil.cpp, xrefs: 009440B4

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: File$ErrorFindLast$AttributesCloseDeleteFirst
String ID: fileutil.cpp
API String ID: 3967264933-2967768451
Opcode ID: efece74d73ecb3dffbe687ffc7089bcf5d8427a5c2156b32ab4c46019a19e5ca
Instruction ID: 0bebcda301b18de67a7d9c58c44de950585161ea6c67378f9c2da4fcb0c6e088
Opcode Fuzzy Hash: efece74d73ecb3dffbe687ffc7089bcf5d8427a5c2156b32ab4c46019a19e5ca
Instruction Fuzzy Hash: 5D019E31A05729A7D7316AB98D08F5B7BDCAF057A1F004325FE05E6090D721CE10A5E6

Function 0092D7CC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0092D7E1
LeaveCriticalSection.KERNEL32(?), ref: 0092D826
SetEvent.KERNEL32(?,?,?,?), ref: 0092D83A

Strings

Failure while sending progress during BITS job modification., xrefs: 0092D815
Failed to get state during job modification., xrefs: 0092D7FA

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave
String ID: Failed to get state during job modification.$Failure while sending progress during BITS job modification.
API String ID: 3094578987-1258544340
Opcode ID: 7214bccb00b699eff511a1ffd59106e9972dee6ad2c97246ff13b7a0775104b7
Instruction ID: 5b63e32a128931f0461b805804de5d641ec1cf40e7b9c10d0c1be7e433058649
Opcode Fuzzy Hash: 7214bccb00b699eff511a1ffd59106e9972dee6ad2c97246ff13b7a0775104b7
Instruction Fuzzy Hash: 3F019236506629ABCB019B55E889EAEB7ACFF49331B104119F804D7600D774ED049BD5

Function 0092DA45 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000008,?,00000000,00000000,00000000,?,0092DBB5), ref: 0092DA59
LeaveCriticalSection.KERNEL32(00000008,?,0092DBB5), ref: 0092DA9E
SetEvent.KERNEL32(?,?,0092DBB5), ref: 0092DAB2

Strings

Failure while sending progress., xrefs: 0092DA8D
Failed to get BITS job state., xrefs: 0092DA72

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave
String ID: Failed to get BITS job state.$Failure while sending progress.
API String ID: 3094578987-2876445054
Opcode ID: 5d2b15ff6e066a695f66fe6f06462e021f810ed74c33342bc84b4d00418a3e1e
Instruction ID: 2e0ec9d954446d115ee5c60f2fb96f0bb59fd7fce80e9d3ed03a9bdd258adb9c
Opcode Fuzzy Hash: 5d2b15ff6e066a695f66fe6f06462e021f810ed74c33342bc84b4d00418a3e1e
Instruction Fuzzy Hash: 20012476A0A625BFCB01DB59E849DAEB7ACFF98321B00021AF909D3210DB30ED00D7D4

Function 0092D5AF Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000008,00000000,00000000,?,0092DD19,?,?,?,?,?,00000001,00000000,?), ref: 0092D5C9
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,0092DD19,?,?,?,?,?,00000001,00000000,?), ref: 0092D5D4
GetLastError.KERNEL32(?,0092DD19,?,?,?,?,?,00000001,00000000,?), ref: 0092D5E1

Strings

bitsengine.cpp, xrefs: 0092D605
Failed to create BITS job complete event., xrefs: 0092D60F

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CreateCriticalErrorEventInitializeLastSection
String ID: Failed to create BITS job complete event.$bitsengine.cpp
API String ID: 3069647169-3441864216
Opcode ID: ac07ba8dafc88dc740472f8169086f061a97e5fafbb9e0dc2c243b76dc95980e
Instruction ID: d18f3b8fdcf285c5c9363cdeb7e9e1a495154497ca2a93968dd91caa2127e53a
Opcode Fuzzy Hash: ac07ba8dafc88dc740472f8169086f061a97e5fafbb9e0dc2c243b76dc95980e
Instruction Fuzzy Hash: 56015A76615726ABE3109B6AD845A87BBE8FF89760B004126F908D7640E7B0D810CBE4

Function 0090D39D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(000000D0,?,000000B8,00000000,?,00916E4B,000000B8,00000000,?,00000000,75C0B390), ref: 0090D3AC
InterlockedCompareExchange.KERNEL32(000000E8,00000001,00000000), ref: 0090D3BB
LeaveCriticalSection.KERNEL32(000000D0,?,00916E4B,000000B8,00000000,?,00000000,75C0B390), ref: 0090D3D0

Strings

Engine active cannot be changed because it was already in that state., xrefs: 0090D3F3
userexperience.cpp, xrefs: 0090D3E9

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CriticalSection$CompareEnterExchangeInterlockedLeave
String ID: Engine active cannot be changed because it was already in that state.$userexperience.cpp
API String ID: 3376869089-1544469594
Opcode ID: 70bc901aad14e38172d298e7100ec2d858ab58e1a86de560e3ffa6e13c659075
Instruction ID: 1eca6d061646f5da115188bb028eede8b8e2006eb0e698dcf9fb0813deb9d9eb
Opcode Fuzzy Hash: 70bc901aad14e38172d298e7100ec2d858ab58e1a86de560e3ffa6e13c659075
Instruction Fuzzy Hash: 7CF0AF763083086FD710AEAAAC84E9B77ACEBCA769700442ABA05C3180DB70F8058761

Function 00941B28 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(SRSetRestorePointW,srclient.dll), ref: 00941B53
GetLastError.KERNEL32(?,009048D4,00000001,?,?,0090444C,?,?,?,?,0090535E,?,?,?,?), ref: 00941B62

Strings

srputil.cpp, xrefs: 00941B83
SRSetRestorePointW, xrefs: 00941B48
srclient.dll, xrefs: 00941B31

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: SRSetRestorePointW$srclient.dll$srputil.cpp
API String ID: 199729137-398595594
Opcode ID: ac3bc9962776bfae3d6f77ad033f5ba720160240cd5a9e97b47aaf24975dedad
Instruction ID: 0f3d833259d62a3eb9d5aa86fc7ebe38f7fa81504b2e86e6d64550d186059e9e
Opcode Fuzzy Hash: ac3bc9962776bfae3d6f77ad033f5ba720160240cd5a9e97b47aaf24975dedad
Instruction Fuzzy Hash: 59F0F47BB946319BE73227B58C05F662998CB407A1F014236FC01E62A4FB64CCC0D6E5

Function 00934897 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00934848,00000000,?,009347E8,00000000,00967CF8,0000000C,0093493F,00000000,00000002), ref: 009348B7
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 009348CA
FreeLibrary.KERNEL32(00000000,?,?,?,00934848,00000000,?,009347E8,00000000,00967CF8,0000000C,0093493F,00000000,00000002), ref: 009348ED

Strings

CorExitProcess, xrefs: 009348C2
mscoree.dll, xrefs: 009348B0

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: d9024bf709ffc30fe4c8f0bbf5ac19f91d1fb72cec9147d659ac66204cc58353
Instruction ID: f976e40cac344daae2b27651abdcfe068489f01210753d90591a435adf4de1f8
Opcode Fuzzy Hash: d9024bf709ffc30fe4c8f0bbf5ac19f91d1fb72cec9147d659ac66204cc58353
Instruction Fuzzy Hash: B9F04434614218BBCB119FA4EC59BADBFB8EF45755F010169F805A2150DB709E40DB50

Function 0094937F Relevance: 7.6, APIs: 5, Instructions: 119registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00940E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,00945699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 00940E52

RegCloseKey.ADVAPI32(00000001,00000001,?,00000000,00000001,?,00000000,00000001,00000000,00020019,00000001,00000000,00000000,00020019,00000000,00000001), ref: 00949457
RegCloseKey.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000,00000001,?,00000000,00000001,00000000,00020019), ref: 00949492
RegCloseKey.ADVAPI32(00000001,00000001,00020019,00000000,00000000,00000000,00000000), ref: 009494AE
RegCloseKey.ADVAPI32(00000000,00000001,00020019,00000000,00000000,00000000,00000000), ref: 009494BB
RegCloseKey.ADVAPI32(00000000,00000001,00020019,00000000,00000000,00000000,00000000), ref: 009494C8

Part of subcall function 00940B49: RegCloseKey.ADVAPI32(00000000), ref: 00940CA0

Part of subcall function 00940E9B: RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00949444,00000001), ref: 00940EB3

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Close$InfoOpenQuery
String ID:
API String ID: 796878624-0
Opcode ID: 5dc3fb4786860175567a430e96c60f1318f7f07df9060ef0fd0593d4b80311a0
Instruction ID: 1e5eec389add7c540194498b8b05aaaceb08389fa6755a9acccde36db4cbd38d
Opcode Fuzzy Hash: 5dc3fb4786860175567a430e96c60f1318f7f07df9060ef0fd0593d4b80311a0
Instruction Fuzzy Hash: 53411976C0122DBFCF22AF95CD81DAEFB79EF44364B11426AEA0076121D7324E51AA90

Function 009088DE Relevance: 7.6, APIs: 5, Instructions: 118stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00000000,00000000,?,?,00908A9E,009095E7,?,009095E7,?,?,009095E7,?,?), ref: 009088FE
lstrlenW.KERNEL32(?,?,00000000,00000000,?,?,00908A9E,009095E7,?,009095E7,?,?,009095E7,?,?), ref: 00908906
CompareStringW.KERNEL32(0000007F,?,?,?,?,00000000,?,00000000,00000000,?,?,00908A9E,009095E7,?,009095E7,?), ref: 00908955
CompareStringW.KERNEL32(0000007F,?,?,00000000,?,00000000,?,00000000,00000000,?,?,00908A9E,009095E7,?,009095E7,?), ref: 009089B7
CompareStringW.KERNEL32(0000007F,?,?,00000000,?,00000000,?,00000000,00000000,?,?,00908A9E,009095E7,?,009095E7,?), ref: 009089E4

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CompareString$lstrlen
String ID:
API String ID: 1657112622-0
Opcode ID: 0c46c62a05b58f155752ad42be55c0e3cca590ce6276160cc414e926807cdf20
Instruction ID: 82fc946cc2ac2d98af7a25f407a4de65e6c47440980503fac47032b95205e991
Opcode Fuzzy Hash: 0c46c62a05b58f155752ad42be55c0e3cca590ce6276160cc414e926807cdf20
Instruction Fuzzy Hash: A931A336704108FFCF219F58CC84ABF3F6AEF89350F104416F9A997290C6358990DB92

Function 009021BC Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(8007139F,00000000,?,?,00000000,00000000,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 00902202
GetLastError.KERNEL32(?,00000000,00000000,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 0090220E

Part of subcall function 00903B51: GetProcessHeap.KERNEL32(00000000,000001C7,?,009021DC,000001C7,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 00903B59
Part of subcall function 00903B51: HeapSize.KERNEL32(00000000,?,009021DC,000001C7,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 00903B60

Strings

strutil.cpp, xrefs: 00902232

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Heap$ByteCharErrorLastMultiProcessSizeWide
String ID: strutil.cpp
API String ID: 3662877508-3612885251
Opcode ID: f86e8e1df64c73d91e2b7181ae79444d100ee2ac112ae4d74d483a47bdd1aae1
Instruction ID: cd49e6293daf80605d62e818b204c39b9c07ee62af585f3d4637104e12ac213b
Opcode Fuzzy Hash: f86e8e1df64c73d91e2b7181ae79444d100ee2ac112ae4d74d483a47bdd1aae1
Instruction Fuzzy Hash: 9431D832704216AFEB249BADCC48B6777D9EF45764B114225FD25DB2E4E630CC40D7A0

Function 0090738E Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(009052B5,WixBundleOriginalSource,?,?,0091A41D,009053B5,WixBundleOriginalSource,0090533D,0096AA90,?,00000000,0090533D,?,00917587,?,?), ref: 0090739A
LeaveCriticalSection.KERNEL32(009052B5,009052B5,00000000,00000000,?,?,0091A41D,009053B5,WixBundleOriginalSource,0090533D,0096AA90,?,00000000,0090533D,?,00917587), ref: 00907401

Strings

Failed to get value as string for variable: %ls, xrefs: 009073F0
Failed to get value of variable: %ls, xrefs: 009073D4
WixBundleOriginalSource, xrefs: 00907396

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as string for variable: %ls$Failed to get value of variable: %ls$WixBundleOriginalSource
API String ID: 3168844106-30613933
Opcode ID: f266975cd35102774d12e2056ebebe53f13e90a09eaeef524e80a08d8100ee92
Instruction ID: 2e5f9cc702e13d1a470dc1bd6986fa330cd80767ab9a5dc0476d6792ae951437
Opcode Fuzzy Hash: f266975cd35102774d12e2056ebebe53f13e90a09eaeef524e80a08d8100ee92
Instruction Fuzzy Hash: BE019E72D89128BFDF115E94EC05E9EBB68DB04774F108024FD04AA2A0D735AE20ABD0

Function 0092CEF5 Relevance: 7.5, APIs: 5, Instructions: 41fileCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,00000000,?,00000000,?,0092CEEB,00000000), ref: 0092CF10
CloseHandle.KERNEL32(00000000,00000000,?,00000000,?,0092CEEB,00000000), ref: 0092CF1C
CloseHandle.KERNEL32(0094B508,00000000,?,00000000,?,0092CEEB,00000000), ref: 0092CF29
CloseHandle.KERNEL32(00000000,00000000,?,00000000,?,0092CEEB,00000000), ref: 0092CF36
UnmapViewOfFile.KERNEL32(0094B4D8,00000000,?,0092CEEB,00000000), ref: 0092CF45

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CloseHandle$FileUnmapView
String ID:
API String ID: 260491571-0
Opcode ID: c2ca81e15df4cd141853764c7757801e57e02cc11f3838b5e07bc2e206c8d30f
Instruction ID: 1eea351524ad14f0caba0c9885165eb4c4bfb987739c85423e15fba135311fd2
Opcode Fuzzy Hash: c2ca81e15df4cd141853764c7757801e57e02cc11f3838b5e07bc2e206c8d30f
Instruction Fuzzy Hash: 1801FBB6404B25DFCB306F66ED9085AFBEEEF50711315C83ED2A652525C371A840DF50

Function 009479CC Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 009038D4: GetProcessHeap.KERNEL32(?,000001C7,?,00902284,000001C7,00000001,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 009038E5
Part of subcall function 009038D4: RtlAllocateHeap.NTDLL(00000000,?,00902284,000001C7,00000001,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 009038EC

SysFreeString.OLEAUT32(00000000), ref: 00947B2C
SysFreeString.OLEAUT32(00000000), ref: 00947B37
SysFreeString.OLEAUT32(00000000), ref: 00947B42

Strings

atomutil.cpp, xrefs: 009479FF

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: FreeString$Heap$AllocateProcess
String ID: atomutil.cpp
API String ID: 2724874077-4059165915
Opcode ID: 964a6b98bc4386aba9ad0f366335b268cad18f65b649a94b70695468c76d6af5
Instruction ID: 089795029bc78e1cfcc7c48a121562ab33ab98512de94ebd0a01ddea995ffa91
Opcode Fuzzy Hash: 964a6b98bc4386aba9ad0f366335b268cad18f65b649a94b70695468c76d6af5
Instruction Fuzzy Hash: AA512B71E0522EAFDB21DBA4C844FAEF7B8EF44754F1545A4E905AB250DB31EE00CBA0

Function 009485CB Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 137timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,00000000,00000000,clbcatq.dll,00000000,clbcatq.dll,00000000,00000000,00000000), ref: 009486D8
GetLastError.KERNEL32 ref: 009486E2

Strings

clbcatq.dll, xrefs: 009485E9, 009485F4
timeutil.cpp, xrefs: 00948706

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Time$ErrorFileLastSystem
String ID: clbcatq.dll$timeutil.cpp
API String ID: 2781989572-961924111
Opcode ID: 4e8fb90b2a6f0984fa718d278909fbcfe53c56f7fd19ba01d978cc016b9d28a7
Instruction ID: b0633b15b96154b0cb2db96a7ef61c081ed50c46666ef3e2b7d28eb99ba9fbee
Opcode Fuzzy Hash: 4e8fb90b2a6f0984fa718d278909fbcfe53c56f7fd19ba01d978cc016b9d28a7
Instruction Fuzzy Hash: 1441C575E5021576EB60ABB88C49FBF73A9EF91700F164519FA01A72A0DA35CE0087A5

Function 009435A4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(000002C0), ref: 009435BE
SysAllocString.OLEAUT32(?), ref: 009435CE
VariantClear.OLEAUT32(?), ref: 009436AF

Strings

xmlutil.cpp, xrefs: 009435E6

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Variant$AllocClearInitString
String ID: xmlutil.cpp
API String ID: 2213243845-1270936966
Opcode ID: c393498d892c31136a049fcfa09dff344536470bb497537a73ca6867e1e9dc5c
Instruction ID: f88fd41551896cd4f29b7037cd10138e130d88351ddd5653a1606a6712ea115a
Opcode Fuzzy Hash: c393498d892c31136a049fcfa09dff344536470bb497537a73ca6867e1e9dc5c
Instruction Fuzzy Hash: EB41787591061AABCB119F75C889EAFB7BCAF45710B0646A5FC05EB311D734DD008B91

Function 00940D1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000002,00000100,00000000,00000000,?,?,00928BD8), ref: 00940D77
RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00928BD8,00000000), ref: 00940D99
RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000003,?,?,00928BD8,00000000,00000000,00000000), ref: 00940DF1

Strings

regutil.cpp, xrefs: 00940DC1

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Enum$InfoQuery
String ID: regutil.cpp
API String ID: 73471667-955085611
Opcode ID: 2f07caafb5f178fdee4e9d780b26cbcd7c1a94b1d36411a4ebc43fe1362fd41a
Instruction ID: a2eb3abbe697661744aa50261a6e3994da6849ff73208204cb77d8f1d2600e33
Opcode Fuzzy Hash: 2f07caafb5f178fdee4e9d780b26cbcd7c1a94b1d36411a4ebc43fe1362fd41a
Instruction Fuzzy Hash: AD3194B6901229FFEB218AD9CD44EABB7ACEF84350F114465FE04E7150E7719E10D7A0

Function 009478C5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 009038D4: GetProcessHeap.KERNEL32(?,000001C7,?,00902284,000001C7,00000001,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 009038E5
Part of subcall function 009038D4: RtlAllocateHeap.NTDLL(00000000,?,00902284,000001C7,00000001,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 009038EC

SysFreeString.OLEAUT32(00000000), ref: 009479AA
SysFreeString.OLEAUT32(?), ref: 009479B5
SysFreeString.OLEAUT32(00000000), ref: 009479C0

Strings

atomutil.cpp, xrefs: 009478F2

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: FreeString$Heap$AllocateProcess
String ID: atomutil.cpp
API String ID: 2724874077-4059165915
Opcode ID: 93d6c544a36ef4b879defbc5e760be54f48cdd6b731f63a0e1f1657cf372d9a0
Instruction ID: 743c3c0167534ab0d6c7c5c171151ff2a70ad4c7f36da00158939e201848eb52
Opcode Fuzzy Hash: 93d6c544a36ef4b879defbc5e760be54f48cdd6b731f63a0e1f1657cf372d9a0
Instruction Fuzzy Hash: C0316272D0562DBFDB12ABA4CC45FAEF7A8AF44714F0145A5E900AB250E771DD049BA0

Function 009288CF Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00940E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,00945699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 00940E52

RegCloseKey.ADVAPI32(00000000,00000000,00000088,00000000,000002C0,00000410,00020019,00000000,000002C0,00000000,?,?,?,00928C14,00000000,00000000), ref: 0092898C

Strings

Failed to open uninstall key for potential related bundle: %ls, xrefs: 009288FB
Failed to ensure there is space for related bundles., xrefs: 0092893F
Failed to initialize package from related bundle id: %ls, xrefs: 00928972

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CloseOpen
String ID: Failed to ensure there is space for related bundles.$Failed to initialize package from related bundle id: %ls$Failed to open uninstall key for potential related bundle: %ls
API String ID: 47109696-1717420724
Opcode ID: 706bf70f23ea364f9ac9e5320f0a60923bbd5bab2b3fe47704a0f78712936722
Instruction ID: 618a4e507af57b362f8b27d74334e8265087612f7fdb54b32ac1351724a13e82
Opcode Fuzzy Hash: 706bf70f23ea364f9ac9e5320f0a60923bbd5bab2b3fe47704a0f78712936722
Instruction Fuzzy Hash: 0621AF3694222AFBDB129E80DC02FBFBB68EB44715F144159FD00A6154DB359EA0EB91

Function 00903A97 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000010,00000000,80004005,00000000,00000000,00000100,?,00901472,00000000,80004005,00000000,80004005,00000000,000001C7,?,009013B7), ref: 00903AB2
HeapReAlloc.KERNEL32(00000000,?,00901472,00000000,80004005,00000000,80004005,00000000,000001C7,?,009013B7,000001C7,00000100,?,80004005,00000000), ref: 00903AB9

Part of subcall function 009038D4: GetProcessHeap.KERNEL32(?,000001C7,?,00902284,000001C7,00000001,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 009038E5
Part of subcall function 009038D4: RtlAllocateHeap.NTDLL(00000000,?,00902284,000001C7,00000001,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 009038EC

Part of subcall function 00903B51: GetProcessHeap.KERNEL32(00000000,000001C7,?,009021DC,000001C7,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 00903B59
Part of subcall function 00903B51: HeapSize.KERNEL32(00000000,?,009021DC,000001C7,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 00903B60

_memcpy_s.LIBCMT ref: 00903B04

Strings

memutil.cpp, xrefs: 00903B45

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Heap$Process$AllocAllocateSize_memcpy_s
String ID: memutil.cpp
API String ID: 3406509257-2429405624
Opcode ID: 4ba797cf5e9d61de1585f63b58d2c2b2d7bafbe0b7755c4318e3ba95b0e66658
Instruction ID: a5e662a315f5c08a41b11d265df5eaf911ec0d33cbd17c2d9292e6fce0b10c90
Opcode Fuzzy Hash: 4ba797cf5e9d61de1585f63b58d2c2b2d7bafbe0b7755c4318e3ba95b0e66658
Instruction Fuzzy Hash: 16110331601228BFDF211A68DC45EBE3A5DDF85768B00C215F9158B2D0C771CF50A390

Function 00948803 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69timeCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0094884C
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00948874
GetLastError.KERNEL32 ref: 0094887E

Strings

inetutil.cpp, xrefs: 0094889F

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorLastTime$FileSystem
String ID: inetutil.cpp
API String ID: 1528435940-2900720265
Opcode ID: a9fee0d9910330d1b232c028c79d81960b6e49af812a8586c49f181a79011419
Instruction ID: 8561c83afad4a29835b34718bcbafe55e6591200ed1b89d7ea8c098eadc2ace4
Opcode Fuzzy Hash: a9fee0d9910330d1b232c028c79d81960b6e49af812a8586c49f181a79011419
Instruction Fuzzy Hash: 6F116076A11229ABE720DBB98D44FABB7ECEF48350F11052AEE05F7250E6748D0497E1

Function 00913955 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00940E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,00945699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 00940E52

RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000001,feclient.dll,?,?,?,00913E61,feclient.dll,?,00000000,?,?,?,00904A0C), ref: 009139F1

Part of subcall function 00940F6E: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00940FE4
Part of subcall function 00940F6E: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 0094101F

Strings

Logging, xrefs: 00913983
feclient.dll, xrefs: 0091395A
SOFTWARE\Policies\Microsoft\Windows\Installer, xrefs: 00913966

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: Logging$SOFTWARE\Policies\Microsoft\Windows\Installer$feclient.dll
API String ID: 1586453840-3596319545
Opcode ID: b381c264b6711aea72476f8617c5b57592b5e847f350885949ebf589ab467434
Instruction ID: ccc04f3f2a1e639e3563a6b9e06d154a421c8122ddb1c4b8b9745a72fff27a51
Opcode Fuzzy Hash: b381c264b6711aea72476f8617c5b57592b5e847f350885949ebf589ab467434
Instruction Fuzzy Hash: BA119032B4020CFBDB218AA5CD42EEEBBBCEB40B55F508066E505AB090D6B19FC1E750

Function 00940658 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62filestringCOMMONLIBRARYCODE

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,00000000,00000000,00000000,?,?,0093FF0B,?,?,00000000,00000000,0000FDE9), ref: 0094066A
WriteFile.KERNEL32(FFFFFFFF,00000000,00000000,00000000,00000000,?,?,0093FF0B,?,?,00000000,00000000,0000FDE9), ref: 009406A6
GetLastError.KERNEL32(?,?,0093FF0B,?,?,00000000,00000000,0000FDE9), ref: 009406B0

Strings

logutil.cpp, xrefs: 009406E0

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorFileLastWritelstrlen
String ID: logutil.cpp
API String ID: 606256338-3545173039
Opcode ID: 70a7c7a7d8ab1191e17b18368f3dd569b68f2742abcd25583546d6f4ea57be13
Instruction ID: 880c487b4667242819d5c3a5bad6d6dbbebf45f5ea81ea2e15b31f810279b3eb
Opcode Fuzzy Hash: 70a7c7a7d8ab1191e17b18368f3dd569b68f2742abcd25583546d6f4ea57be13
Instruction Fuzzy Hash: 8711E972A053256BD310DA798D54EAFBBACEBC5761B024315FE06D7140E774DD10D6E0

Function 00901209 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,00905137,00000000,?), ref: 00901247
GetLastError.KERNEL32(?,?,?,00905137,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 00901251

Strings

apputil.cpp, xrefs: 00901272
ignored , xrefs: 00901216

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ArgvCommandErrorLastLine
String ID: apputil.cpp$ignored
API String ID: 3459693003-568828354
Opcode ID: e77bcefcb4c8d5246c5094e53be436bb094d596193006e93f7b87ced3ec37e2a
Instruction ID: 5be4144f784e93c891a426bda997ec6026150fae18ebe370be6b1e883b65d6ea
Opcode Fuzzy Hash: e77bcefcb4c8d5246c5094e53be436bb094d596193006e93f7b87ced3ec37e2a
Instruction Fuzzy Hash: C5114276A01229BFDB11DB99C905D9FBBF8EF45750B114156FD04E7250E730DE00D6A0

Function 0092CF56 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00000002,00000000,?,?,0092D1DC,00000000,00000000,00000000,?), ref: 0092CF66
ReleaseMutex.KERNEL32(?,?,0092D1DC,00000000,00000000,00000000,?), ref: 0092CFED

Part of subcall function 009038D4: GetProcessHeap.KERNEL32(?,000001C7,?,00902284,000001C7,00000001,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 009038E5
Part of subcall function 009038D4: RtlAllocateHeap.NTDLL(00000000,?,00902284,000001C7,00000001,80004005,8007139F,?,?,0094015F,8007139F,?,00000000,00000000,8007139F), ref: 009038EC

Strings

NetFxChainer.cpp, xrefs: 0092CFAB
Failed to allocate memory for message data, xrefs: 0092CFB5

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Heap$AllocateMutexObjectProcessReleaseSingleWait
String ID: Failed to allocate memory for message data$NetFxChainer.cpp
API String ID: 2993511968-1624333943
Opcode ID: 51f97e933085035e3c4349f5cc7c1dea4863d2e5d6e0ebf7a2d3979d611a5bed
Instruction ID: e0a058a0443afad5ea42f9e8881605065c4c8d21abf022b0f35939c599b55300
Opcode Fuzzy Hash: 51f97e933085035e3c4349f5cc7c1dea4863d2e5d6e0ebf7a2d3979d611a5bed
Instruction Fuzzy Hash: FD11C4B1300215AFCB04CF24E894E5ABBB9FF49720F104168F9149B391C771AC10CBA4

Function 00901F78 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(000011FF,00905386,?,00000000,00000000,00000000,?,80070656,?,?,?,0091E50B,00000000,00905386,00000000,80070656), ref: 00901FAA
GetLastError.KERNEL32(?,?,?,0091E50B,00000000,00905386,00000000,80070656,?,?,00913F6B,00905386,?,80070656,00000001,crypt32.dll), ref: 00901FB7
LocalFree.KERNEL32(00000000,?,00000000,00000000,?,?,?,0091E50B,00000000,00905386,00000000,80070656,?,?,00913F6B,00905386), ref: 00901FFE

Strings

strutil.cpp, xrefs: 00901FDB

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: strutil.cpp
API String ID: 1365068426-3612885251
Opcode ID: bcd0cc05fde30abd9c7a0d0c44f4efee59b315dd07d954d6109399c497c8d57b
Instruction ID: bb8fce752dd3fff7a2d2f5f698a91cf5e62470afcfcfe80d8b467a7d52561931
Opcode Fuzzy Hash: bcd0cc05fde30abd9c7a0d0c44f4efee59b315dd07d954d6109399c497c8d57b
Instruction Fuzzy Hash: 78115E76910229FFEB159FA4CC09AEE7AA9EF08341F004169FE05A2190E7718E10D7E0

Function 0091FC51 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 50COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 0091FC58

Strings

EngineForApplication.cpp, xrefs: 0091FC84
Failed to QI for IBootstrapperEngine from BootstrapperEngineForApplication object., xrefs: 0091FCB0
Failed to allocate new BootstrapperEngineForApplication object., xrefs: 0091FC8E

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID:
String ID: EngineForApplication.cpp$Failed to QI for IBootstrapperEngine from BootstrapperEngineForApplication object.$Failed to allocate new BootstrapperEngineForApplication object.
API String ID: 0-1509993410
Opcode ID: 5218fe119eeda45ca2ed802c5b453ffc8c79cc93f66086255d7ba1f77d562032
Instruction ID: bab033b5b21d6b3a8b203d1de721f6785e8c4af45cd88a6ceeeda417f001b099
Opcode Fuzzy Hash: 5218fe119eeda45ca2ed802c5b453ffc8c79cc93f66086255d7ba1f77d562032
Instruction Fuzzy Hash: 8BF0493634431E7F97026B15EC12EEE3768CFC5775710002AFD04AA290EF208941A2A5

Function 00944C67 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(0094B4F0,40000000,00000001,00000000,00000002,00000080,00000000,00910328,00000000,?,0090F37F,?,00000080,0094B4F0,00000000), ref: 00944C7F
GetLastError.KERNEL32(?,0090F37F,?,00000080,0094B4F0,00000000,?,00910328,?,00000094,?,?,?,?,?,00000000), ref: 00944C8C
CloseHandle.KERNEL32(00000000,00000000,?,0090F37F,?,0090F37F,?,00000080,0094B4F0,00000000,?,00910328,?,00000094), ref: 00944CE0

Strings

fileutil.cpp, xrefs: 00944CB0

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: fileutil.cpp
API String ID: 2528220319-2967768451
Opcode ID: c66b06823a3d1a93f6c327d9c46af40b61b8c84dbe06cb641aee6ad449caf615
Instruction ID: 7e34f46aa928e8e8c16ccbc50f6f443fcd1141925837de4357df853dc234db87
Opcode Fuzzy Hash: c66b06823a3d1a93f6c327d9c46af40b61b8c84dbe06cb641aee6ad449caf615
Instruction Fuzzy Hash: 22012B767113246BE7315E699C45F9B3A98DB817B2F154320FE24E71E0C731CC1193A0

Function 00944840 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000080,00000001,00000000,00000003,00000080,00000000,000002C0,00000000,?,00928A30,00000000,00000088,000002C0,BundleCachePath,00000000), ref: 00944874
GetLastError.KERNEL32(?,00928A30,00000000,00000088,000002C0,BundleCachePath,00000000,000002C0,BundleVersion,000000B8,000002C0,EngineVersion,000002C0,000000B0), ref: 00944881

Strings

fileutil.cpp, xrefs: 00944855, 009448A5

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CreateErrorFileLast
String ID: fileutil.cpp
API String ID: 1214770103-2967768451
Opcode ID: 8eff0119ff7366b89e7d1f13ce71d74ffcd55b00eb3606eff7c8df113598b150
Instruction ID: b43f8dd551d6c855959c6cc020a33a17f02306ec5be057a4e52c5e77c822a858
Opcode Fuzzy Hash: 8eff0119ff7366b89e7d1f13ce71d74ffcd55b00eb3606eff7c8df113598b150
Instruction Fuzzy Hash: A401A436790320BAF73126A9AC09F7B269CDB85B62F114225FE05AB2D0C6698D0192E5

Function 009269A8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(009268BA,00000001,?,00000001,00000000,?,?,?,?,?,?,009268BA,00000000), ref: 009269D0
GetLastError.KERNEL32(?,?,?,?,?,?,009268BA,00000000), ref: 009269DA

Strings

Failed to stop wusa service., xrefs: 00926A08
msuengine.cpp, xrefs: 009269FE

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ControlErrorLastService
String ID: Failed to stop wusa service.$msuengine.cpp
API String ID: 4114567744-2259829683
Opcode ID: f1cddcff0af9f65e062af44b69c96e03eeab7d33874f83f92dd20406a403bd20
Instruction ID: 3b78086be44395b1838c1e3d96fcbf6c5d2adbdd645fb82f7a56ae39afe2dcdd
Opcode Fuzzy Hash: f1cddcff0af9f65e062af44b69c96e03eeab7d33874f83f92dd20406a403bd20
Instruction Fuzzy Hash: 17012B72B042246BE720AB75AC01FBB77E8DF88751F014029FD04FB180DA349D0482D5

Function 0091EA72 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009002,00000000,?), ref: 0091EA9A
GetLastError.KERNEL32 ref: 0091EAA4

Strings

EngineForApplication.cpp, xrefs: 0091EAC8
Failed to post elevate message., xrefs: 0091EAD2

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post elevate message.
API String ID: 2609174426-4098423239
Opcode ID: 9f6dc63f80fbabec7517bcc08ef2f2ed173ac1b9088b4a9d424055af98dacc96
Instruction ID: 8df03c61f01dd8e79f266a6d9506d60ddfdb3c57b7b5bdbf36323d4c4ef729b5
Opcode Fuzzy Hash: 9f6dc63f80fbabec7517bcc08ef2f2ed173ac1b9088b4a9d424055af98dacc96
Instruction Fuzzy Hash: 57F0F036704334ABE320AAA99C09E9337D8FF44765F118229FE18EA1D0D725CC4197D5

Function 0090D7CF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,BootstrapperApplicationDestroy), ref: 0090D7F6
FreeLibrary.KERNEL32(?,?,009047D1,00000000,?,?,00905386,?,?), ref: 0090D805
GetLastError.KERNEL32(?,009047D1,00000000,?,?,00905386,?,?), ref: 0090D80F

Strings

BootstrapperApplicationDestroy, xrefs: 0090D7EE

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: AddressErrorFreeLastLibraryProc
String ID: BootstrapperApplicationDestroy
API String ID: 1144718084-3186005537
Opcode ID: 44adbfcbe92cd8472e08648083d2a2524cc243244dcdc7b944d216595b82b169
Instruction ID: 574c966173ecfb305dd27da6e7af6bb73b81ac8adbb89fc4a34aeec8383d4441
Opcode Fuzzy Hash: 44adbfcbe92cd8472e08648083d2a2524cc243244dcdc7b944d216595b82b169
Instruction Fuzzy Hash: 37F044362147009FD7209FA6DC08A67B7E9BF81362B01C52EE966C25A0DB35E800DBA0

Function 0091F086 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009001,00000000,?), ref: 0091F09B
GetLastError.KERNEL32 ref: 0091F0A5

Strings

EngineForApplication.cpp, xrefs: 0091F0C9
Failed to post plan message., xrefs: 0091F0D3

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post plan message.
API String ID: 2609174426-2952114608
Opcode ID: e8c8941ac00080ea317a5f6e245467de734479492355f3bf3306728090b23766
Instruction ID: 1b99128188519f36eb0e5acf4fd5b3ec77a55bcbe63bc02ab2843543b415d443
Opcode Fuzzy Hash: e8c8941ac00080ea317a5f6e245467de734479492355f3bf3306728090b23766
Instruction Fuzzy Hash: D0F0A0367543346AE7206AAA9C09F877BD8EF48BA1F018025FE0CEA091D625CC40D6E5

Function 0091F194 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009005,?,00000000), ref: 0091F1A9
GetLastError.KERNEL32 ref: 0091F1B3

Strings

EngineForApplication.cpp, xrefs: 0091F1D7
Failed to post shutdown message., xrefs: 0091F1E1

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post shutdown message.
API String ID: 2609174426-188808143
Opcode ID: 8b94ebd31c3b37076614d75245c7620186f7e60253822cee5e91ee622d11d21d
Instruction ID: 1f7c3634e1adb3bc86d31591012f1306f05cc2cd6aaabb6f82f60dcb935fc163
Opcode Fuzzy Hash: 8b94ebd31c3b37076614d75245c7620186f7e60253822cee5e91ee622d11d21d
Instruction Fuzzy Hash: 3DF0EC377453347BE7206AAA9C09F877BD8EF44B61F014025FE08E6091D611CD00D7E5

Function 0092051A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(0094B468,00000000,?,0092145A,?,00000000,?,0090C121,?,009052FD,?,009173B2,?,?,009052FD,?), ref: 00920524
GetLastError.KERNEL32(?,0092145A,?,00000000,?,0090C121,?,009052FD,?,009173B2,?,?,009052FD,?,0090533D,00000001), ref: 0092052E

Strings

cabextract.cpp, xrefs: 00920552
Failed to set begin operation event., xrefs: 0092055C

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorEventLast
String ID: Failed to set begin operation event.$cabextract.cpp
API String ID: 3848097054-4159625223
Opcode ID: 1fe1fdd200d19324f04775f8582a1882a3044189ffafa169e01f2f857d2deea5
Instruction ID: c3136a9e002a37c6f53ec190fbd0df5c93984c2d5f667adb3a26cc0356298857
Opcode Fuzzy Hash: 1fe1fdd200d19324f04775f8582a1882a3044189ffafa169e01f2f857d2deea5
Instruction Fuzzy Hash: DFF0E533A447306BA720A6BA7C05F9B76D8CF897A1B010126FE09F7150E6149D0097E9

Function 0091E978 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009003,00000000,?), ref: 0091E98D
GetLastError.KERNEL32 ref: 0091E997

Strings

EngineForApplication.cpp, xrefs: 0091E9BB
Failed to post apply message., xrefs: 0091E9C5

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post apply message.
API String ID: 2609174426-1304321051
Opcode ID: d0491c78464eff20e42a8fba9a548c20c3874cd8eb29838145ef4ce76f731109
Instruction ID: 1ef7db22f55ea1a874560ac98c00abe57c493cd691ffdc206419c17524e7ba88
Opcode Fuzzy Hash: d0491c78464eff20e42a8fba9a548c20c3874cd8eb29838145ef4ce76f731109
Instruction Fuzzy Hash: B0F0EC367443306BE7306A6A9C05F877BD8EF44BA1F014025FE08EA091D621CC00D6E5

Function 0091EA09 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009000,00000000,?), ref: 0091EA1E
GetLastError.KERNEL32 ref: 0091EA28

Strings

EngineForApplication.cpp, xrefs: 0091EA4C
Failed to post detect message., xrefs: 0091EA56

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post detect message.
API String ID: 2609174426-598219917
Opcode ID: 179015e5d8ff1f2bb60b096a8fc4ca75dd4fbff79b28d3256d66cb7d283f35b3
Instruction ID: e5861cb42f0f068c9fa4bbf93739fbb10acc59c2f3c59e755764adcf6d7d2e6b
Opcode Fuzzy Hash: 179015e5d8ff1f2bb60b096a8fc4ca75dd4fbff79b28d3256d66cb7d283f35b3
Instruction Fuzzy Hash: EEF0EC367453306FE7306A6A9C05F877BD8EF49BA1F014115FD08E6090D621CD00D6E5

Function 00936A76 Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00936B01
__alldvrm.LIBCMT ref: 00936D02
__alldvrm.LIBCMT ref: 00936D24

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: f3a74c95afe91129e83f4a200ae329e72b68e1b987d16e4549aa364eb4fd1ab8
Instruction ID: 95479535f2bc09f21347e502742475901b14bd58c3dc371e15bde7b410a3e892
Opcode Fuzzy Hash: f3a74c95afe91129e83f4a200ae329e72b68e1b987d16e4549aa364eb4fd1ab8
Instruction Fuzzy Hash: F1A13672A04386AFDB25CF18C891BAEBBF9EF51350F1481ADE5D59B281C6389D41CF50

Function 00945D7F Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 159stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 00945E3D
lstrlenW.KERNEL32(?), ref: 00945E55

Strings

dlutil.cpp, xrefs: 00945EDB

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: lstrlen
String ID: dlutil.cpp
API String ID: 1659193697-2067379296
Opcode ID: e84ed165f1ee43a0857c66e6a0d94eb2a88b6ab7a20184e21372d37630875ac2
Instruction ID: 1f3317837d947eb6e0ac71f88f3cfdf9b3ddb8e9b362fcd1f4864395bb6b291a
Opcode Fuzzy Hash: e84ed165f1ee43a0857c66e6a0d94eb2a88b6ab7a20184e21372d37630875ac2
Instruction Fuzzy Hash: DC51A332A01615BBDB219FE58C84EAFB7BDEF88750B164019FE01A7251DB71DD019BA0

Function 009390AA Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,E3E85006,0093234D,00000000,00000000,00933382,?,00933382,?,00000001,0093234D,E3E85006,00000001,00933382,00933382), ref: 009390F7
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00939180
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00939192
__freea.LIBCMT ref: 0093919B

Part of subcall function 00935154: HeapAlloc.KERNEL32(00000000,?,?,?,00931E90,?,0000015D,?,?,?,?,009332E9,000000FF,00000000,?,?), ref: 00935186

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ByteCharMultiWide$AllocHeapStringType__freea
String ID:
API String ID: 573072132-0
Opcode ID: 40dfa21c8a6c812979fdd23df357e4485ab0435f863fc7cffe529c09a0f64413
Instruction ID: e460a9ed2b2451848750bafe107a34348f97aedd9f330fa1e399d25f3d2c218b
Opcode Fuzzy Hash: 40dfa21c8a6c812979fdd23df357e4485ab0435f863fc7cffe529c09a0f64413
Instruction Fuzzy Hash: FB31B072A0021AABDF248FA5DC49EAF7BA9EB41710F054168FC04E6250E775CD54CBA0

Function 00904E9C Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00000000,?,0090545F,?,?,?,?,?,?), ref: 00904EF6
DeleteCriticalSection.KERNEL32(?,?,?,00000000,?,0090545F,?,?,?,?,?,?), ref: 00904F0A
TlsFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,0090545F,?,?), ref: 00904FF9
DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,0090545F,?,?), ref: 00905000

Part of subcall function 00901160: LocalFree.KERNEL32(?,?,00904EB3,?,00000000,?,0090545F,?,?,?,?,?,?), ref: 0090116A

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CriticalDeleteFreeSection$CloseHandleLocal
String ID:
API String ID: 3671900028-0
Opcode ID: 521360b6db8196664f5144336655deafd5a0e902069cda261a229a670f198e67
Instruction ID: 572f1fb33e76c4cf32b35df9c1420e19ae2571b90e21428108f97160132c7bc1
Opcode Fuzzy Hash: 521360b6db8196664f5144336655deafd5a0e902069cda261a229a670f198e67
Instruction Fuzzy Hash: AD41C5B1604B05AFCA20EBB5C889F9B73ECAF44341F444829B79AD7092EB34F544CB24

Function 00943119 Relevance: 6.1, APIs: 4, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 0094312C
VariantInit.OLEAUT32(?), ref: 00943138
VariantClear.OLEAUT32(?), ref: 009431AC
SysFreeString.OLEAUT32(00000000), ref: 009431B7

Part of subcall function 0094336E: SysAllocString.OLEAUT32(?), ref: 00943383

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: String$AllocVariant$ClearFreeInit
String ID:
API String ID: 347726874-0
Opcode ID: ce17993b2ca5786704be765939edc3a2cc0c4ce9b24179722685da138cffca73
Instruction ID: 84c645eaac5721c26029d8894a05b20cb8ac06b724e25efbe1d9fc229741210e
Opcode Fuzzy Hash: ce17993b2ca5786704be765939edc3a2cc0c4ce9b24179722685da138cffca73
Instruction Fuzzy Hash: B6214F35905219AFCB28DFB5C888EAEBBB8EF49711F14825CE90197210D731DE05CB90

Function 00904B80 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0090F7F7: RegCloseKey.ADVAPI32(00000000,?,?,00000001,00000000,00000000,?,?,00904B9F,?,?,00000001), ref: 0090F847

CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,?,?,00000001,00000000,?,?,?), ref: 00904C06

Part of subcall function 0094082D: CreateProcessW.KERNEL32(00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,00000000), ref: 0094089A
Part of subcall function 0094082D: GetLastError.KERNEL32(?,?,?,?,00000000,00000000,00000000), ref: 009408A4
Part of subcall function 0094082D: CloseHandle.KERNEL32(?,?,?,?,?,00000000,00000000,00000000), ref: 009408ED
Part of subcall function 0094082D: CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,00000000,00000000), ref: 009408FA

Strings

Unable to get resume command line from the registry, xrefs: 00904BA5
Failed to re-launch bundle process after RunOnce: %ls, xrefs: 00904BF0
Failed to get current process path., xrefs: 00904BC4

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Close$Handle$CreateErrorLastProcess
String ID: Failed to get current process path.$Failed to re-launch bundle process after RunOnce: %ls$Unable to get resume command line from the registry
API String ID: 1572399834-642631345
Opcode ID: b1fd4827a2d14a86b40ae4d1c0aaa1341936e65f74b413b53d6aac79c6d9c02e
Instruction ID: 17f118920e75dc8f7642976f87a2acc07d287af0b210d1906246d3f66256368e
Opcode Fuzzy Hash: b1fd4827a2d14a86b40ae4d1c0aaa1341936e65f74b413b53d6aac79c6d9c02e
Instruction Fuzzy Hash: 23114FB5D0552CFFCF22AB98DD01DEDFBB8EF84710B1041A6FA04B6251D7718A50AB91

Function 00938731 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,009388D5,00000000,00000000,?,009386D8,009388D5,00000000,00000000,00000000,?,009388D5,00000006,FlsSetValue), ref: 00938763
GetLastError.KERNEL32(?,009386D8,009388D5,00000000,00000000,00000000,?,009388D5,00000006,FlsSetValue,00962208,00962210,00000000,00000364,?,00936130), ref: 0093876F
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,009386D8,009388D5,00000000,00000000,00000000,?,009388D5,00000006,FlsSetValue,00962208,00962210,00000000), ref: 0093877D

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: f9296784a4210a9c7cae2dad52a6aa5ecb6f8de91b6b2e320668f181aaae07c5
Instruction ID: f8c6267a02b1bda5c24449c79f21f130b9cda22b54bcf7b86272950773d2fe48
Opcode Fuzzy Hash: f9296784a4210a9c7cae2dad52a6aa5ecb6f8de91b6b2e320668f181aaae07c5
Instruction Fuzzy Hash: E201D43A229326ABC7214A799C44E57379EAB05BA1B340A20F917D3240DB24DC01CAE0

Function 0093605E Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,009319F5,00000000,80004004,?,00931CF9,00000000,80004004,00000000,00000000), ref: 00936062
SetLastError.KERNEL32(00000000,80004004,00000000,00000000), ref: 009360CA
SetLastError.KERNEL32(00000000,80004004,00000000,00000000), ref: 009360D6
_abort.LIBCMT ref: 009360DC

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorLast$_abort
String ID:
API String ID: 88804580-0
Opcode ID: baa7daea819451e0b938386923bf8c61f8c8ce6f4c3c4df3c7f6368f62d763e5
Instruction ID: 492d34bf3d205a0e7c19258fa8e9d8ae668af6176f88d5ec6ad4d3a79a57a36b
Opcode Fuzzy Hash: baa7daea819451e0b938386923bf8c61f8c8ce6f4c3c4df3c7f6368f62d763e5
Instruction Fuzzy Hash: 7EF0C835108B0076C2263B766D0FF1B16AE9FC7731F264518F829E6191FF24DC015D62

Function 0090730C Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00907318
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 0090737F

Strings

Failed to get value of variable: %ls, xrefs: 00907352
Failed to get value as numeric for variable: %ls, xrefs: 0090736E

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as numeric for variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-4270472870
Opcode ID: 83d631ac71f0390f852ada1710619346e43fb5fd252c3f708a2f698eef240df5
Instruction ID: e0176222b8e4de098d17584f3dd60a0c92dfb014aece61ec8cee67bae95fce1f
Opcode Fuzzy Hash: 83d631ac71f0390f852ada1710619346e43fb5fd252c3f708a2f698eef240df5
Instruction Fuzzy Hash: 2A019E32D48128FFDF215E94DC05F9EBB699F44734F008124FD04AA260D335AA50ABE0

Function 00907481 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0090748D
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 009074F4

Strings

Failed to get value of variable: %ls, xrefs: 009074C7
Failed to get value as version for variable: %ls, xrefs: 009074E3

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as version for variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-1851729331
Opcode ID: 02058522649b509c1fc0ac9e740cd3c2eaf7e7a2ee56fa4b95d36a3b78e5a1d3
Instruction ID: bafbfa49517cc5532180e24e5f7bed9e2d26d37982badb83c144564b32c2b6ce
Opcode Fuzzy Hash: 02058522649b509c1fc0ac9e740cd3c2eaf7e7a2ee56fa4b95d36a3b78e5a1d3
Instruction Fuzzy Hash: 44015E72D4912CFFCF115A84CC05E9EBF6A9B54735F118125FD04AA260C335AE10A7E0

Function 00907410 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,00000006,?,00909752,00000000,?,00000000,00000000,00000000,?,00909590,00000000,?,00000000,00000000), ref: 0090741C
LeaveCriticalSection.KERNEL32(00000000,00000000,00000000,00000000,?,00909752,00000000,?,00000000,00000000,00000000,?,00909590,00000000,?,00000000), ref: 00907472

Strings

Failed to get value of variable: %ls, xrefs: 00907442
Failed to copy value of variable: %ls, xrefs: 00907461

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to copy value of variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-2936390398
Opcode ID: 5c23c778e28b049dcd912594792d835946c27dfb21095f3ed39f2885071b41cd
Instruction ID: f878e3fa274277c0f60b692e65eb8c2740a0492aa9f2b95a746c905782caeb6e
Opcode Fuzzy Hash: 5c23c778e28b049dcd912594792d835946c27dfb21095f3ed39f2885071b41cd
Instruction Fuzzy Hash: 7FF08C76D4812CBFCF126F94CC05E9EBF69EF44764F008124FD04A6260D736AA20ABD1

Function 00931246 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00931246
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 0093124B
___vcrt_initialize_locks.LIBVCRUNTIME ref: 00931250

Part of subcall function 00931548: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 00931559

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00931265

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: 294756368ebb91e0d837f8d85631f380e5f2af2aa371e18ba28d844398db2aca
Instruction ID: 869f063e5169bf1294420836515e4254358b32484e5166e7972ce17e591518a6
Opcode Fuzzy Hash: 294756368ebb91e0d837f8d85631f380e5f2af2aa371e18ba28d844398db2aca
Instruction Fuzzy Hash: BAC04808108201541E203BF222463EF43884CE2786F9024C6F876A7533AE0A081F2D36

Function 00944661 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 136registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00940E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,00945699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 00940E52

RegCloseKey.ADVAPI32(00000000,80000002,SYSTEM\CurrentControlSet\Control\Session Manager,00000003,?,00000000,00000000,00000101), ref: 009447C2

Strings

PendingFileRenameOperations, xrefs: 009446B2, 0094479A
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00944672

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$SYSTEM\CurrentControlSet\Control\Session Manager
API String ID: 47109696-3023217399
Opcode ID: 021301d7249bb624f212698c7488eac1acfedc6b44a2793c5d773df5cdbef66e
Instruction ID: b72be725d890d092d8024cc78d39256bbf226928eed376c7775fff5d6febf1f8
Opcode Fuzzy Hash: 021301d7249bb624f212698c7488eac1acfedc6b44a2793c5d773df5cdbef66e
Instruction Fuzzy Hash: EE41A375E00219EFCF20DF94C981FAEBBB9EF86B10F214069E500AB211DB319E52DB50

Function 00940B49 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 130registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000), ref: 00940CA0

Part of subcall function 00940E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,00945699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 00940E52

Strings

regutil.cpp, xrefs: 00940C8D

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CloseOpen
String ID: regutil.cpp
API String ID: 47109696-955085611
Opcode ID: b3819baf7be60e10e85cdd669b00699ef60fb34b7ea512ae4e666b18b69ab039
Instruction ID: 209f50cc87edd6d145fdb08ec1f99129235aa371f649f696c3e30cf596732d8d
Opcode Fuzzy Hash: b3819baf7be60e10e85cdd669b00699ef60fb34b7ea512ae4e666b18b69ab039
Instruction Fuzzy Hash: 58412832D40229FFDF215AA4CD84FAD7BA9AB84316F118369FE41AB160D3358D50D784

Function 00940F6E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 126registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00940FE4
RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 0094101F

Strings

regutil.cpp, xrefs: 00941057

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: QueryValue
String ID: regutil.cpp
API String ID: 3660427363-955085611
Opcode ID: b0bb811ec6ac1a33bb9a94768016629e54766939327f3acad661affd1070930f
Instruction ID: 5173811651e78c11c39457fe0e01807ea7bc12f3b3a5596ef595fa4a47829e8d
Opcode Fuzzy Hash: b0bb811ec6ac1a33bb9a94768016629e54766939327f3acad661affd1070930f
Instruction Fuzzy Hash: FD419F31D0022AEFDF209F94C885EAEBBB9FF54750F104269E914E7250D7719E91DB90

Function 009365D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0094B508,00000000,00000006,00000001,comres.dll,?,00000000,?,00000000,?,?,00000000,00000006,?,comres.dll,?), ref: 009366A3
GetLastError.KERNEL32 ref: 009366BF

Strings

comres.dll, xrefs: 0093664A, 00936698, 009366D4

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID: comres.dll
API String ID: 203985260-246242247
Opcode ID: 30da6ea20bd43ac60b0f70f8b34bc2fc19151aef0fe2e6ebc39d1a6cb0ae4c5f
Instruction ID: ad999ae476aaac47bd5ea3540fb296be588b5d5f03fdf77815638549fc668d10
Opcode Fuzzy Hash: 30da6ea20bd43ac60b0f70f8b34bc2fc19151aef0fe2e6ebc39d1a6cb0ae4c5f
Instruction Fuzzy Hash: 1231B331600215FBCB21AF59D88BBAB7B6CEF92798F148125F9145B291DB708D40CFA1

Function 00948E07 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00948CFB: lstrlenW.KERNEL32(00000100,?,?,00949098,000002C0,00000100,00000100,00000100,?,?,?,00927B40,?,?,000001BC,00000000), ref: 00948D1B

RegCloseKey.ADVAPI32(00000000,?,?,00000000,?,00000000,?,?,?,00000000,wininet.dll,?,0094B4F0,wininet.dll,?), ref: 00948F07
RegCloseKey.ADVAPI32(?,?,?,00000000,?,00000000,?,?,?,00000000,wininet.dll,?,0094B4F0,wininet.dll,?), ref: 00948F14

Part of subcall function 00940E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,00945699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 00940E52

Part of subcall function 00940D1C: RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000002,00000100,00000000,00000000,?,?,00928BD8), ref: 00940D77
Part of subcall function 00940D1C: RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00928BD8,00000000), ref: 00940D99

Strings

wininet.dll, xrefs: 00948E7C, 00948EC9

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Close$EnumInfoOpenQuerylstrlen
String ID: wininet.dll
API String ID: 2680864210-3354682871
Opcode ID: ed35fa501f07f22b386b2e449f9fbb2a2c199c263e15a42f97c0f2011850089e
Instruction ID: 45c560c3f0a19891429ea8567f9cb25b670defd53048c5e99a8887f8d3950895
Opcode Fuzzy Hash: ed35fa501f07f22b386b2e449f9fbb2a2c199c263e15a42f97c0f2011850089e
Instruction Fuzzy Hash: 37310C76C0112EBFCF21AF94C980DAFBBBAEF44350B554169EA0177121DB318E54EB90

Function 00949220 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00948CFB: lstrlenW.KERNEL32(00000100,?,?,00949098,000002C0,00000100,00000100,00000100,?,?,?,00927B40,?,?,000001BC,00000000), ref: 00948D1B

RegCloseKey.ADVAPI32(00000000,00000000,?,00000000,00000000,00000000), ref: 00949305
RegCloseKey.ADVAPI32(00000001,00000000,?,00000000,00000000,00000000), ref: 0094931F

Part of subcall function 00940AD5: RegCreateKeyExW.ADVAPI32(00000001,00000000,00000000,00000000,00000000,00000001,00000000,?,00000000,00000001,?,?,00910491,?,00000000,00020006), ref: 00940AFA

Part of subcall function 00941392: RegSetValueExW.ADVAPI32(00020006,00020006,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,0090F1C2,00000000,?,00020006), ref: 009413C5

Part of subcall function 00941392: RegDeleteValueW.ADVAPI32(00020006,00020006,00000000,?,?,0090F1C2,00000000,?,00020006,?,00020006,00020006,00000000,?,?,?), ref: 009413F5

Part of subcall function 00941344: RegSetValueExW.ADVAPI32(?,?,00000000,00000004,?,00000004,SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce,?,0090F11A,00000005,Resume,?,?,?,00000002,00000000), ref: 00941359

Strings

%ls\%ls, xrefs: 00949281

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Value$Close$CreateDeletelstrlen
String ID: %ls\%ls
API String ID: 3924016894-2125769799
Opcode ID: 82a78ac23075067925a245f7ab49db2013c1ed638a06cf311a4fc14e1fcd24b3
Instruction ID: aa7a8f8a285ebff2927134985eaa7c9f5d6c7a47b15ff0992e857c8d2f631a93
Opcode Fuzzy Hash: 82a78ac23075067925a245f7ab49db2013c1ed638a06cf311a4fc14e1fcd24b3
Instruction Fuzzy Hash: 5431E972C0112EBBCF12AFD4CC81DAFBBB9EF45754B51416AFA10B6121D7718E50AB90

Function 009039CF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 00903A32

Strings

crypt32.dll, xrefs: 009039EF, 00903A2E, 00903A30
wininet.dll, xrefs: 009039F0

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: _memcpy_s
String ID: crypt32.dll$wininet.dll
API String ID: 2001391462-82500532
Opcode ID: 20d9f25f4ff598d2956f110480d47adb0513f97da9c1314b068fe09bcabe11f2
Instruction ID: 769af58b84eee0967c344b10adf4c470d3dc4edccbb88e2201b0cb94e14e6b06
Opcode Fuzzy Hash: 20d9f25f4ff598d2956f110480d47adb0513f97da9c1314b068fe09bcabe11f2
Instruction Fuzzy Hash: 48114D71700219AFCB08DE19DD95A9BBB6DEF94750B14812ABC098B351D230EA108AE0

Function 00941392 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.ADVAPI32(00020006,00020006,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,0090F1C2,00000000,?,00020006), ref: 009413C5
RegDeleteValueW.ADVAPI32(00020006,00020006,00000000,?,?,0090F1C2,00000000,?,00020006,?,00020006,00020006,00000000,?,?,?), ref: 009413F5

Strings

regutil.cpp, xrefs: 00941429

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Value$Delete
String ID: regutil.cpp
API String ID: 1738766685-955085611
Opcode ID: 29cc665fb4d1663ef9b99ce26815bd1f4cd1d537c4f35cf2b28b7b889d438b63
Instruction ID: f22329ede9d7cc82eb1ac32a219ec6b0a6840be5a5a2c14abfbe551fb77526ee
Opcode Fuzzy Hash: 29cc665fb4d1663ef9b99ce26815bd1f4cd1d537c4f35cf2b28b7b889d438b63
Instruction Fuzzy Hash: 6E11C632E10239BBEF215EA58D04FAA76A9EF047A0F014225FD04EA1B0E771CD5097D0

Function 0090DCA5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,00000000,000000FF,?,000000FF,IGNOREDEPENDENCIES,00000000,?,?,0092744B,00000000,IGNOREDEPENDENCIES,00000000,?,0094B508), ref: 0090DCF6

Strings

IGNOREDEPENDENCIES, xrefs: 0090DCAD
Failed to copy the property value., xrefs: 0090DD2A

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CompareString
String ID: Failed to copy the property value.$IGNOREDEPENDENCIES
API String ID: 1825529933-1412343224
Opcode ID: 0fe985ed8a1b23ba78d1d2a3d60556e2a414dc5df5f99b637e57af4825624c40
Instruction ID: 99a2ed3db3cff7106a571e86426d840f928e6ae410d46de60a4005c4000a45e0
Opcode Fuzzy Hash: 0fe985ed8a1b23ba78d1d2a3d60556e2a414dc5df5f99b637e57af4825624c40
Instruction Fuzzy Hash: 1711C636205315AFDB104F84CC84F6977A9EF59324F254576FA189B2D1C7B09850DB90

Function 009454F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(20000004,00000000,00000000,00000000,00000000,00000000,?,?,00918C90,?,00000001,20000004,00000000,00000000,?,00000000), ref: 00945527
SetNamedSecurityInfoW.ADVAPI32(00000000,?,000007D0,00000003,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00918C90,?), ref: 00945542

Strings

aclutil.cpp, xrefs: 00945565

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: InfoNamedSecuritySleep
String ID: aclutil.cpp
API String ID: 2352087905-2159165307
Opcode ID: c267a86eb5bf668aa3052acf988b4749f389a7dd5acef54572a8fa9061142ba4
Instruction ID: 3071a892f91828bed9beb3c075c8d1ee131f2fd33180e12af5b954b7fdd6a06e
Opcode Fuzzy Hash: c267a86eb5bf668aa3052acf988b4749f389a7dd5acef54572a8fa9061142ba4
Instruction Fuzzy Hash: 85016577900528BBDF129FD5CD05EDE7E7AEF84760F064115FD0566121D6318D60E7A0

Function 009155BD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 009155D9
CoUninitialize.OLE32(?,00000000,?,?,?,?,?,?,?), ref: 00915633

Strings

Failed to initialize COM on cache thread., xrefs: 009155E5

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: InitializeUninitialize
String ID: Failed to initialize COM on cache thread.
API String ID: 3442037557-3629645316
Opcode ID: dec9950826303800d37392b0e72c0c03ae98281dadadc457ab08e12fe6f607b5
Instruction ID: 53c265f1874b18e476e34dc8c412eaf2917f7839f53c9ed7b8a071ce061862ab
Opcode Fuzzy Hash: dec9950826303800d37392b0e72c0c03ae98281dadadc457ab08e12fe6f607b5
Instruction Fuzzy Hash: 21016D72605619BFCB058FA5DC84ED6FBACFF48354B418126FA08D7121DB31AD549BD0

Function 0090155F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(0000007F,00000000,00000000,00916EF3,00000000,00916EF3,00000000,00000000,00916EF3,00000000,00000000,00000000,?,00902326,00000000,00000000), ref: 009015A3
GetLastError.KERNEL32(?,00902326,00000000,00000000,00916EF3,00000200,?,0094516B,00000000,00916EF3,00000000,00916EF3,00000000,00000000,00000000), ref: 009015AD

Strings

strutil.cpp, xrefs: 009015D1

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorLastString
String ID: strutil.cpp
API String ID: 3728238275-3612885251
Opcode ID: 8f993113be7b1f8923057d1a2bdcd042d25a0bdb11be0391e344cfb016e9fc78
Instruction ID: dac9afbdce6a4e5cf78abf0352290e7df2e0ff3d211047ac8313406f979e24dc
Opcode Fuzzy Hash: 8f993113be7b1f8923057d1a2bdcd042d25a0bdb11be0391e344cfb016e9fc78
Instruction Fuzzy Hash: 9501B1336046296BDB219EAA8C44F577AADEF8A760B020225FE15EB190DB20DC1087E1

Function 0094388A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 009438D0
SysFreeString.OLEAUT32(00000000), ref: 00943903

Strings

xmlutil.cpp, xrefs: 009438A0, 009438E7

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: String$AllocFree
String ID: xmlutil.cpp
API String ID: 344208780-1270936966
Opcode ID: 5b30d39d2ac97d0080cfa4d7f29610056cade1feb6c93a3c2813601eb56ac660
Instruction ID: 5d494920aadf5d25821a2cd192d9c51d2c3266f6ad938565399a12d9456c265c
Opcode Fuzzy Hash: 5b30d39d2ac97d0080cfa4d7f29610056cade1feb6c93a3c2813601eb56ac660
Instruction Fuzzy Hash: 3501A275A40215FBDB205A688C09F7B76ECEF857A0F108425FD05A7340C7B8CE0097A1

Function 00943803 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 00943849
SysFreeString.OLEAUT32(00000000), ref: 0094387C

Strings

xmlutil.cpp, xrefs: 00943819, 00943860

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: String$AllocFree
String ID: xmlutil.cpp
API String ID: 344208780-1270936966
Opcode ID: 3591b9befeea83208b916fb81bfafb9f9a9b1727859f4c2aae1640969d92d70e
Instruction ID: 5816bb7eeb85acc38dab5a3296c147139ec5b797a280a8a4babbd4f0ed61f21f
Opcode Fuzzy Hash: 3591b9befeea83208b916fb81bfafb9f9a9b1727859f4c2aae1640969d92d70e
Instruction Fuzzy Hash: DC01A275640215ABDB211A698C05F7B72ECDF85764F10C539FE05A7340C778CE0197A1

Function 00943AC9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00940E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,00945699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 00940E52

RegCloseKey.ADVAPI32(00000000,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00020019,00000000,?,?,?,?,?,0094396A,?), ref: 00943B3A

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, xrefs: 00943AE4
EnableLUA, xrefs: 00943B0C

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CloseOpen
String ID: EnableLUA$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
API String ID: 47109696-3551287084
Opcode ID: 273864fb2a219b6ad40e528afad463b38532d13b34cc5b8d2e5f5c8c32d263ec
Instruction ID: be717deaf596441186b96adfb853c8f9c9ea852058f7f89faafbbbb06df10693
Opcode Fuzzy Hash: 273864fb2a219b6ad40e528afad463b38532d13b34cc5b8d2e5f5c8c32d263ec
Instruction Fuzzy Hash: 8B017C32810238FBD710AAB4C80AFEEFBACDB44725F208166A901A3111D3745E50E7D4

Function 0090501B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(burn.clean.room,?,?,?,?,00901104,?,?,00000000), ref: 0090503A
CompareStringW.KERNEL32(0000007F,00000001,?,0000000F,burn.clean.room,0000000F,?,?,?,?,00901104,?,?,00000000), ref: 0090506A

Strings

burn.clean.room, xrefs: 00905027, 00905034, 00905061

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CompareStringlstrlen
String ID: burn.clean.room
API String ID: 1433953587-3055529264
Opcode ID: aa3202b236019f0313900e4e1f77c41d8e9283ad5a14cd8ee866d4ca053cc06a
Instruction ID: dd72db0070ad0297cc720439724c5f26f571fa968714327737c79039eea0921b
Opcode Fuzzy Hash: aa3202b236019f0313900e4e1f77c41d8e9283ad5a14cd8ee866d4ca053cc06a
Instruction Fuzzy Hash: 3D01ADB7614625AEC3204B98AC88D7BB7BDFB08B64711411AF949D2660D3B0AC40DEE1

Function 00946754 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 009467B3

Part of subcall function 009485CB: SystemTimeToFileTime.KERNEL32(?,00000000,00000000,clbcatq.dll,00000000,clbcatq.dll,00000000,00000000,00000000), ref: 009486D8
Part of subcall function 009485CB: GetLastError.KERNEL32 ref: 009486E2

Strings

clbcatq.dll, xrefs: 00946780
atomutil.cpp, xrefs: 009467A1

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Time$ErrorFileFreeLastStringSystem
String ID: atomutil.cpp$clbcatq.dll
API String ID: 211557998-3749116663
Opcode ID: 4eb06f84420b1462c1d531f223456cfe561b026dcad1feb781c7422cf31a43e9
Instruction ID: c4a2b04614951be6267a441398095704114ab0330e1b05d8317d8566451773cc
Opcode Fuzzy Hash: 4eb06f84420b1462c1d531f223456cfe561b026dcad1feb781c7422cf31a43e9
Instruction Fuzzy Hash: 9201A2B190121AFBDB209F959981C5EFBBCEB46764B50827AF90467100D3319E10D791

Function 00906418 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?), ref: 0090642A

Part of subcall function 009409BB: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00905D8F,00000000), ref: 009409CF
Part of subcall function 009409BB: GetProcAddress.KERNEL32(00000000), ref: 009409D6
Part of subcall function 009409BB: GetLastError.KERNEL32(?,?,?,00905D8F,00000000), ref: 009409ED

Part of subcall function 00905BF0: RegCloseKey.ADVAPI32(00000000,?,00000000,CommonFilesDir,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00020119,00000000), ref: 00905C77

Strings

Failed to get 64-bit folder., xrefs: 0090644D
Failed to set variant value., xrefs: 00906467

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: AddressCloseCurrentErrorHandleLastModuleProcProcess
String ID: Failed to get 64-bit folder.$Failed to set variant value.
API String ID: 3109562764-2681622189
Opcode ID: 042fe7503c8fba842da50e5fd48048e78d1341572f8fd4aa42f1328a9e73b073
Instruction ID: b38352172efa0fadeb3043df9fda067c3cd8440b8a7afdb294e49a8d45406ddc
Opcode Fuzzy Hash: 042fe7503c8fba842da50e5fd48048e78d1341572f8fd4aa42f1328a9e73b073
Instruction Fuzzy Hash: 4B016D32D0122CBFCF11ABA4DC06EAEBA78EB44B61F118256F940B61A2D7719F50D7D0

Function 009033D7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,009010DD,?,00000000), ref: 009033F8
GetLastError.KERNEL32(?,?,?,009010DD,?,00000000), ref: 0090340F

Strings

pathutil.cpp, xrefs: 00903433

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: pathutil.cpp
API String ID: 2776309574-741606033
Opcode ID: 834f474f8f74cfa92e9f72bc35bf9cbb2b1fd82214cde3ebedbf7a6717f7e0dc
Instruction ID: d6547686857b654f6e9966dd14f5e77764e7e9f1db6b4bcef94b5ffa941438d7
Opcode Fuzzy Hash: 834f474f8f74cfa92e9f72bc35bf9cbb2b1fd82214cde3ebedbf7a6717f7e0dc
Instruction Fuzzy Hash: 84F09673B442346FD732566A9C48E97BA9DDB86760B128121FD05EF1A0D775CD0192F0

Function 00910598 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00940E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,00945699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 00940E52

RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,00000001,00000000,?,?,0092BB7C,00000101,?), ref: 009105EF

Strings

Failed to update resume mode., xrefs: 009105D9
Failed to open registration key., xrefs: 009105BF

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CloseOpen
String ID: Failed to open registration key.$Failed to update resume mode.
API String ID: 47109696-3366686031
Opcode ID: de2f4eaa04872df7d08d6dfdfc9aed31e89776aff01ee6215eeb83d4421a8ab6
Instruction ID: 65c6e7ba37485f770fbdd68a5223adec68cc838c85bfd04316d9c893c51c3765
Opcode Fuzzy Hash: de2f4eaa04872df7d08d6dfdfc9aed31e89776aff01ee6215eeb83d4421a8ab6
Instruction Fuzzy Hash: 5EF04C32A4122CB7C7229A95DC02FDEB76EEF80754F100015FA00B2150DBB2AF90A7D0

Function 009448CB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetFileSizeEx.KERNEL32(00000000,00000000,00000000,74DF34C0,?,?,?,0090B919,?,?,?,00000000,00000000), ref: 009448E3
GetLastError.KERNEL32(?,?,?,0090B919,?,?,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 009448ED

Strings

fileutil.cpp, xrefs: 00944911

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: ErrorFileLastSize
String ID: fileutil.cpp
API String ID: 464720113-2967768451
Opcode ID: 76d0a8ecacdd84fed5bb4ca792e87bef2cb87145bc3ab42b7168da13543a803a
Instruction ID: 13a0a33279444dcf96fe3fb51ab91cabda04226c42155a48acb461b097ca5a65
Opcode Fuzzy Hash: 76d0a8ecacdd84fed5bb4ca792e87bef2cb87145bc3ab42b7168da13543a803a
Instruction Fuzzy Hash: 8AF0C2B6A10225AFE7109F99C804AABFBECEF49751B01422AFC04E3300D370AD10DBE0

Function 00943C58 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36comCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(Microsoft.Update.AutoUpdate,0090535E,?,00000000,0090535E,?,?,?), ref: 00943C7F
CoCreateInstance.OLE32(00000000,00000000,00000001,00966F3C,?), ref: 00943C97

Strings

Microsoft.Update.AutoUpdate, xrefs: 00943C7A

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: CreateFromInstanceProg
String ID: Microsoft.Update.AutoUpdate
API String ID: 2151042543-675569418
Opcode ID: 8ba77fa51b13564707d19cdb9c81782bfc609c370f2dfe64894bacba9a0370ab
Instruction ID: dff75604daffb44b2c9ea24fde4b1479954adba824322385a31896f8062705a7
Opcode Fuzzy Hash: 8ba77fa51b13564707d19cdb9c81782bfc609c370f2dfe64894bacba9a0370ab
Instruction Fuzzy Hash: C7F03075615218BBDB00DFA9DD45DBBB7B8DB49710F410069E901F7150D670AA0496A2

Function 009430BF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 009430D4
SysFreeString.OLEAUT32(00000000), ref: 00943104

Strings

xmlutil.cpp, xrefs: 009430E8

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: String$AllocFree
String ID: xmlutil.cpp
API String ID: 344208780-1270936966
Opcode ID: a2e93e4f7bc5b76c3eb2286757bd908c2221b5cce516719c10a3bc1dff84afdd
Instruction ID: 97f1644af4f10f44c0b772661181c83958b7b9a9076d0e2ca2ddad90a5d98824
Opcode Fuzzy Hash: a2e93e4f7bc5b76c3eb2286757bd908c2221b5cce516719c10a3bc1dff84afdd
Instruction Fuzzy Hash: 6BF0B435209258E7CB219F249C09F6B7BB9AB89B60F248029FC0557210C7758E109AA1

Function 0094336E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00943383
SysFreeString.OLEAUT32(00000000), ref: 009433B3

Strings

xmlutil.cpp, xrefs: 0094339A

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: String$AllocFree
String ID: xmlutil.cpp
API String ID: 344208780-1270936966
Opcode ID: 1fba6262124964f2ec013e8c460967102c252dce7b3b3db7f26fd669922b248a
Instruction ID: 3cd1ffb51643dcc1d48efd48c84543019fac983aa7856a3bab39d545f44375da
Opcode Fuzzy Hash: 1fba6262124964f2ec013e8c460967102c252dce7b3b3db7f26fd669922b248a
Instruction Fuzzy Hash: 23F0E23A200218EBC7221F299C08F6F3BACEF857A0F508119FC059B210CB78CE00DAE1

Function 00941344 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.ADVAPI32(?,?,00000000,00000004,?,00000004,SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce,?,0090F11A,00000005,Resume,?,?,?,00000002,00000000), ref: 00941359

Strings

regutil.cpp, xrefs: 00941381
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00941347

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: Value
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce$regutil.cpp
API String ID: 3702945584-2416625845
Opcode ID: 95ae9c945e2969c8566079bc4c9d85e28e448c788b4fc71f54236afdb3dad6e5
Instruction ID: ad7f9042f7cf79eb05bf51d50e7e32e4e705e55d71c2af189cf704034a8c0664
Opcode Fuzzy Hash: 95ae9c945e2969c8566079bc4c9d85e28e448c788b4fc71f54236afdb3dad6e5
Instruction Fuzzy Hash: ECE06D72B442357AE7205AA68C05F977ADCDB04AE0F014025BE08EA0A0E6618D0082E4

Function 0093FCBC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(75A70000,00000001,00905497,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0093FCC9
FreeLibrary.KERNEL32(00000000,00000001,00905497,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0093FCEB

Strings

`+9s, xrefs: 0093FCDB

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: FreeLibrary
String ID: `+9s
API String ID: 3664257935-3924962338
Opcode ID: 56a8d4a2ddf95c8552a580bc780c114bb7c70fedec73dd882fe8dfbaaecd2735
Instruction ID: e226a590b5f2fa740c3ed8fe5a033a6a85baef055bf9aec0ca0fc841844d9181
Opcode Fuzzy Hash: 56a8d4a2ddf95c8552a580bc780c114bb7c70fedec73dd882fe8dfbaaecd2735
Instruction Fuzzy Hash: DCE0DEB592C3069B97008F6BFD58A85FBECBA95751344412EF512C2274E7B08481BF11

Function 00940CD1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 00940CF2

Strings

RegDeleteKeyExW, xrefs: 00940CE7
AdvApi32.dll, xrefs: 00940CD7

Memory Dump Source

Source File: 00000001.00000002.2974068156.0000000000901000.00000020.00000001.01000000.00000005.sdmp, Offset: 00900000, based on PE: true

Associated: 00000001.00000002.2973993067.0000000000900000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974191946.000000000094B000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974259880.000000000096A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974311899.000000000096E000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_900000_UNK_.jbxd

Similarity

API ID: AddressProc
String ID: AdvApi32.dll$RegDeleteKeyExW
API String ID: 190572456-850864035
Opcode ID: 3de87ae8d8f95cfe8d32ac5a83caafc83b80d36a3e56d7d76f09caec363453fd
Instruction ID: d9c3efb0a0cd452d55851b88d4256e5f4f0fcea3420ac12a1b26a5426e3905af
Opcode Fuzzy Hash: 3de87ae8d8f95cfe8d32ac5a83caafc83b80d36a3e56d7d76f09caec363453fd
Instruction Fuzzy Hash: 10E08CB172DA249BCB049F24FD06A053AA0AB94B29300812DE806D22B1FBF05880AB90

Analysis Process: ._cache_file.exePID: 1608, Parent PID: 2312COMMON

Executed Functions

Function 00CE1070 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 77fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CE33D7: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,00CE10DD,?,00000000), ref: 00CE33F8

CreateFileW.KERNELBASE(?,80000000,00000005,00000000,00000003,00000080,00000000,?,00000000), ref: 00CE10F6

Part of subcall function 00CE1174: HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,00CE111A,cabinet.dll,00000009,?,?,00000000), ref: 00CE1185
Part of subcall function 00CE1174: GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,00CE111A,cabinet.dll,00000009,?,?,00000000), ref: 00CE1190
Part of subcall function 00CE1174: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00CE119E
Part of subcall function 00CE1174: GetLastError.KERNEL32(?,?,?,?,00CE111A,cabinet.dll,00000009,?,?,00000000), ref: 00CE11B9
Part of subcall function 00CE1174: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00CE11C1
Part of subcall function 00CE1174: GetLastError.KERNEL32(?,?,?,?,00CE111A,cabinet.dll,00000009,?,?,00000000), ref: 00CE11D6

CloseHandle.KERNEL32(?,?,?,?,00D2B4C0,?,cabinet.dll,00000009,?,?,00000000), ref: 00CE1131

Strings

cabinet.dll, xrefs: 00CE1099
clbcatq.dll, xrefs: 00CE10BC
crypt32.dll, xrefs: 00CE10CA
msi.dll, xrefs: 00CE10A0
msasn1.dll, xrefs: 00CE10C3
wininet.dll, xrefs: 00CE10AE
feclient.dll, xrefs: 00CE10D1
comres.dll, xrefs: 00CE10B5
version.dll, xrefs: 00CE10A7

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: AddressErrorFileHandleLastModuleProc$CloseCreateHeapInformationName
String ID: cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$feclient.dll$msasn1.dll$msi.dll$version.dll$wininet.dll
API String ID: 3687706282-3151496603
Opcode ID: 8ef1f5768766c4b0cedd8c43145a21c40762b719f2f33d7b3adc8e05d3fcd580
Instruction ID: 140fe5a82b94b4aee25d34a3a30f5d7dcb14767d7a75514914c5dceb16707b85
Opcode Fuzzy Hash: 8ef1f5768766c4b0cedd8c43145a21c40762b719f2f33d7b3adc8e05d3fcd580
Instruction Fuzzy Hash: 4D21A671900258ABCB10EFA6DC45BEEBBB8EF15728F144116F920B7391D7B05515CBB0

Function 6CF61C04 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(00000000,00000000,bafunctions.dll,00000000,?,00000000,?,?,6CF61B21,?,00000000,00000000,?,00000000,00000000,?), ref: 6CF61C31
GetProcAddress.KERNEL32(00000000,CreateBootstrapperBAFunction), ref: 6CF61C47
GetLastError.KERNEL32(?,6CF61B21,?,00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000,?,00000001), ref: 6CF61C53
FreeLibrary.KERNEL32(?), ref: 6CF61CBD

Strings

Failed to create BA function., xrefs: 6CF61C9C
Failed to get CreateBootstrapperBAFunction entry-point from: %ls, xrefs: 6CF61C67
CreateBootstrapperBAFunction, xrefs: 6CF61C41
Failed to get path to BA function DLL., xrefs: 6CF61C27
bafunctions.dll, xrefs: 6CF61C16

Memory Dump Source

Source File: 00000002.00000002.2976644492.000000006CF61000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF60000, based on PE: true

Associated: 00000002.00000002.2976608888.000000006CF60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976693645.000000006CF7F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976757688.000000006CF8A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976814931.000000006CF8C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cf60000_UNK_.jbxd

Similarity

API ID: Library$AddressErrorFreeLastLoadProc
String ID: CreateBootstrapperBAFunction$Failed to create BA function.$Failed to get CreateBootstrapperBAFunction entry-point from: %ls$Failed to get path to BA function DLL.$bafunctions.dll
API String ID: 2540614322-2645503994
Opcode ID: 7ee13d6259b03a090597874e95a827986389b51b62d31f2da63508a8a02cdcb3
Instruction ID: 8504714715e7dffc39b7105abef0b12ff579417309bdb26919604c5ad99e1a69
Opcode Fuzzy Hash: 7ee13d6259b03a090597874e95a827986389b51b62d31f2da63508a8a02cdcb3
Instruction Fuzzy Hash: 90219F32A15616BBDB064BA6DE05BDEB6B8AB04319F114229E804E2E50EB32DD1096D0

Function 00D1FDC2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130threadtimeCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00D4B60C,00000000,?,?,?,?,00D01014,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 00D1FDF0
GetCurrentProcessId.KERNEL32(00000000,?,00D01014,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 00D1FE00
GetCurrentThreadId.KERNEL32 ref: 00D1FE09
GetLocalTime.KERNEL32(8007139F,?,00D01014,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 00D1FE1F
LeaveCriticalSection.KERNEL32(00D4B60C,?,00000000,00000000,0000FDE9), ref: 00D1FF12

Strings

%ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls, xrefs: 00D1FEB9

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: CriticalCurrentSection$EnterLeaveLocalProcessThreadTime
String ID: %ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls
API String ID: 296830338-59366893
Opcode ID: 6839c4ef414591f3cbf795e6391d4b26154ced50d17a96fb43f6eea303ad90d9
Instruction ID: 32cb08c1bbbd261919ffbe997345bda14c5b6ec44771c4920a5a121c4a6c6c96
Opcode Fuzzy Hash: 6839c4ef414591f3cbf795e6391d4b26154ced50d17a96fb43f6eea303ad90d9
Instruction Fuzzy Hash: 64417E76900219BBDB219FA4EC45AFEB7F9EB19721F044026F901E6260DB348D85CBB1

Function 00CF9EB7 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51COMMON

Download Yara Rule

Strings

Failed create working folder., xrefs: 00CF9EEA
Failed to calculate working folder to ensure it exists., xrefs: 00CF9ED4
Failed to copy working folder., xrefs: 00CF9F12

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: CurrentDirectoryErrorLastProcessWindows
String ID: Failed create working folder.$Failed to calculate working folder to ensure it exists.$Failed to copy working folder.
API String ID: 3841436932-2072961686
Opcode ID: c6ff786882cc2913f7e673959df01526345c44856973c4ab1a4665c39f06d889
Instruction ID: d3ab64d7693baa3dd666d56c33f533803cb8061ca318aa8ed9732dd51708121f
Opcode Fuzzy Hash: c6ff786882cc2913f7e673959df01526345c44856973c4ab1a4665c39f06d889
Instruction Fuzzy Hash: 8F018832D0462CFB8F626B56DC05D7F7B78DF90720B114156FA04E6216DB718F50A6E1

Function 6CF665CB Relevance: 3.0, APIs: 2, Instructions: 44fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000000,00000000,?), ref: 6CF66606
FindClose.KERNELBASE(00000000), ref: 6CF66612

Memory Dump Source

Source File: 00000002.00000002.2976644492.000000006CF61000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF60000, based on PE: true

Associated: 00000002.00000002.2976608888.000000006CF60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976693645.000000006CF7F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976757688.000000006CF8A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976814931.000000006CF8C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cf60000_UNK_.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 08b99125ad59b6183bd121758ef04702d00ff499af44916733e9be8656e61f3b
Instruction ID: ab4a9601c6167721baee70872c2059d343a23933e9b0cec5f2bd070b6740591e
Opcode Fuzzy Hash: 08b99125ad59b6183bd121758ef04702d00ff499af44916733e9be8656e61f3b
Instruction Fuzzy Hash: B901FE31B01118ABDB10EF66ED48EAAB7BCDBC6319F000565F914D7640D630594D8750

Function 00CEF86E Relevance: 112.4, APIs: 3, Strings: 61, Instructions: 445
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

DisableRemove, xrefs: 00CEFC53
Failed to get @ProviderKey., xrefs: 00CEF970
DisplayVersion, xrefs: 00CEFA2D
Version, xrefs: 00CEF91B
Failed to get @Comments., xrefs: 00CEFB4A
Failed to get @PerMachine., xrefs: 00CEF9AF
Publisher, xrefs: 00CEFA52
Name, xrefs: 00CEFD4B
Failed to get @Department., xrefs: 00CEFD18
Failed to get @AboutUrl., xrefs: 00CEFAD8
Failed to get @HelpLink., xrefs: 00CEFA8E
yes, xrefs: 00CEFBC0
Failed to get @Contact., xrefs: 00CEFB72
Update, xrefs: 00CEFCA8
AboutUrl, xrefs: 00CEFAC1
DisableModify, xrefs: 00CEFB80
Failed to parse software tag., xrefs: 00CEFC9A
Failed to get @Publisher., xrefs: 00CEFA69
Department, xrefs: 00CEFD01
Invalid modify disabled type: %ls, xrefs: 00CEFC1E
Failed to set registration paths., xrefs: 00CEFD92
Failed to get @Register., xrefs: 00CEF9FA
Comments, xrefs: 00CEFB33
ProductFamily, xrefs: 00CEFD26
HelpLink, xrefs: 00CEFA77
Failed to get @Version., xrefs: 00CEF92E
Failed to parse @Version: %ls, xrefs: 00CEF94F
Arp, xrefs: 00CEF9BD
ExecutableName, xrefs: 00CEF97E
Failed to get @ExecutableName., xrefs: 00CEF991
Failed to get @DisplayVersion., xrefs: 00CEFA44
Failed to get @HelpTelephone., xrefs: 00CEFAB3
Failed to get @DisplayName., xrefs: 00CEFA1F
UpdateUrl, xrefs: 00CEFAE6
Failed to get @UpdateUrl., xrefs: 00CEFAFD
Classification, xrefs: 00CEFD6C
Failed to get @Manufacturer., xrefs: 00CEFCF0
button, xrefs: 00CEFB9F
Contact, xrefs: 00CEFB5B
Failed to get @Name., xrefs: 00CEFD5E
Register, xrefs: 00CEF9E7
PerMachine, xrefs: 00CEF99C
Manufacturer, xrefs: 00CEFCDD
Failed to get @DisableRemove., xrefs: 00CEFC6A
ProviderKey, xrefs: 00CEF95D
Failed to parse related bundles, xrefs: 00CEF90D
Tag, xrefs: 00CEF8E1
Failed to select Update node., xrefs: 00CEFCC6
Failed to select registration node., xrefs: 00CEF8A6
Failed to get @Tag., xrefs: 00CEF8F4
Failed to get @Id., xrefs: 00CEF8D3
HelpTelephone, xrefs: 00CEFA9C
Registration, xrefs: 00CEF888
DisplayName, xrefs: 00CEFA08
Failed to get @Classification., xrefs: 00CEFD7F
Failed to get @DisableModify., xrefs: 00CEFC42
ParentDisplayName, xrefs: 00CEFB0B
Failed to select ARP node., xrefs: 00CEF9D9
Failed to get @ParentDisplayName., xrefs: 00CEFB22
Failed to get @ProductFamily., xrefs: 00CEFD3D
registration.cpp, xrefs: 00CEFC11

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID:
String ID: AboutUrl$Arp$Classification$Comments$Contact$Department$DisableModify$DisableRemove$DisplayName$DisplayVersion$ExecutableName$Failed to get @AboutUrl.$Failed to get @Classification.$Failed to get @Comments.$Failed to get @Contact.$Failed to get @Department.$Failed to get @DisableModify.$Failed to get @DisableRemove.$Failed to get @DisplayName.$Failed to get @DisplayVersion.$Failed to get @ExecutableName.$Failed to get @HelpLink.$Failed to get @HelpTelephone.$Failed to get @Id.$Failed to get @Manufacturer.$Failed to get @Name.$Failed to get @ParentDisplayName.$Failed to get @PerMachine.$Failed to get @ProductFamily.$Failed to get @ProviderKey.$Failed to get @Publisher.$Failed to get @Register.$Failed to get @Tag.$Failed to get @UpdateUrl.$Failed to get @Version.$Failed to parse @Version: %ls$Failed to parse related bundles$Failed to parse software tag.$Failed to select ARP node.$Failed to select Update node.$Failed to select registration node.$Failed to set registration paths.$HelpLink$HelpTelephone$Invalid modify disabled type: %ls$Manufacturer$Name$ParentDisplayName$PerMachine$ProductFamily$ProviderKey$Publisher$Register$Registration$Tag$Update$UpdateUrl$Version$button$registration.cpp$yes
API String ID: 0-2956246334
Opcode ID: 0ba571759ab5d9f183c28c767b7de6a574b3210199b7c16807dc7ebdf6234fdf
Instruction ID: ede58ff9b3c0cbf92edb72020fd5480dc7dec462b91efde8ae6cacb4db77db9b
Opcode Fuzzy Hash: 0ba571759ab5d9f183c28c767b7de6a574b3210199b7c16807dc7ebdf6234fdf
Instruction Fuzzy Hash: 1DE1E636E407B6BFCB229AA2CC42EED7E64AB10724F110278FD10B6190D7A15F5697B0

Function 00CEB389 Relevance: 91.6, APIs: 24, Strings: 28, Instructions: 565
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,00000000,76EEC3F0,00000000), ref: 00CEB3FF
SetFilePointerEx.KERNELBASE(000000FF,00000000,00000000,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 00CEB44C
GetLastError.KERNEL32(?,?,?,00000000,76EEC3F0,00000000), ref: 00CEB452
ReadFile.KERNELBASE(00000000,00CE435C,00000040,?,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 00CEB49A
GetLastError.KERNEL32(?,?,?,00000000,76EEC3F0,00000000), ref: 00CEB4A0
SetFilePointerEx.KERNELBASE(00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 00CEB4FD
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 00CEB503
ReadFile.KERNELBASE(00000000,?,00000018,00000040,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 00CEB54C
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 00CEB552
SetFilePointerEx.KERNELBASE(00000000,-00000098,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 00CEB5C3
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 00CEB5C9

Strings

PE Header from file didn't match PE Header in memory., xrefs: 00CEBA0D
Failed to read section info, data to short: %u, xrefs: 00CEB7A6
Failed to seek past optional headers., xrefs: 00CEB6E7
burn, xrefs: 00CEB734
Failed to read complete image section header, index: %u, xrefs: 00CEBA71
Failed to read signature size., xrefs: 00CEB692
Failed to allocate buffer for section info., xrefs: 00CEB7E0
Failed to allocate memory for container sizes., xrefs: 00CEB9CF
Failed to find valid NT image header in buffer., xrefs: 00CEBACC
Failed to get total size of bundle., xrefs: 00CEB91F
Failed to read complete section info., xrefs: 00CEB8C1
Failed to read NT header., xrefs: 00CEB57D
Failed to find valid DOS image header in buffer., xrefs: 00CEBAE7
Failed to read DOS header., xrefs: 00CEB4CB
.wix, xrefs: 00CEB72C
Failed to find Burn section., xrefs: 00CEBA2E
4, xrefs: 00CEB780
Failed to seek to NT header., xrefs: 00CEB52E
Failed to read image section header, index: %u, xrefs: 00CEBAA8
(, xrefs: 00CEB719
Failed to open handle to engine process path., xrefs: 00CEB42A
Failed to seek to start of file., xrefs: 00CEB47D
Failed to read section info, unsupported version: %08x, xrefs: 00CEB8F1
Failed to read signature offset., xrefs: 00CEB643
Failed to read section info., xrefs: 00CEB895
Failed to seek to section info., xrefs: 00CEB5F4, 00CEB830
section.cpp, xrefs: 00CEB420, 00CEB473, 00CEB4C1, 00CEB524, 00CEB573, 00CEB5EA, 00CEB639, 00CEB688, 00CEB6DD, 00CEB794, 00CEB7D4, 00CEB826, 00CEB88B, 00CEB8B5, 00CEB8DC, 00CEB9C3, 00CEBA03, 00CEBA22, 00CEBA5F, 00CEBA9D, 00CEBAC0, 00CEBADB
PE, xrefs: 00CEB594

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: ErrorLast$File$Pointer$Read
String ID: ($.wix$4$Failed to allocate buffer for section info.$Failed to allocate memory for container sizes.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get total size of bundle.$Failed to open handle to engine process path.$Failed to read DOS header.$Failed to read NT header.$Failed to read complete image section header, index: %u$Failed to read complete section info.$Failed to read image section header, index: %u$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$Failed to read section info.$Failed to read signature offset.$Failed to read signature size.$Failed to seek past optional headers.$Failed to seek to NT header.$Failed to seek to section info.$Failed to seek to start of file.$PE$PE Header from file didn't match PE Header in memory.$burn$section.cpp
API String ID: 2600052162-695169583
Opcode ID: 735d09757dd568b66072bd2a01e31bdb2c557a5dceed0b84fadb8fec1b1e5ad3
Instruction ID: d481b14072c018e43e5a641d2ab3b41d7b0b718e75672455ee98f0460a7be329
Opcode Fuzzy Hash: 735d09757dd568b66072bd2a01e31bdb2c557a5dceed0b84fadb8fec1b1e5ad3
Instruction Fuzzy Hash: 1C12EF72A40374AFEB219A26DD85FBB76E8EF05710F000165BD09EB281D7719E41DBB1

Function 6CF6940E Relevance: 58.4, APIs: 2, Strings: 31, Instructions: 624COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(6CF69FC4), ref: 6CF69B68

Part of subcall function 6CF6C938: VariantInit.OLEAUT32(00000000), ref: 6CF6C94E
Part of subcall function 6CF6C938: SysAllocString.OLEAUT32(?), ref: 6CF6C96A
Part of subcall function 6CF6C938: VariantClear.OLEAUT32(?), ref: 6CF6C9F1
Part of subcall function 6CF6C938: SysFreeString.OLEAUT32(00000000), ref: 6CF6C9FC

SysFreeString.OLEAUT32(6CF69FC4), ref: 6CF69843

Strings

Center, xrefs: 6CF698CC
HasLines, xrefs: 6CF69B2E
Width, xrefs: 6CF69565
HoverFontId, xrefs: 6CF69661
HasButtons, xrefs: 6CF69AB8
DisablePrefix, xrefs: 6CF698FA
StringId, xrefs: 6CF697D9
sid, xrefs: 6CF697EF
EnableDragDrop, xrefs: 6CF69A5E
FileSystemAutoComplete, xrefs: 6CF697AE
HideWhenDisabled, xrefs: 6CF69783
SourceY, xrefs: 6CF695F1
HexStyle, xrefs: 6CF696D3
ImageList, xrefs: 6CF6996A
ImageListSmall, xrefs: 6CF699A1
Visible, xrefs: 6CF69755
Name, xrefs: 6CF69493
FontId, xrefs: 6CF69629
SourceX, xrefs: 6CF695B9
Height, xrefs: 6CF6952B
HexExtendedStyle, xrefs: 6CF69939
FullRowSelect, xrefs: 6CF69A8B
ImageListGroupHeader, xrefs: 6CF69A0F
thmutil.cpp, xrefs: 6CF69461
AlwaysShowSelect, xrefs: 6CF69AE2
TabStop, xrefs: 6CF69702
LinesAtRoot, xrefs: 6CF69B08
Loop, xrefs: 6CF69863
Interval, xrefs: 6CF6988D
SelectedFontId, xrefs: 6CF69699
ImageListState, xrefs: 6CF699D8

Memory Dump Source

Source File: 00000002.00000002.2976644492.000000006CF61000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF60000, based on PE: true

Associated: 00000002.00000002.2976608888.000000006CF60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976693645.000000006CF7F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976757688.000000006CF8A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976814931.000000006CF8C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cf60000_UNK_.jbxd

Similarity

API ID: String$Free$Variant$AllocClearInit
String ID: AlwaysShowSelect$Center$DisablePrefix$EnableDragDrop$FileSystemAutoComplete$FontId$FullRowSelect$HasButtons$HasLines$Height$HexExtendedStyle$HexStyle$HideWhenDisabled$HoverFontId$ImageList$ImageListGroupHeader$ImageListSmall$ImageListState$Interval$LinesAtRoot$Loop$Name$SelectedFontId$SourceX$SourceY$StringId$TabStop$Visible$Width$sid$thmutil.cpp
API String ID: 3564436086-2239863677
Opcode ID: 927aa237bee7e1bcc720ce5e3c3275a30139e92f0fc75af4fc38c0852a95582c
Instruction ID: a7b227d983347c0098c7baecf797ff29f265a44513854156d58501463d7fb7d6
Opcode Fuzzy Hash: 927aa237bee7e1bcc720ce5e3c3275a30139e92f0fc75af4fc38c0852a95582c
Instruction Fuzzy Hash: 11120932C02129ABCB15EB638894AEE76BCDB05758F0106A5ED50FBE40DB25EF44D7B0

Function 00D00A77 Relevance: 54.5, APIs: 20, Strings: 11, Instructions: 288
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEvent.KERNEL32(?,?,?,?,00000000,00000000,?,00D00621,?,?), ref: 00D00A85
GetLastError.KERNEL32(?,?,?,00000000,00000000,?,00D00621,?,?), ref: 00D00A92
WaitForSingleObject.KERNEL32(?,?,?,?,?,00000000,00000000,?,00D00621,?,?), ref: 00D00ACE
GetLastError.KERNEL32(?,?,?,?,00000000,00000000,?,00D00621,?,?), ref: 00D00AD8

Strings

Failed to set file pointer to beginning of file., xrefs: 00D00E20
Failed to wait for begin operation event., xrefs: 00D00B06
Failed to set operation complete event., xrefs: 00D00AC0
Failed to create file: %ls, xrefs: 00D00D38
Invalid operation for this state., xrefs: 00D00B79
Failed to set end of file., xrefs: 00D00DCC
Failed to copy stream name: %ls, xrefs: 00D00BB7
Failed to set file pointer to end of file., xrefs: 00D00D87
Failed to allocate buffer for stream., xrefs: 00D00CC8
Failed to reset begin operation event., xrefs: 00D00B4B
cabextract.cpp, xrefs: 00D00AB6, 00D00AFC, 00D00B41, 00D00B6D, 00D00CBE, 00D00D2B, 00D00D7D, 00D00DC2, 00D00E16

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: ErrorLast$EventObjectSingleWait
String ID: Failed to allocate buffer for stream.$Failed to copy stream name: %ls$Failed to create file: %ls$Failed to reset begin operation event.$Failed to set end of file.$Failed to set file pointer to beginning of file.$Failed to set file pointer to end of file.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$cabextract.cpp
API String ID: 3600396749-2104912459
Opcode ID: 8f00b7e32eca93be08ef064d9712293786b2bb7e9f780c10881007dd5c02ae53
Instruction ID: feca8913aa155ed2469035aff247c85212c7cb339cb61295921c65f8cb6e69b9
Opcode Fuzzy Hash: 8f00b7e32eca93be08ef064d9712293786b2bb7e9f780c10881007dd5c02ae53
Instruction Fuzzy Hash: 6191C172B80721BFE7216A798E49B673AD4EF04760F014226BD09FB6E0D7A1DC1096F5

Function 00CE508D Relevance: 44.1, APIs: 5, Strings: 20, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?), ref: 00CE510F

Part of subcall function 00D203F0: InitializeCriticalSection.KERNEL32(00D4B60C,?,00CE511B,00000000,?,?,?,?,?,?), ref: 00D20407

Part of subcall function 00CE1209: CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,00CE5137,00000000,?), ref: 00CE1247
Part of subcall function 00CE1209: GetLastError.KERNEL32(?,?,?,00CE5137,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 00CE1251

CoInitializeEx.COMBASE(00000000,00000000,?,?,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 00CE517D

Part of subcall function 00D20CD1: GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 00D20CF2

GetVersionExW.KERNEL32(?,?,?,?,?,?,?), ref: 00CE520F
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 00CE5219
CoUninitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00CE549B

Strings

Failed to run per-user mode., xrefs: 00CE538C
Failed to initialize XML util., xrefs: 00CE51F1
Invalid run mode., xrefs: 00CE52F1
Failed to initialize Cryputil., xrefs: 00CE519E
Failed to run embedded mode., xrefs: 00CE533C
Failed to initialize engine state., xrefs: 00CE5164
txt, xrefs: 00CE53F2
Failed to run untrusted mode., xrefs: 00CE53AE
Failed to run RunOnce mode., xrefs: 00CE5314
Setup, xrefs: 00CE53FC
Failed to initialize core., xrefs: 00CE52BB
Failed to get OS info., xrefs: 00CE5247
_Failed, xrefs: 00CE53F7
Failed to initialize COM., xrefs: 00CE5189
Failed to run per-machine mode., xrefs: 00CE5364
Failed to initialize Wiutil., xrefs: 00CE51D9
Failed to parse command line., xrefs: 00CE513D
engine.cpp, xrefs: 00CE523D
Failed to initialize Regutil., xrefs: 00CE51C1
3.10.4.4718, xrefs: 00CE527C

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: ErrorInitializeLast$AddressArgvCommandCriticalHandleLineModuleProcSectionUninitializeVersion
String ID: 3.10.4.4718$Failed to get OS info.$Failed to initialize COM.$Failed to initialize Cryputil.$Failed to initialize Regutil.$Failed to initialize Wiutil.$Failed to initialize XML util.$Failed to initialize core.$Failed to initialize engine state.$Failed to parse command line.$Failed to run RunOnce mode.$Failed to run embedded mode.$Failed to run per-machine mode.$Failed to run per-user mode.$Failed to run untrusted mode.$Invalid run mode.$Setup$_Failed$engine.cpp$txt
API String ID: 3262001429-867073019
Opcode ID: 318c5be44143ceb26ef2ebcb12f86de8eadc7bd16b47cc495e23fbc59d5c5d47
Instruction ID: 1870614009ad8a30d0fc1031d13a376d7e559b8ee9bb0bb9d0fc436957df0e85
Opcode Fuzzy Hash: 318c5be44143ceb26ef2ebcb12f86de8eadc7bd16b47cc495e23fbc59d5c5d47
Instruction Fuzzy Hash: 00B1D872D40A789BDB32AF66DC46BED77B4AF14318F040095F909B6241D7709F849FA1

Function 00CE567D Relevance: 42.5, APIs: 5, Strings: 19, Instructions: 476
stringCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(000002C0,00000100,00000100,00000000,00000000,?,00CE99BB,000002C0,?,00000000,00000000,000002C0,00000100,000002C0,00000100), ref: 00CE56A2
lstrlenW.KERNEL32(00000000,?,00CE99BB,000002C0,?,00000000,00000000,000002C0,00000100,000002C0,00000100), ref: 00CE56AC
_wcschr.LIBVCRUNTIME ref: 00CE58B4
LeaveCriticalSection.KERNEL32(000002C0,00000000,00000000,00000000,00000000,00000000,00000001,?,00CE99BB,000002C0,?,00000000,00000000,000002C0,00000100,000002C0), ref: 00CE5B56

Strings

Failed to allocate variable array., xrefs: 00CE5991
Failed to allocate buffer for format string., xrefs: 00CE56CA
Failed to append string., xrefs: 00CE5728
Failed to append placeholder., xrefs: 00CE5959
Failed to set variable value., xrefs: 00CE596D
Failed to allocate string., xrefs: 00CE5AD1
Failed to reallocate variable array., xrefs: 00CE5938
*****, xrefs: 00CE5820
Failed to format placeholder string., xrefs: 00CE5963
Failed to get variable name., xrefs: 00CE5998
[%d], xrefs: 00CE586F
Failed to set record format string., xrefs: 00CE59DD
Failed to set record string., xrefs: 00CE5AA2
Failed to allocate record., xrefs: 00CE5917
variable.cpp, xrefs: 00CE590A, 00CE592B, 00CE5984, 00CE59D0, 00CE5A60, 00CE5A95, 00CE5B0D
Failed to determine variable visibility: '%ls'., xrefs: 00CE5946
Failed to get formatted length., xrefs: 00CE5A6D
Failed to copy string., xrefs: 00CE5B3A
Failed to format record., xrefs: 00CE5B1A

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: CriticalSection$EnterLeave_wcschrlstrlen
String ID: *****$Failed to allocate buffer for format string.$Failed to allocate record.$Failed to allocate string.$Failed to allocate variable array.$Failed to append placeholder.$Failed to append string.$Failed to copy string.$Failed to determine variable visibility: '%ls'.$Failed to format placeholder string.$Failed to format record.$Failed to get formatted length.$Failed to get variable name.$Failed to reallocate variable array.$Failed to set record format string.$Failed to set record string.$Failed to set variable value.$[%d]$variable.cpp
API String ID: 1026845265-2050445661
Opcode ID: 066b855d3963de8be8551ecf9adf733b063480f50bf9dc4fb692943b1a117a46
Instruction ID: 92e8354c77b4749f97b9083234e8c26bc1ca240cb14db97be1b530a5493c7758
Opcode Fuzzy Hash: 066b855d3963de8be8551ecf9adf733b063480f50bf9dc4fb692943b1a117a46
Instruction Fuzzy Hash: E2F1D4B1D00769EFDB21DFA6C841AAF7BA9EF04754F11412AFD14A7240D7349E419BA0

Function 00CF7337 Relevance: 35.3, APIs: 1, Strings: 19, Instructions: 277
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to get unique temporary folder for bootstrapper application., xrefs: 00CF75BC
Failed to load manifest., xrefs: 00CF73F5
Failed to set original source variable., xrefs: 00CF7558
Failed to open manifest stream., xrefs: 00CF73B8
Failed to initialize variables., xrefs: 00CF737E
Failed to get source process folder from path., xrefs: 00CF7513
Failed to overwrite the %ls built-in variable., xrefs: 00CF74C9
WixBundleElevated, xrefs: 00CF74B3, 00CF74C4
Failed to extract bootstrapper application payloads., xrefs: 00CF75DD
WixBundleOriginalSource, xrefs: 00CF7547
Failed to get manifest stream from container., xrefs: 00CF73D9
Failed to parse command line., xrefs: 00CF7474
Failed to set source process folder variable., xrefs: 00CF7533
WixBundleSourceProcessPath, xrefs: 00CF74E6
WixBundleSourceProcessFolder, xrefs: 00CF7522
Failed to set source process path variable., xrefs: 00CF74F7
Failed to open attached UX container., xrefs: 00CF739B
Failed to load catalog files., xrefs: 00CF75FD
Failed to initialize internal cache functionality., xrefs: 00CF758D

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: Failed to extract bootstrapper application payloads.$Failed to get manifest stream from container.$Failed to get source process folder from path.$Failed to get unique temporary folder for bootstrapper application.$Failed to initialize internal cache functionality.$Failed to initialize variables.$Failed to load catalog files.$Failed to load manifest.$Failed to open attached UX container.$Failed to open manifest stream.$Failed to overwrite the %ls built-in variable.$Failed to parse command line.$Failed to set original source variable.$Failed to set source process folder variable.$Failed to set source process path variable.$WixBundleElevated$WixBundleOriginalSource$WixBundleSourceProcessFolder$WixBundleSourceProcessPath
API String ID: 32694325-252221001
Opcode ID: 5be001c0176643820976aeb8a7e6e7f80567fb65990b78b4591647634f905555
Instruction ID: 7a33644d0bfd95ff8eafad2aa54abc567b84ac2fba7ebd7cbfc8bf6bf6587cd6
Opcode Fuzzy Hash: 5be001c0176643820976aeb8a7e6e7f80567fb65990b78b4591647634f905555
Instruction Fuzzy Hash: E29192B2A44A2EBECB529BA4CC45EFEB76CBF14304F000326F615E7141D774AA549BE1

Function 00CE7503 Relevance: 33.4, APIs: 1, Strings: 21, Instructions: 378
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(00CF7378,00CE52B5,00000000,00CE533D), ref: 00CE7523

Strings

WixBundleExecutePackageCacheFolder, xrefs: 00CE7CAC
WixBundleAction, xrefs: 00CE7C90
WixBundleVersion, xrefs: 00CE7DAC
Failed to add built-in variable: %ls., xrefs: 00CE7DF0
WixBundleExecutePackageAction, xrefs: 00CE7CCE
#, xrefs: 00CE759C
WixBundleActiveParent, xrefs: 00CE7D47
$, xrefs: 00CE7C54
Date, xrefs: 00CE7642
InstallerVersion, xrefs: 00CE771E
WixBundleProviderKey, xrefs: 00CE7D5A
InstallerName, xrefs: 00CE76F8
WixBundleElevated, xrefs: 00CE7D2E
', xrefs: 00CE77E2
0, xrefs: 00CE753D
WixBundleTag, xrefs: 00CE7D99
WixBundleSourceProcessPath, xrefs: 00CE7D6D
WixBundleSourceProcessFolder, xrefs: 00CE7D86
LogonUser, xrefs: 00CE77B2
WixBundleInstalled, xrefs: 00CE7D12
WixBundleForcedRestartPackage, xrefs: 00CE7CF0

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: #$$$'$0$Date$Failed to add built-in variable: %ls.$InstallerName$InstallerVersion$LogonUser$WixBundleAction$WixBundleActiveParent$WixBundleElevated$WixBundleExecutePackageAction$WixBundleExecutePackageCacheFolder$WixBundleForcedRestartPackage$WixBundleInstalled$WixBundleProviderKey$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleTag$WixBundleVersion
API String ID: 32694325-826827252
Opcode ID: 3af269a7ea1ef937ccd9e8b9a1a077c5dca5896af56ceffd04b7bb9dcc13452b
Instruction ID: c29e02fa7271f2613c1ad43f7138ae1893af11a3e19cc23e41522d75d19ad6b8
Opcode Fuzzy Hash: 3af269a7ea1ef937ccd9e8b9a1a077c5dca5896af56ceffd04b7bb9dcc13452b
Instruction Fuzzy Hash: 383239F0C253798BDB65CF5999887CDBAB8BB59B08F5091DAE10CA6311D7B00B84CF94

Function 6CF61CE0 Relevance: 31.7, APIs: 1, Strings: 17, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

#(loc.SuccessInstallHeader), xrefs: 6CF61DF8
thm.wxl, xrefs: 6CF61CE9
FailureUninstallHeader, xrefs: 6CF61ECE
Failed to set WixStdBALanguageId variable., xrefs: 6CF61D86
Failed to load loc file from path: %ls, xrefs: 6CF61D47
mbapreq.wxl, xrefs: 6CF61CF1, 6CF61D0C, 6CF61D1E
FailureRepairHeader, xrefs: 6CF61EB3
SuccessRepairHeader, xrefs: 6CF61E4E
#(loc.FailureHeader), xrefs: 6CF61E7F
SuccessInstallHeader, xrefs: 6CF61E2F
Failed to localize confirm close message: %ls, xrefs: 6CF61DC5
Failed to probe for loc file: %ls in path: %ls, xrefs: 6CF61D1F
FailureInstallHeader, xrefs: 6CF61E98
SuccessUninstallHeader, xrefs: 6CF61E69
#(loc.ConfirmCancelMessage), xrefs: 6CF61D9A
WixStdBALanguageId, xrefs: 6CF61D77
#(loc.SuccessHeader), xrefs: 6CF61E16

Memory Dump Source

Source File: 00000002.00000002.2976644492.000000006CF61000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF60000, based on PE: true

Associated: 00000002.00000002.2976608888.000000006CF60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976693645.000000006CF7F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976757688.000000006CF8A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976814931.000000006CF8C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cf60000_UNK_.jbxd

Similarity

API ID: Default$LangLanguageSystemUser
String ID: #(loc.ConfirmCancelMessage)$#(loc.FailureHeader)$#(loc.SuccessHeader)$#(loc.SuccessInstallHeader)$Failed to load loc file from path: %ls$Failed to localize confirm close message: %ls$Failed to probe for loc file: %ls in path: %ls$Failed to set WixStdBALanguageId variable.$FailureInstallHeader$FailureRepairHeader$FailureUninstallHeader$SuccessInstallHeader$SuccessRepairHeader$SuccessUninstallHeader$WixStdBALanguageId$mbapreq.wxl$thm.wxl
API String ID: 4175731448-3264773947
Opcode ID: 1fe577aa511aadf21f2d76a8f8a07b94e3450907c8550a5067abd71c4f3acabf
Instruction ID: bba24e57ab3e97890bd697b91c1568b61df5b68b604cd1a8edcc91c76065facd
Opcode Fuzzy Hash: 1fe577aa511aadf21f2d76a8f8a07b94e3450907c8550a5067abd71c4f3acabf
Instruction Fuzzy Hash: 67518F3A902519BFDB129B56CC40ECA7BB5EF18358F158264F904ABE70DB32DD24DB90

Function 00CF80AE Relevance: 31.7, APIs: 7, Strings: 11, Instructions: 151
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00CE5381), ref: 00CF8104

Part of subcall function 00D2076C: OpenProcessToken.ADVAPI32(?,00000008,?,00CE52B5,00000000,?,?,?,?,?,?,?,00CF74AB,00000000), ref: 00D2078A
Part of subcall function 00D2076C: GetLastError.KERNEL32(?,?,?,?,?,?,?,00CF74AB,00000000), ref: 00D20794
Part of subcall function 00D2076C: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,00CF74AB,00000000), ref: 00D2081D

GetWindowsDirectoryW.KERNEL32(?,00000104,00000000), ref: 00CF812A
GetLastError.KERNEL32 ref: 00CF8134
GetTempPathW.KERNEL32(00000104,?,00000000), ref: 00CF81B1
GetLastError.KERNEL32 ref: 00CF81BB

Strings

%ls%ls\, xrefs: 00CF824C
Failed to concat Temp directory on windows path for working folder., xrefs: 00CF81A1
Failed to convert working folder guid into string., xrefs: 00CF823A
Failed to create working folder guid., xrefs: 00CF8207
Temp\, xrefs: 00CF8189
cache.cpp, xrefs: 00CF8158, 00CF81DF, 00CF8230
Failed to ensure windows path for working folder ended in backslash., xrefs: 00CF817F
Failed to get windows path for working folder., xrefs: 00CF8162
Failed to copy working folder path., xrefs: 00CF827F
Failed to get temp path for working folder., xrefs: 00CF81E9
Failed to append bundle id on to temp path for working folder., xrefs: 00CF8264

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: ErrorLast$Process$CloseCurrentDirectoryHandleOpenPathTempTokenWindows
String ID: %ls%ls\$Failed to append bundle id on to temp path for working folder.$Failed to concat Temp directory on windows path for working folder.$Failed to convert working folder guid into string.$Failed to copy working folder path.$Failed to create working folder guid.$Failed to ensure windows path for working folder ended in backslash.$Failed to get temp path for working folder.$Failed to get windows path for working folder.$Temp\$cache.cpp
API String ID: 348923985-819636856
Opcode ID: 7ad509cac154260dbab43ea4e13bea31c99a7ae7b985ce931908da0a63c95ff9
Instruction ID: 7323664d89c85d75b991a3c4e234d2da1b4c3bfe6efa9ae80c7023c1ba16169b
Opcode Fuzzy Hash: 7ad509cac154260dbab43ea4e13bea31c99a7ae7b985ce931908da0a63c95ff9
Instruction Fuzzy Hash: 6141E972B407287BEB6196A5DD4AFAB77ACAB00710F004152FE05E7140EB74ED4D86B2

Function 00D00E43 Relevance: 30.0, APIs: 8, Strings: 9, Instructions: 210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 00D00E65
CoUninitialize.COMBASE ref: 00D010D9

Strings

<the>.cab, xrefs: 00D00F05
Failed to wait for begin operation event., xrefs: 00D01054
Failed to set operation complete event., xrefs: 00D01009
Invalid operation for this state., xrefs: 00D010BD
Failed to initialize COM., xrefs: 00D00E71
Failed to extract all files from container, erf: %d:%X:%d, xrefs: 00D00FC0
Failed to initialize cabinet.dll., xrefs: 00D00EE7
Failed to reset begin operation event., xrefs: 00D01091
cabextract.cpp, xrefs: 00D00EDB, 00D00FFF, 00D0104A, 00D01087, 00D010B3

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: InitializeUninitialize
String ID: <the>.cab$Failed to extract all files from container, erf: %d:%X:%d$Failed to initialize COM.$Failed to initialize cabinet.dll.$Failed to reset begin operation event.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$cabextract.cpp
API String ID: 3442037557-1168358783
Opcode ID: 18640ace294322c6b10248f72172eb6b55d9d647e98a1b0df8f6af398744e60e
Instruction ID: 8d3d5ed7f1b827806d920e0f872e46c18e9b64668fdfb84402cb230ddcb169bb
Opcode Fuzzy Hash: 18640ace294322c6b10248f72172eb6b55d9d647e98a1b0df8f6af398744e60e
Instruction Fuzzy Hash: 1F514836E80362BBD33116699C45B6B7E50DF40720F160226FD4ABB2C0D7A5CC41AAF6

Function 00D03870 Relevance: 28.6, APIs: 1, Strings: 15, Instructions: 589COMMON

Download Yara Rule

Strings

Language, xrefs: 00D03CBC
Failed to get version for product in user unmanaged context: %ls, xrefs: 00D03E97
Failed to enum related products., xrefs: 00D03EC3
Invalid state value., xrefs: 00D03F47
msiengine.cpp, xrefs: 00D039F5, 00D03AF6, 00D03F3D, 00D03F54
Failed to copy the installed ProductCode to the package., xrefs: 00D03B20
VersionString, xrefs: 00D038CB, 00D03A52, 00D03BAC, 00D03BE3
UX aborted detect related MSI package., xrefs: 00D039FF
Failed to convert version: %ls to DWORD64 for ProductCode: %ls, xrefs: 00D0390F
UX aborted detect compatible MSI package., xrefs: 00D03B00
UX aborted detect., xrefs: 00D03F5E
Failed to get product information for ProductCode: %ls, xrefs: 00D03A1F
msasn1.dll, xrefs: 00D039D6, 00D03ADD, 00D03DB3, 00D03EFE
Failed to query feature state., xrefs: 00D03F2B
Failed to get version for product in machine context: %ls, xrefs: 00D03EB9

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: lstrlen
String ID: Failed to convert version: %ls to DWORD64 for ProductCode: %ls$Failed to copy the installed ProductCode to the package.$Failed to enum related products.$Failed to get product information for ProductCode: %ls$Failed to get version for product in machine context: %ls$Failed to get version for product in user unmanaged context: %ls$Failed to query feature state.$Invalid state value.$Language$UX aborted detect compatible MSI package.$UX aborted detect related MSI package.$UX aborted detect.$VersionString$msasn1.dll$msiengine.cpp
API String ID: 1659193697-2574767977
Opcode ID: 3ca6ab7625526803cf37a68474cfc7202b5e1b34b6696d79ad6c50ff30ebbaaa
Instruction ID: 479a204b4908e9eeda86142472c7907d41b49e4dde5eb0f10bd6988be187d03d
Opcode Fuzzy Hash: 3ca6ab7625526803cf37a68474cfc7202b5e1b34b6696d79ad6c50ff30ebbaaa
Instruction Fuzzy Hash: 94228E71A00619AFDB249FA4C881FADBBB9FF04314F14422AF559AB191D730AE54DB70

Function 00CE41D2 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 158
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(00000000,?,00000000,00000000,?,?,00CE515E,?,?,00000000,?,?), ref: 00CE41FE
InitializeCriticalSection.KERNEL32(000000D0,?,?,00CE515E,?,?,00000000,?,?), ref: 00CE4207
lstrlenW.KERNEL32(burn.filehandle.attached,000004B8,000004A0,?,?,00CE515E,?,?,00000000,?,?), ref: 00CE424D
lstrlenW.KERNEL32(burn.filehandle.attached,burn.filehandle.attached,00000000,?,?,00CE515E,?,?,00000000,?,?), ref: 00CE4257
CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,00CE515E,?,?,00000000,?,?), ref: 00CE426B
lstrlenW.KERNEL32(burn.filehandle.attached,?,?,00CE515E,?,?,00000000,?,?), ref: 00CE427B
lstrlenW.KERNEL32(burn.filehandle.self,?,?,00CE515E,?,?,00000000,?,?), ref: 00CE42CB
lstrlenW.KERNEL32(burn.filehandle.self,burn.filehandle.self,00000000,?,?,00CE515E,?,?,00000000,?,?), ref: 00CE42D5
CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,00CE515E,?,?,00000000,?,?), ref: 00CE42E9
lstrlenW.KERNEL32(burn.filehandle.self,?,?,00CE515E,?,?,00000000,?,?), ref: 00CE42F9

Strings

Missing required parameter for switch: %ls, xrefs: 00CE439F
burn.filehandle.attached, xrefs: 00CE4248, 00CE4250, 00CE4255, 00CE4256, 00CE4276, 00CE439A
Failed to parse file handle: '%ls', xrefs: 00CE437D
Failed to initialize engine section., xrefs: 00CE4362
engine.cpp, xrefs: 00CE4390, 00CE43BC
burn.filehandle.self, xrefs: 00CE42C6, 00CE42CE, 00CE42D3, 00CE42D4, 00CE42F4, 00CE43C6

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: lstrlen$CompareCriticalInitializeSectionString
String ID: Failed to initialize engine section.$Failed to parse file handle: '%ls'$Missing required parameter for switch: %ls$burn.filehandle.attached$burn.filehandle.self$engine.cpp
API String ID: 3039292287-3209860532
Opcode ID: afdeefb8ae7b919402e3834b939b7e48dc08be2626b7ce21612c4a51a2179559
Instruction ID: 11bc5551aeb13986e6f9d400683bbb4c7ae1a886a47661ba2cc494ea79a4de62
Opcode Fuzzy Hash: afdeefb8ae7b919402e3834b939b7e48dc08be2626b7ce21612c4a51a2179559
Instruction Fuzzy Hash: F051C571A00365BFC7289F6ADC46FAABB6CEB15720F000116F618D72A0DBB0B950C7B4

Function 00CFE563 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 135registryCOMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,?), ref: 00CFE5AE
RegisterClassW.USER32(?), ref: 00CFE5DA
GetLastError.KERNEL32 ref: 00CFE5E5
CreateWindowExW.USER32(00000080,00D39CC4,00000000,90000000,80000000,00000008,00000000,00000000,00000000,00000000,?,?), ref: 00CFE64C
GetLastError.KERNEL32 ref: 00CFE656
UnregisterClassW.USER32(WixBurnMessageWindow,?), ref: 00CFE6F4

Strings

uithread.cpp, xrefs: 00CFE609, 00CFE67A
Failed to create window., xrefs: 00CFE684
WixBurnMessageWindow, xrefs: 00CFE5D3, 00CFE6EF
Unexpected return value from message pump., xrefs: 00CFE6DF
Failed to register window., xrefs: 00CFE613

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: ClassErrorLast$CreateRegisterUnregisterValueWindow
String ID: Failed to create window.$Failed to register window.$Unexpected return value from message pump.$WixBurnMessageWindow$uithread.cpp
API String ID: 213125376-288575659
Opcode ID: 151b5402395bb104071256dde64047e0c122bec201d07cf86fd9092bb75c3e7c
Instruction ID: 662b018ad6c181b7bc6ae15c8eb9728c1b874468a76b7406ccfe557db0da687a
Opcode Fuzzy Hash: 151b5402395bb104071256dde64047e0c122bec201d07cf86fd9092bb75c3e7c
Instruction Fuzzy Hash: DE417472A0071CAFDB209BA5DD44AEABFE8FF18760F104126FA05E6260D7709915CBB5

Function 00CEC129 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 128fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,08000080,00000000,?,00000000,00000000,?,00CEC319,00CE52FD,?,?,00CE533D), ref: 00CEC170
GetLastError.KERNEL32(?,00CEC319,00CE52FD,?,?,00CE533D,00CE533D,00000000,?,00000000), ref: 00CEC181
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002,?,00000000,00000000,?,00CEC319,00CE52FD,?,?,00CE533D,00CE533D,00000000,?), ref: 00CEC1D0
GetCurrentProcess.KERNEL32(000000FF,00000000,?,00CEC319,00CE52FD,?,?,00CE533D,00CE533D,00000000,?,00000000), ref: 00CEC1D6
DuplicateHandle.KERNELBASE(00000000,?,00CEC319,00CE52FD,?,?,00CE533D,00CE533D,00000000,?,00000000), ref: 00CEC1D9
GetLastError.KERNEL32(?,00CEC319,00CE52FD,?,?,00CE533D,00CE533D,00000000,?,00000000), ref: 00CEC1E3
SetFilePointerEx.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00CEC319,00CE52FD,?,?,00CE533D,00CE533D,00000000,?,00000000), ref: 00CEC235
GetLastError.KERNEL32(?,00CEC319,00CE52FD,?,?,00CE533D,00CE533D,00000000,?,00000000), ref: 00CEC23F

Strings

crypt32.dll, xrefs: 00CEC231
container.cpp, xrefs: 00CEC1A5, 00CEC207, 00CEC263
Failed to open container., xrefs: 00CEC28B
Failed to move file pointer to container offset., xrefs: 00CEC26D
Failed to duplicate handle to container: %ls, xrefs: 00CEC214
feclient.dll, xrefs: 00CEC232
Failed to open file: %ls, xrefs: 00CEC1B2

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: ErrorLast$CurrentFileProcess$CreateDuplicateHandlePointer
String ID: Failed to duplicate handle to container: %ls$Failed to move file pointer to container offset.$Failed to open container.$Failed to open file: %ls$container.cpp$crypt32.dll$feclient.dll
API String ID: 2619879409-373955632
Opcode ID: a5466312fc14f38daf73cd5f601a96d757dca58c0a34d1c9e3a1edd5fc161a67
Instruction ID: 0c3b050700d36b4449cff91510d657ae98f97d50d0ed55c6b57ace2026405cac
Opcode Fuzzy Hash: a5466312fc14f38daf73cd5f601a96d757dca58c0a34d1c9e3a1edd5fc161a67
Instruction Fuzzy Hash: 3F411172200340AFEB219F6AAC88F577BE9EB95760F114129FD18DB291DB71D812CB70

Function 00D229B3 Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00CE37EA: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00CE3829
Part of subcall function 00CE37EA: GetLastError.KERNEL32 ref: 00CE3833

Part of subcall function 00D24932: GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 00D2495A

GetProcAddress.KERNEL32(MsiDeterminePatchSequenceW,00000000), ref: 00D229FD
GetProcAddress.KERNEL32(MsiDetermineApplicablePatchesW), ref: 00D22A20
GetProcAddress.KERNEL32(MsiEnumProductsExW), ref: 00D22A43
GetProcAddress.KERNEL32(MsiGetPatchInfoExW), ref: 00D22A66
GetProcAddress.KERNEL32(MsiGetProductInfoExW), ref: 00D22A89
GetProcAddress.KERNEL32(MsiSetExternalUIRecord), ref: 00D22AAC
GetProcAddress.KERNEL32(MsiSourceListAddSourceExW), ref: 00D22ACF

Strings

MsiDeterminePatchSequenceW, xrefs: 00D229F2
Msi.dll, xrefs: 00D229C5
MsiGetPatchInfoExW, xrefs: 00D22A4D
MsiDetermineApplicablePatchesW, xrefs: 00D22A07
MsiGetProductInfoExW, xrefs: 00D22A70
MsiEnumProductsExW, xrefs: 00D22A2A
MsiSetExternalUIRecord, xrefs: 00D22A93
MsiSourceListAddSourceExW, xrefs: 00D22AB6

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: AddressProc$ErrorLast$DirectorySystem
String ID: Msi.dll$MsiDetermineApplicablePatchesW$MsiDeterminePatchSequenceW$MsiEnumProductsExW$MsiGetPatchInfoExW$MsiGetProductInfoExW$MsiSetExternalUIRecord$MsiSourceListAddSourceExW
API String ID: 2510051996-1735120554
Opcode ID: b91dd5638736204ad93d863354efe313518328b487d9e41b6a8e517bce72f947
Instruction ID: 37d863f5d96e3a9f465d8e5a0a77939cc99f16a2618dd63b015c51bb2f1c8990
Opcode Fuzzy Hash: b91dd5638736204ad93d863354efe313518328b487d9e41b6a8e517bce72f947
Instruction Fuzzy Hash: 30310BB8606718AFDB18DF29EC52A293BB5F766720742442FE40ADA360D7B1D804DF30

Function 6CF614FF Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 160registrywindowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000000,00000001), ref: 6CF6154F
LoadIconW.USER32(00000000,00000001), ref: 6CF6155B
LoadCursorW.USER32(00000000,00007F00), ref: 6CF6157E
RegisterClassW.USER32(?), ref: 6CF615A9
GetLastError.KERNEL32 ref: 6CF615B4
IsWindow.USER32(?), ref: 6CF615FB
GetCursorPos.USER32(?), ref: 6CF6160F
MonitorFromPoint.USER32(?,?,00000002), ref: 6CF61621
GetMonitorInfoW.USER32(00000000,00000002), ref: 6CF61637
CreateWindowExW.USER32(00000000,6CF7FE40,?,?,?,?,?,?,00000000,00000000,?,?), ref: 6CF61691
GetLastError.KERNEL32 ref: 6CF616A1

Strings

(, xrefs: 6CF6162E
WixStandardBootstrapperApplication.cpp, xrefs: 6CF616C5
WixStdBA, xrefs: 6CF615A2

Memory Dump Source

Source File: 00000002.00000002.2976644492.000000006CF61000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF60000, based on PE: true

Associated: 00000002.00000002.2976608888.000000006CF60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976693645.000000006CF7F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976757688.000000006CF8A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976814931.000000006CF8C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cf60000_UNK_.jbxd

Similarity

API ID: CursorErrorLastLoadMonitorWindow$ClassCreateFromHandleIconInfoModulePointRegister
String ID: ($WixStandardBootstrapperApplication.cpp$WixStdBA
API String ID: 4193476069-4208313422
Opcode ID: 6e90c8b01938b694717b94956221ccc90dabf0be36f5913772b41794f3f24465
Instruction ID: cb905bbdf1cef3aaaa4fc6a8b86d9b7f52c4869347b5b11211a70525764d1524
Opcode Fuzzy Hash: 6e90c8b01938b694717b94956221ccc90dabf0be36f5913772b41794f3f24465
Instruction Fuzzy Hash: 8E516E76E01215AFDF44CFAAD988A9EBBF5FF49300F144169E905EB650DB71D801CBA0

Function 00D22F23 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 152libraryloadercomCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,00D234DF,00000000,?,00000000), ref: 00D22F3D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00D0BDED,?,00CE52FD,?,00000000,?), ref: 00D22F49
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00D22F89
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00D22F95
GetProcAddress.KERNEL32(00000000,Wow64EnableWow64FsRedirection), ref: 00D22FA0
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00D22FAA
CoCreateInstance.OLE32(00D4B6C8,00000000,00000001,00D2B808,?,?,?,?,?,?,?,?,?,?,?,00D0BDED), ref: 00D22FE5
ExitProcess.KERNEL32 ref: 00D23094

Strings

Wow64EnableWow64FsRedirection, xrefs: 00D22F97
Wow64RevertWow64FsRedirection, xrefs: 00D22FA2
Wow64DisableWow64FsRedirection, xrefs: 00D22F8F
xmlutil.cpp, xrefs: 00D22F6D
kernel32.dll, xrefs: 00D22F2D
IsWow64Process, xrefs: 00D22F83

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: AddressProc$CreateErrorExitHandleInstanceLastModuleProcess
String ID: IsWow64Process$Wow64DisableWow64FsRedirection$Wow64EnableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$xmlutil.cpp
API String ID: 2124981135-499589564
Opcode ID: d6ef8206a9cff8c0e4eb402a7b8b06877fba3616cce7f9c12427e98265f6de08
Instruction ID: 2a711989a54a687cc289dd5b3cd2279164772148c9758e51b96d0df4be418664
Opcode Fuzzy Hash: d6ef8206a9cff8c0e4eb402a7b8b06877fba3616cce7f9c12427e98265f6de08
Instruction Fuzzy Hash: F541BF31A00325AFDB20DFA9A944B6EB7B4EF65714F154069F905EB350DB75DE008BB0

Function 6CF6C694 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 152libraryloadercomCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,?,6CF6CC0B,00000000,00000000,00000000,?,6CF65200,?), ref: 6CF6C6AE
GetLastError.KERNEL32(?,6CF6CC0B,00000000,00000000,00000000,?,6CF65200,?), ref: 6CF6C6BA
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 6CF6C6FA
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 6CF6C706
GetProcAddress.KERNEL32(00000000,Wow64EnableWow64FsRedirection), ref: 6CF6C711
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 6CF6C71B
CoCreateInstance.OLE32(6CF8AB30,00000000,00000001,6CF7F3E0,00000000,?,6CF6CC0B,00000000,00000000,00000000,?,6CF65200,?), ref: 6CF6C756
ExitProcess.KERNEL32 ref: 6CF6C805

Strings

xmlutil.cpp, xrefs: 6CF6C6DE
kernel32.dll, xrefs: 6CF6C69E
Wow64RevertWow64FsRedirection, xrefs: 6CF6C713
Wow64DisableWow64FsRedirection, xrefs: 6CF6C700
IsWow64Process, xrefs: 6CF6C6F4
Wow64EnableWow64FsRedirection, xrefs: 6CF6C708

Memory Dump Source

Source File: 00000002.00000002.2976644492.000000006CF61000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF60000, based on PE: true

Associated: 00000002.00000002.2976608888.000000006CF60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976693645.000000006CF7F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976757688.000000006CF8A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976814931.000000006CF8C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cf60000_UNK_.jbxd

Similarity

API ID: AddressProc$CreateErrorExitHandleInstanceLastModuleProcess
String ID: IsWow64Process$Wow64DisableWow64FsRedirection$Wow64EnableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$xmlutil.cpp
API String ID: 2124981135-499589564
Opcode ID: 3e1286c9edbdca74c984f6b223e6ed9684c530d8777924a7f0976177048fc60b
Instruction ID: c325e03999cbc3e351d95a87b0646ea1bbc1a649783d3dea0fae947931f061d9
Opcode Fuzzy Hash: 3e1286c9edbdca74c984f6b223e6ed9684c530d8777924a7f0976177048fc60b
Instruction Fuzzy Hash: CE41B271A02215ABDF11EFBAC894BAEB7F4EF05714F214169E845EBE80D771DD008B90

Function 00D1FBAD Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNELBASE(SystemFunction040,AdvApi32.dll), ref: 00D1FBD5
GetProcAddress.KERNEL32(SystemFunction041), ref: 00D1FBE7
GetProcAddress.KERNEL32(CryptProtectMemory,Crypt32.dll), ref: 00D1FC2A
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 00D1FC3E
GetProcAddress.KERNEL32(CryptUnprotectMemory), ref: 00D1FC76
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 00D1FC8A

Strings

SystemFunction041, xrefs: 00D1FBD7
CryptProtectMemory, xrefs: 00D1FC1F
AdvApi32.dll, xrefs: 00D1FBB4
`+9s, xrefs: 00D1FBE9, 00D1FBF0, 00D1FC78
CryptUnprotectMemory, xrefs: 00D1FC6B
cryputil.cpp, xrefs: 00D1FC5F
SystemFunction040, xrefs: 00D1FBCA
Crypt32.dll, xrefs: 00D1FC0B

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: AddressProc$ErrorLast
String ID: AdvApi32.dll$Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory$SystemFunction040$SystemFunction041$`+9s$cryputil.cpp
API String ID: 4214558900-213721895
Opcode ID: 2af6012815a0da925d8ea054a2e96c06497a1001b7740045045dff9b5fb2d362
Instruction ID: 85027e95c4bb3b3b404b952040fcca7fc2b38f653445862392b7abf22ffdeea1
Opcode Fuzzy Hash: 2af6012815a0da925d8ea054a2e96c06497a1001b7740045045dff9b5fb2d362
Instruction Fuzzy Hash: 31219875A40326AFD7219F36AD44B52B9D1AB22760F060133EC01E7360EB60DC45AAF0

Function 00D01484 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 103COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,wininet.dll,?,00000000,00000000,00000000,?,?,00CEC285,?,00000000,?,00CEC319), ref: 00D014BB
GetLastError.KERNEL32(?,00CEC285,?,00000000,?,00CEC319,00CE52FD,?,?,00CE533D,00CE533D,00000000,?,00000000), ref: 00D014C4

Strings

Failed to wait for operation complete., xrefs: 00D01597
Failed to create begin operation event., xrefs: 00D014F2
wininet.dll, xrefs: 00D0149A
Failed to copy file name., xrefs: 00D014A6
Failed to create operation complete event., xrefs: 00D01538
cabextract.cpp, xrefs: 00D014E8, 00D0152E, 00D0157A
Failed to create extraction thread., xrefs: 00D01584

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: CreateErrorEventLast
String ID: Failed to copy file name.$Failed to create begin operation event.$Failed to create extraction thread.$Failed to create operation complete event.$Failed to wait for operation complete.$cabextract.cpp$wininet.dll
API String ID: 545576003-938279966
Opcode ID: 56cb7076aee49c1c5d2edd9f8cd3f7b1f82379062bb60fc5012cebc02cf34dc5
Instruction ID: 9a190b307933d812117426805f93fe5fd628171886dfd778be0b67da3e6f5173
Opcode Fuzzy Hash: 56cb7076aee49c1c5d2edd9f8cd3f7b1f82379062bb60fc5012cebc02cf34dc5
Instruction Fuzzy Hash: 2C21D1B6B407257EF32166795C89B677AECEB447A0F010222BC49EB2C0E6A4DD0185F5

Function 6CF6AE55 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 295windowkeyboardCOMMON

Download Yara Rule

APIs

GetUpdateRect.USER32(?,00000000,00000000), ref: 6CF6AEE8
BeginPaint.USER32(?,?,?,6CF655CA,00000000,?,?,?,?), ref: 6CF6AEFD
EndPaint.USER32(?,?,?,?,?,6CF655CA,00000000,?,?,?,?), ref: 6CF6AF12
GetClientRect.USER32(?,?), ref: 6CF6AF31
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?,?,?,?,?,6CF655CA,00000000,?), ref: 6CF6AF90
SendMessageW.USER32(?,0000101E,00000000,?), ref: 6CF6AFDA
GetDlgItem.USER32(?,?), ref: 6CF6B062
GetKeyState.USER32(00000010), ref: 6CF6B0F4
GetNextDlgTabItem.USER32(?,?,00000000), ref: 6CF6B109
SetFocus.USER32(00000000,?,6CF655CA,00000000,?,?,?,?), ref: 6CF6B110
DefWindowProcW.USER32(?,?,?,?,?,00000000,?,?,6CF655CA,00000000,?,?,?,?), ref: 6CF6B1F9

Strings

open, xrefs: 6CF6B0B3

Memory Dump Source

Source File: 00000002.00000002.2976644492.000000006CF61000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF60000, based on PE: true

Associated: 00000002.00000002.2976608888.000000006CF60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976693645.000000006CF7F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976757688.000000006CF8A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976814931.000000006CF8C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cf60000_UNK_.jbxd

Similarity

API ID: ItemPaintRectWindow$BeginClientFocusMessageMoveNextProcSendStateUpdate
String ID: open
API String ID: 3202820204-2758837156
Opcode ID: b8774d85355b78f583a86be08c34af18ccf747f917ac1808af5a36548fd0149e
Instruction ID: f1ac378488d47cc27f3eaed7c2e07790972d905290d0291e69e9f75bf4066be6
Opcode Fuzzy Hash: b8774d85355b78f583a86be08c34af18ccf747f917ac1808af5a36548fd0149e
Instruction Fuzzy Hash: 49A1C271A01114BFDF258F6ACC84AEEB7B9EF49304F11899AF62593E50D730D981DBA0

Function 00D00627 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 103fileCOMMON

Download Yara Rule

APIs

CompareStringA.KERNELBASE(00000000,00000000,<the>.cab,?,?), ref: 00D00657
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 00D0066F
GetCurrentProcess.KERNEL32(?,00000000,?,?), ref: 00D00674
DuplicateHandle.KERNELBASE(00000000,?,?), ref: 00D00677
GetLastError.KERNEL32(?,?), ref: 00D00681
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,08000080,00000000,?,?), ref: 00D006F0
GetLastError.KERNEL32(?,?), ref: 00D006FD

Strings

<the>.cab, xrefs: 00D00650
Failed to add virtual file pointer for cab container., xrefs: 00D006D6
Failed to open cabinet file: %hs, xrefs: 00D0072E
Failed to duplicate handle to cab container., xrefs: 00D006AF
cabextract.cpp, xrefs: 00D006A5, 00D00721

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: CurrentErrorLastProcess$CompareCreateDuplicateFileHandleString
String ID: <the>.cab$Failed to add virtual file pointer for cab container.$Failed to duplicate handle to cab container.$Failed to open cabinet file: %hs$cabextract.cpp
API String ID: 3030546534-3446344238
Opcode ID: c6bd974855ffdf239b91a1d566414c2f1a6bc16fae68255da7530f94f3445882
Instruction ID: bcab3e621f652aef71722496bf589ce98ea94e0e8ac70bf1fac708d16e490a29
Opcode Fuzzy Hash: c6bd974855ffdf239b91a1d566414c2f1a6bc16fae68255da7530f94f3445882
Instruction Fuzzy Hash: 0C31DE72A01725BFEB229B698C49F9B7EADEF05760F110126FD08E7290C7619D118AF4

Function 00CF3E47 Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 220sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00CF3955: RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000001,feclient.dll,?,?,?,00CF3E61,feclient.dll,?,00000000,?,?,?,00CE4A0C), ref: 00CF39F1

Sleep.KERNEL32(000007D0,00000001,feclient.dll,?,00000000,?,?,?,00CE4A0C,?,?,00D2B478,?,00000001,00000000,00000000), ref: 00CF3EF8

Strings

Failed to copy log extension to extension., xrefs: 00CF403D
clbcatq.dll, xrefs: 00CF4031
Failed to get current directory., xrefs: 00CF3EDA
crypt32.dll, xrefs: 00CF3E9E, 00CF3F03, 00CF3F0B, 00CF3F72, 00CF3FAC, 00CF3FED, 00CF400C, 00CF404A, 00CF4074
log, xrefs: 00CF3E9F
Failed to get non-session specific TEMP folder., xrefs: 00CF3FA2
Failed to copy log path to prefix., xrefs: 00CF401A
msasn1.dll, xrefs: 00CF400E, 00CF404F
feclient.dll, xrefs: 00CF3E5B, 00CF3F08
Failed to copy full log path to prefix., xrefs: 00CF405B
Failed to open log: %ls, xrefs: 00CF3F74
Setup, xrefs: 00CF3EA5

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: CloseSleep
String ID: Failed to copy full log path to prefix.$Failed to copy log extension to extension.$Failed to copy log path to prefix.$Failed to get current directory.$Failed to get non-session specific TEMP folder.$Failed to open log: %ls$Setup$clbcatq.dll$crypt32.dll$feclient.dll$log$msasn1.dll
API String ID: 2834455192-2673269691
Opcode ID: 5005da72d1a5c30c8e258b982ccc635e4bd20798bab16792d68d88a7da7320a0
Instruction ID: b3b98f4de689b66c724174ae6e019d6c5f44635ebb6bda71a952fbafac6c01fa
Opcode Fuzzy Hash: 5005da72d1a5c30c8e258b982ccc635e4bd20798bab16792d68d88a7da7320a0
Instruction Fuzzy Hash: F261C471A006A9BFDB969B64CC46B7B7BA8EF10300B044165FA11DB141EB71EF9097B2

Function 00CE6C5D Relevance: 19.7, APIs: 2, Strings: 11, Instructions: 167COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000001,?,00000000,00CE533D,00000000,00000001), ref: 00CE6C6E

Part of subcall function 00CE55B6: CompareStringW.KERNEL32(0000007F,00001000,?,000000FF,version.dll,000000FF,?,00000000,00000007,00CE648B,00CE648B,?,00CE554A,?,?,00000000), ref: 00CE55F2
Part of subcall function 00CE55B6: GetLastError.KERNEL32(?,00CE554A,?,?,00000000,?,00000000,00CE648B,?,00CE7DDC,?,?,?,?,?), ref: 00CE5621

LeaveCriticalSection.KERNEL32(00000001,?,00000001), ref: 00CE6E02

Strings

Setting variable failed: ID '%ls', HRESULT 0x%x, xrefs: 00CE6E14
Failed to set value of variable: %ls, xrefs: 00CE6DEA
Setting version variable '%ls' to value '%hu.%hu.%hu.%hu', xrefs: 00CE6D79
Setting numeric variable '%ls' to value %lld, xrefs: 00CE6DA3
Failed to insert variable '%ls'., xrefs: 00CE6CB3
variable.cpp, xrefs: 00CE6CF1
Failed to find variable value '%ls'., xrefs: 00CE6C89
Setting string variable '%ls' to value '%ls', xrefs: 00CE6D96
Unsetting variable '%ls', xrefs: 00CE6DBE
Attempt to set built-in variable value: %ls, xrefs: 00CE6CFC
Setting hidden variable '%ls', xrefs: 00CE6D2C

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: CriticalSection$CompareEnterErrorLastLeaveString
String ID: Attempt to set built-in variable value: %ls$Failed to find variable value '%ls'.$Failed to insert variable '%ls'.$Failed to set value of variable: %ls$Setting hidden variable '%ls'$Setting numeric variable '%ls' to value %lld$Setting string variable '%ls' to value '%ls'$Setting variable failed: ID '%ls', HRESULT 0x%x$Setting version variable '%ls' to value '%hu.%hu.%hu.%hu'$Unsetting variable '%ls'$variable.cpp
API String ID: 2716280545-445000439
Opcode ID: b2fb3956f4b9891be5b0eaced0cbf3f0a03b1c248cf719ba7c86af51c23b3412
Instruction ID: c57ed8674c86dd9ebd1c5305f775485426ef73c1ea2b8b320246ab369a1b2e0c
Opcode Fuzzy Hash: b2fb3956f4b9891be5b0eaced0cbf3f0a03b1c248cf719ba7c86af51c23b3412
Instruction Fuzzy Hash: E8514A71B102A4ABCB309E16DD4AF6B7B69EBB1748F200119F8546A281C271DF54DBF0

Function 00CE49DF Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 144windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00CE4B5E
PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00CE4B6F

Strings

Failed to open log., xrefs: 00CE4A12
Failed to query registration., xrefs: 00CE4AA8
Failed to set registration variables., xrefs: 00CE4AD8
Failed while running , xrefs: 00CE4B24
Failed to set action variables., xrefs: 00CE4ABE
Failed to create the message window., xrefs: 00CE4A92
Failed to set layout directory variable to value provided from command-line., xrefs: 00CE4B00
WixBundleLayoutDirectory, xrefs: 00CE4AEF
Failed to check global conditions, xrefs: 00CE4A43

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: MessagePostWindow
String ID: Failed to check global conditions$Failed to create the message window.$Failed to open log.$Failed to query registration.$Failed to set action variables.$Failed to set layout directory variable to value provided from command-line.$Failed to set registration variables.$Failed while running $WixBundleLayoutDirectory
API String ID: 3618638489-3051724725
Opcode ID: 4169a504d80dee5e9b76b9d054d691443d3f4d66b9008e0d8f79402ce5711f7d
Instruction ID: cfce8f6a8eb377f4eaa958ba8b3a8376ee2dc2d266050b4271c2ac3dc1949c73
Opcode Fuzzy Hash: 4169a504d80dee5e9b76b9d054d691443d3f4d66b9008e0d8f79402ce5711f7d
Instruction Fuzzy Hash: 8B412971A40AAABFCB2E5A22CC45FBBB75CFF00764F000226F914A6150D770ED54A7E5

Function 00CFE82A Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 99threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,?,00CE5386,?,?), ref: 00CFE84A
GetLastError.KERNEL32(?,00CE5386,?,?), ref: 00CFE857
CreateThread.KERNELBASE(00000000,00000000,Function_0001E563,?,00000000,00000000), ref: 00CFE8B0
GetLastError.KERNEL32(?,00CE5386,?,?), ref: 00CFE8BD
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,00CE5386,?,?), ref: 00CFE8F8
CloseHandle.KERNEL32(00000000,?,00CE5386,?,?), ref: 00CFE917
CloseHandle.KERNELBASE(?,?,00CE5386,?,?), ref: 00CFE924

Strings

uithread.cpp, xrefs: 00CFE878, 00CFE8DE
Failed to create the UI thread., xrefs: 00CFE8E8
Failed to create initialization event., xrefs: 00CFE882

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
String ID: Failed to create initialization event.$Failed to create the UI thread.$uithread.cpp
API String ID: 2351989216-3599963359
Opcode ID: 0787a735ed3eb125d3999fac9852b9124688f03f476afb18f5d9aeb14437f23e
Instruction ID: 60d3bf5eb519f0680dd4033b165d7fc621a5f74eff701ed567e0b5d0463af064
Opcode Fuzzy Hash: 0787a735ed3eb125d3999fac9852b9124688f03f476afb18f5d9aeb14437f23e
Instruction Fuzzy Hash: 94315471E40319BFEB519FA99D84AAFBBECEF18350F114126F915E3250D6709F0186B1

Function 6CF6B5FE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 90registryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF6CB3D: CoInitialize.OLE32(00000000), ref: 6CF6CB4C
Part of subcall function 6CF6CB3D: InterlockedIncrement.KERNEL32(6CF8AB40), ref: 6CF6CB69
Part of subcall function 6CF6CB3D: CLSIDFromProgID.OLE32(Msxml2.DOMDocument,6CF8AB30,?,?,?,?,?,?,?,6CF651EC,?), ref: 6CF6CB84
Part of subcall function 6CF6CB3D: CLSIDFromProgID.OLE32(MSXML.DOMDocument,6CF8AB30,?,?,?,?,?,?,?,6CF651EC,?), ref: 6CF6CB90

LoadCursorA.USER32(00000000,00007F89), ref: 6CF6B62E
GetClassInfoW.USER32(00000000,Button,?), ref: 6CF6B643
GetLastError.KERNEL32(?,?,?,?,?,?,?,6CF651EC,?), ref: 6CF6B64D
RegisterClassW.USER32(?), ref: 6CF6B693
GetLastError.KERNEL32(?,?,?,?,?,?,?,6CF651EC,?), ref: 6CF6B69E
GdiplusStartup.GDIPLUS(6CF8AB18,6CF8A1C4,6CF8AB10,?,?,?,?,?,?,?,6CF651EC,?), ref: 6CF6B6E5
InitCommonControlsEx.COMCTL32(?,00000000,6CF8AB18,6CF8A1C4,6CF8AB10,?,?,?,?,?,?,?,6CF651EC,?), ref: 6CF6B713

Strings

ThemeHyperLink, xrefs: 6CF6B68C
Button, xrefs: 6CF6B63D
thmutil.cpp, xrefs: 6CF6B671

Memory Dump Source

Source File: 00000002.00000002.2976644492.000000006CF61000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF60000, based on PE: true

Associated: 00000002.00000002.2976608888.000000006CF60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976693645.000000006CF7F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976757688.000000006CF8A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976814931.000000006CF8C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cf60000_UNK_.jbxd

Similarity

API ID: ClassErrorFromLastProg$CommonControlsCursorGdiplusIncrementInfoInitInitializeInterlockedLoadRegisterStartup
String ID: Button$ThemeHyperLink$thmutil.cpp
API String ID: 1186214510-4220003992
Opcode ID: bf4388424a1d8b484c305e09c02d8abb39ca8677c4c987f1c254b2fa57f49598
Instruction ID: 8adc6bc2e4b51d8b9e1b127b23893e0c0d53442f6a5f91f18c3175d4ad636fc5
Opcode Fuzzy Hash: bf4388424a1d8b484c305e09c02d8abb39ca8677c4c987f1c254b2fa57f49598
Instruction Fuzzy Hash: 5631D776F51225ABDB519FAAC848B9BBAF8FB06754F014526FD04F7A80D73188008BF0

Function 00D01224 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 88threadCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,74DF2F60,?,?,00CE52FD,00CE52B5,00000000,00CE533D), ref: 00D01249
GetLastError.KERNEL32 ref: 00D0125C
GetExitCodeThread.KERNELBASE(00D2B478,?), ref: 00D0129E
GetLastError.KERNEL32 ref: 00D012AC
ResetEvent.KERNEL32(00D2B450), ref: 00D012E7
GetLastError.KERNEL32 ref: 00D012F1

Strings

Failed to wait for operation complete event., xrefs: 00D0128D
Failed to reset operation complete event., xrefs: 00D01322
Failed to get extraction thread exit code., xrefs: 00D012DD
cabextract.cpp, xrefs: 00D01280, 00D012D0, 00D01315

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: ErrorLast$CodeEventExitMultipleObjectsResetThreadWait
String ID: Failed to get extraction thread exit code.$Failed to reset operation complete event.$Failed to wait for operation complete event.$cabextract.cpp
API String ID: 2979751695-3400260300
Opcode ID: 551432beeb574b85580fb7294bf15676a69c95913a45e23032794352a13cc95a
Instruction ID: e383a0fd4fa5b0bbc1c131568bce448903fbc0cdccf8a3164e11dba8180d0ad3
Opcode Fuzzy Hash: 551432beeb574b85580fb7294bf15676a69c95913a45e23032794352a13cc95a
Instruction Fuzzy Hash: BE2181B5740304EFEB149B7A9D46BBE77E8EB05710F50412FE98AD62E0E770DA009A35

Function 00CED5C0 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?,00000000,?,00CE46F8,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,00CE5386,?,?), ref: 00CED5CD
GetLastError.KERNEL32(?,00CE46F8,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,00CE5386,?,?), ref: 00CED5DA
GetProcAddress.KERNEL32(00000000,BootstrapperApplicationCreate), ref: 00CED612
GetLastError.KERNEL32(?,00CE46F8,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,00CE5386,?,?), ref: 00CED61E

Strings

BootstrapperApplicationCreate, xrefs: 00CED60C
Failed to get BootstrapperApplicationCreate entry-point, xrefs: 00CED649
Failed to create UX., xrefs: 00CED662
wininet.dll, xrefs: 00CED5F8, 00CED63C, 00CED667
Failed to load UX DLL., xrefs: 00CED605
userexperience.cpp, xrefs: 00CED5FB, 00CED63F

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID: BootstrapperApplicationCreate$Failed to create UX.$Failed to get BootstrapperApplicationCreate entry-point$Failed to load UX DLL.$userexperience.cpp$wininet.dll
API String ID: 1866314245-1140179540
Opcode ID: 0d810bedb76500ee3e278a6592abfef5fdfb7faeb06641aa5e6e0dab1d66b93c
Instruction ID: cbf6dbd0b42b994c153d28bbc575c6c499a62bb2133004ebf5730bcc841ed622
Opcode Fuzzy Hash: 0d810bedb76500ee3e278a6592abfef5fdfb7faeb06641aa5e6e0dab1d66b93c
Instruction Fuzzy Hash: AC11C132A40771AFEB225B6AAD04E5737E89F15760F01483AFD1AE7690D661DC048AF4

Function 00CE2DE0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 198sleepfiletimeCOMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001,00000000,00000000), ref: 00CE2E7A
GetLastError.KERNEL32 ref: 00CE2E84
GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 00CE2F1F
CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000001,00000080,00000000), ref: 00CE2FAD
GetLastError.KERNEL32 ref: 00CE2FBA
Sleep.KERNEL32(00000064), ref: 00CE2FCC
CloseHandle.KERNEL32(?), ref: 00CE302C

Strings

pathutil.cpp, xrefs: 00CE2EA8
%ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls, xrefs: 00CE2F7D

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: ErrorLast$CloseCreateFileHandleLocalPathSleepTempTime
String ID: %ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls$pathutil.cpp
API String ID: 3480017824-1101990113
Opcode ID: b17a41b83811bc6a7923d7bb29c21ada6513afabd39bfb7ae405713345790bfc
Instruction ID: ccf23a1a92ce3fdf9ece0b116fb08ee711940d42e4243a301f3784a56b4abe44
Opcode Fuzzy Hash: b17a41b83811bc6a7923d7bb29c21ada6513afabd39bfb7ae405713345790bfc
Instruction Fuzzy Hash: BD716272941279ABDB319BA5DC4CBAEB3F8EB18710F0001A6FD15E7190D7749E81CB60

Function 00CECABE Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 144COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,FFFEB88D,000000FF,?,000000FF,00CE5381,?,00CE52B5,00000000,00CE5381,FFF9E89D,00CE5381,00CE53B5,00CE533D,?), ref: 00CECB15

Strings

Failed to find embedded payload: %ls, xrefs: 00CECB41
Failed to get directory portion of local file path, xrefs: 00CECBEE
Failed to concat file paths., xrefs: 00CECBF5
payload.cpp, xrefs: 00CECC16
Failed to get next stream., xrefs: 00CECBFC
Payload was not found in container: %ls, xrefs: 00CECC22
Failed to extract file., xrefs: 00CECBE0
Failed to ensure directory exists, xrefs: 00CECBE7

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: CompareString
String ID: Failed to concat file paths.$Failed to ensure directory exists$Failed to extract file.$Failed to find embedded payload: %ls$Failed to get directory portion of local file path$Failed to get next stream.$Payload was not found in container: %ls$payload.cpp
API String ID: 1825529933-1711239286
Opcode ID: 073307ed8269cba92aa390eab8403412787d2bbe168200222e6b8f8a9804c664
Instruction ID: 9df79d1abe98fb3459eaf52bb9d2ab1ea20d2e3a8ee1f58e4f05b984137b5275
Opcode Fuzzy Hash: 073307ed8269cba92aa390eab8403412787d2bbe168200222e6b8f8a9804c664
Instruction Fuzzy Hash: 6641B5319002A9EFCF15DF46DDC296EBB75FF10710F2041A9E825A7251C3709E42DBA0

Function 00CE4690 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 128windowthreadCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(00000000,00000000,00000400,00000400,00000000), ref: 00CE46B5
GetCurrentThreadId.KERNEL32 ref: 00CE46BB

Part of subcall function 00CFFC51: new.LIBCMT ref: 00CFFC58

GetMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00CE4749

Strings

Failed to load UX., xrefs: 00CE46FE
wininet.dll, xrefs: 00CE46E8
engine.cpp, xrefs: 00CE4795
Failed to start bootstrapper application., xrefs: 00CE4717
Failed to create engine for UX., xrefs: 00CE46D5
Unexpected return value from message pump., xrefs: 00CE479F

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: Message$CurrentPeekThread
String ID: Failed to create engine for UX.$Failed to load UX.$Failed to start bootstrapper application.$Unexpected return value from message pump.$engine.cpp$wininet.dll
API String ID: 673430819-2573580774
Opcode ID: cf641471f8d6e07bdae2127f31e05445dab7c2efcccc52e2f024bec1fdd84938
Instruction ID: d8567e5f91bc1e3bb4b652fe518fdcc31d46baa8b880957d85ca6160728e955a
Opcode Fuzzy Hash: cf641471f8d6e07bdae2127f31e05445dab7c2efcccc52e2f024bec1fdd84938
Instruction Fuzzy Hash: 8D41E271600269BFE7199BA6CC85EBAB7ACEF09314F100126F915EB240DB30ED4597B1

Function 6CF666A7 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,00000000,?,00000000,?,00000000,?,00000000), ref: 6CF666C4
GetLastError.KERNEL32(?,00000000,?,00000000,?,00000000,?,00000000), ref: 6CF666CF
GlobalAlloc.KERNEL32(00000000,00000000,?,00000000,?,00000000,?,00000000,?,00000000), ref: 6CF666FE
GetFileVersionInfoW.VERSION(00000000,00000000,00000000,00000000), ref: 6CF6671F
GetLastError.KERNEL32(00000000,00000000,00000000,00000000), ref: 6CF66728
VerQueryValueW.VERSION(00000000,6CF81ACC,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6CF66760
GetLastError.KERNEL32(00000000,6CF81ACC,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6CF66769
GlobalFree.KERNEL32(00000000), ref: 6CF6679D

Strings

fileutil.cpp, xrefs: 6CF666ED, 6CF66746

Memory Dump Source

Source File: 00000002.00000002.2976644492.000000006CF61000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF60000, based on PE: true

Associated: 00000002.00000002.2976608888.000000006CF60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976693645.000000006CF7F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976757688.000000006CF8A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976814931.000000006CF8C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cf60000_UNK_.jbxd

Similarity

API ID: ErrorLast$FileGlobalInfoVersion$AllocFreeQuerySizeValue
String ID: fileutil.cpp
API String ID: 2342464106-2967768451
Opcode ID: a822300478d5b3a35370c0f793980e2c0ada9da8e4d1ae21a50aac9104eebab2
Instruction ID: 424ad90da59a7933664eff89c3d9ec2070b10485860c92918e513b5be214d762
Opcode Fuzzy Hash: a822300478d5b3a35370c0f793980e2c0ada9da8e4d1ae21a50aac9104eebab2
Instruction Fuzzy Hash: 01218536A04229ABD7119BABDD44EDBFBB9EF45354F114266FD00E7A40EB71CD0096E0

Function 00CE9B3F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 86COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00CE9B5A
GetFileAttributesW.KERNELBASE(00000000,000002C0,?,00000000,00000000,000002C0,00000100,000002C0,00000100), ref: 00CE9B72
GetLastError.KERNEL32 ref: 00CE9B81

Strings

Failed to format variable string., xrefs: 00CE9B65
Failed to set variable., xrefs: 00CE9C07
search.cpp, xrefs: 00CE9BB3
File search: %ls, did not find path: %ls, xrefs: 00CE9BD5
Failed get to file attributes. '%ls', xrefs: 00CE9BC0

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Failed get to file attributes. '%ls'$Failed to format variable string.$Failed to set variable.$File search: %ls, did not find path: %ls$search.cpp
API String ID: 1811509786-2053429945
Opcode ID: 81d63f47f67a8a7bb4678748e99a456e425950354b3c2139a3029b8b1a56e891
Instruction ID: 8993eae623c5c6cb637951c00b6dea2a59c67c5c22807fbc85c096cf0d5f2762
Opcode Fuzzy Hash: 81d63f47f67a8a7bb4678748e99a456e425950354b3c2139a3029b8b1a56e891
Instruction Fuzzy Hash: E6210B32E40364BFDB2266A6AD06B6EB779EF25310F204315FC10E6191E7719E50D6F1

Function 00CEF69D Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 117registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 00CEF7CD
RegCloseKey.ADVAPI32(00000000,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 00CEF7DA

Strings

Failed to open registration key., xrefs: 00CEF736
Failed to read Resume value., xrefs: 00CEF763
Resume, xrefs: 00CEF741
Failed to format pending restart registry key to read., xrefs: 00CEF6D1
%ls.RebootRequired, xrefs: 00CEF6BA

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: Close
String ID: %ls.RebootRequired$Failed to format pending restart registry key to read.$Failed to open registration key.$Failed to read Resume value.$Resume
API String ID: 3535843008-3890505273
Opcode ID: 86d27408b01f1231c9ea8f0af9b63979b42f21abb675544ea8280eb02681d832
Instruction ID: 167b0c72cf114f9daefad6c1ff97e3451560cd1bb4c360c54ac1da1aba5eb087
Opcode Fuzzy Hash: 86d27408b01f1231c9ea8f0af9b63979b42f21abb675544ea8280eb02681d832
Instruction Fuzzy Hash: BD416436900259EFCB11AF9AC881AEDBBB5FF05310F25417EF814AB211C3719E52DBA0

Function 6CF6BD67 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 87windowfileCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 6CF6BD80
CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,08000000,00000000,00000000,00000033,6CF8A028,?,00000000,00000000,?,6CF8A028,00000033), ref: 6CF6BDB9
GetLastError.KERNEL32(?,00000000,00000000,?,6CF8A028,00000033), ref: 6CF6BDC6
SendMessageW.USER32(00000000,00000435,00000000,?), ref: 6CF6BE15
SendMessageW.USER32(?,00000449,00000002,?), ref: 6CF6BE37
CloseHandle.KERNELBASE(00000000,00000000,00000033,6CF8A028,?,00000000,00000000,?,6CF8A028,00000033), ref: 6CF6BE50

Strings

thmutil.cpp, xrefs: 6CF6BDEA

Memory Dump Source

Source File: 00000002.00000002.2976644492.000000006CF61000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF60000, based on PE: true

Associated: 00000002.00000002.2976608888.000000006CF60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976693645.000000006CF7F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976757688.000000006CF8A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976814931.000000006CF8C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cf60000_UNK_.jbxd

Similarity

API ID: MessageSend$CloseCreateErrorFileHandleItemLast
String ID: thmutil.cpp
API String ID: 875121269-2961750086
Opcode ID: 4eff05532a1cea72f1a3a66ef90f7584e590d1f179fdb6ab1c9203dc6607c7fb
Instruction ID: 4b8d93ffefbc1a08f0ecb571bcfad3f72dde0d6910e5f2e4c8dc3895ded097e4
Opcode Fuzzy Hash: 4eff05532a1cea72f1a3a66ef90f7584e590d1f179fdb6ab1c9203dc6607c7fb
Instruction Fuzzy Hash: F0219432A40229BBDB119FA5CC45BDF7BB9EB05720F204615FA10B76E0D7719D10DBA0

Function 00D2041B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00D4B60C,00000000,?,?,?,00CE5407,00000000,Setup,_Failed,txt,00000000,00000000,00000000,?,?,?), ref: 00D2042B
CreateFileW.KERNEL32(40000000,00000001,00000000,00000002,00000080,00000000,?,00000000,?,?,?,00D4B604,?,00CE5407,00000000,Setup), ref: 00D204CC
GetLastError.KERNEL32(?,00CE5407,00000000,Setup,_Failed,txt,00000000,00000000,00000000,?,?,?), ref: 00D204DC
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,00CE5407,00000000,Setup,_Failed,txt,00000000,00000000,00000000,?,?,?), ref: 00D20515

Part of subcall function 00CE2DE0: GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 00CE2F1F

LeaveCriticalSection.KERNEL32(00D4B60C,?,?,00D4B604,?,00CE5407,00000000,Setup,_Failed,txt,00000000,00000000,00000000,?,?,?), ref: 00D2056E

Strings

logutil.cpp, xrefs: 00D204FA

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: CriticalFileSection$CreateEnterErrorLastLeaveLocalPointerTime
String ID: logutil.cpp
API String ID: 4111229724-3545173039
Opcode ID: 90d6e40c5ecc254f2ff40ed7ba73f024ba2d8be54018110bf651f85dab0def0f
Instruction ID: 2035225b31d35b63df662fbe421b8fcadb77d48418fc21902c261d3b1c68281e
Opcode Fuzzy Hash: 90d6e40c5ecc254f2ff40ed7ba73f024ba2d8be54018110bf651f85dab0def0f
Instruction Fuzzy Hash: D031D775901335BFDB21AF65AC81E5A3F68EB21768F050126FE00EA252D770DD509BB0

Function 6CF6A478 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 110windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF6C88A: SysAllocString.OLEAUT32(?), ref: 6CF6C89D
Part of subcall function 6CF6C88A: VariantInit.OLEAUT32(?), ref: 6CF6C8A9
Part of subcall function 6CF6C88A: VariantClear.OLEAUT32(?), ref: 6CF6C91D
Part of subcall function 6CF6C88A: SysFreeString.OLEAUT32(00000000), ref: 6CF6C928

SysFreeString.OLEAUT32(00000000), ref: 6CF6A4CE
GdipCreateHBITMAPFromBitmap.GDIPLUS(?,00000000,FF000000,00000000,ImageResource,00000000,00000000,00000000), ref: 6CF6A53D

Part of subcall function 6CF6D0EA: GlobalAlloc.KERNEL32(00000002,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,?,00000000,00000000,00000000,00000000), ref: 6CF6D122
Part of subcall function 6CF6D0EA: GetLastError.KERNEL32 ref: 6CF6D12E
Part of subcall function 6CF6D0EA: GlobalFree.KERNEL32(00000000), ref: 6CF6D240

SysFreeString.OLEAUT32(00000000), ref: 6CF6A58F

Strings

ImageResource, xrefs: 6CF6A486
ImageFile, xrefs: 6CF6A4E2
thmutil.cpp, xrefs: 6CF6A55F

Memory Dump Source

Source File: 00000002.00000002.2976644492.000000006CF61000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF60000, based on PE: true

Associated: 00000002.00000002.2976608888.000000006CF60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976693645.000000006CF7F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976757688.000000006CF8A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976814931.000000006CF8C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cf60000_UNK_.jbxd

Similarity

API ID: FreeString$AllocGlobalVariant$BitmapClearCreateErrorFromGdipInitLast
String ID: ImageFile$ImageResource$thmutil.cpp
API String ID: 2882486289-1357958357
Opcode ID: cf10f78c61d4e59addf66f5a67b8ade55fb37c126530367505662239c075aa23
Instruction ID: b507929456166f9a9737e09c715383534469e1ade3990655d2401a914866c582
Opcode Fuzzy Hash: cf10f78c61d4e59addf66f5a67b8ade55fb37c126530367505662239c075aa23
Instruction Fuzzy Hash: 82314A76C01528FBCB12DFA6CC04ADEBBB5EF84714F218255E81067E60D7319E14EB90

Function 00D008F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 72fileCOMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 00D00940
WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00D0095F
GetLastError.KERNEL32 ref: 00D00969

Strings

Failed to write during cabinet extraction., xrefs: 00D00997
Unexpected call to CabWrite()., xrefs: 00D00923
cabextract.cpp, xrefs: 00D0098D

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: ErrorFileLastWrite_memcpy_s
String ID: Failed to write during cabinet extraction.$Unexpected call to CabWrite().$cabextract.cpp
API String ID: 1970631241-3111339858
Opcode ID: 9e7aa5d37be47dde6a01a832bb907b31822e238e1ac515be2c5aa5035a39a238
Instruction ID: 3e04c644a5551144a1f8b71f8f2217ffe548b49470f58d08a1497d47f6cac53d
Opcode Fuzzy Hash: 9e7aa5d37be47dde6a01a832bb907b31822e238e1ac515be2c5aa5035a39a238
Instruction Fuzzy Hash: DE219F76600204AFEB01DF6DDD84EAA7BE9EF85720F150059FE08C7296D671D9108B71

Function 00D2076C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32(?,00000008,?,00CE52B5,00000000,?,?,?,?,?,?,?,00CF74AB,00000000), ref: 00D2078A
GetLastError.KERNEL32(?,?,?,?,?,?,?,00CF74AB,00000000), ref: 00D20794
GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?,?,?,?,?,?,?,?,00CF74AB,00000000), ref: 00D207C6
CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,00CF74AB,00000000), ref: 00D2081D

Strings

procutil.cpp, xrefs: 00D2080B

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: Token$CloseErrorHandleInformationLastOpenProcess
String ID: procutil.cpp
API String ID: 3370771294-1178289305
Opcode ID: 56f99dada8379473eb1b84da8c38eb29f60e0852217c19ffcf3710b64a1e96a6
Instruction ID: 3a4919b261596d281a28a3b415bd6bd56d1ec3ac3045a08be40c1d6ac6f2d7be
Opcode Fuzzy Hash: 56f99dada8379473eb1b84da8c38eb29f60e0852217c19ffcf3710b64a1e96a6
Instruction Fuzzy Hash: 1A21A471D00328EBDB21AB959D48A9FFBE8EF64760F118066ED15E7250D3709E00DAF0

Function 00D009B8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 70timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 00D00A25
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00D00A37
SetFileTime.KERNELBASE(?,?,?,?), ref: 00D00A4A
CloseHandle.KERNELBASE(000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00D00616,?,?), ref: 00D00A59

Strings

Invalid operation for this state., xrefs: 00D009FE
cabextract.cpp, xrefs: 00D009F4

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: Time$File$CloseDateHandleLocal
String ID: Invalid operation for this state.$cabextract.cpp
API String ID: 609741386-1751360545
Opcode ID: 1442b8255adb9578c63913fe0f80521bc87de18410a583d73c1fdaf6c9fc2062
Instruction ID: 91b2b47ef2169e0b0a6f33ff01f41a19c69b2950c813a8ea03edd5a0a57d8fbf
Opcode Fuzzy Hash: 1442b8255adb9578c63913fe0f80521bc87de18410a583d73c1fdaf6c9fc2062
Instruction Fuzzy Hash: 15219372A1031ABBCB109FA8DD48AAA7FBCFE05720F54421AF855D65D0D771EA11CBB0

Function 00D2343B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00D2344A
InterlockedIncrement.KERNEL32(00D4B6D8), ref: 00D23467
CLSIDFromProgID.COMBASE(Msxml2.DOMDocument,00D4B6C8,?,?,?,?,?,?), ref: 00D23482
CLSIDFromProgID.OLE32(MSXML.DOMDocument,00D4B6C8,?,?,?,?,?,?), ref: 00D2348E

Strings

Msxml2.DOMDocument, xrefs: 00D2347D
MSXML.DOMDocument, xrefs: 00D23489

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: FromProg$IncrementInitializeInterlocked
String ID: MSXML.DOMDocument$Msxml2.DOMDocument
API String ID: 2109125048-2356320334
Opcode ID: 88fb0382e5123990f6677db202d35db4755ffbdedc6bdaf96c6d3f2f2606965e
Instruction ID: 48f1c89064a2bc6e029ac579e9999cc023ecfb3d5c7612ac0b727de4daf3c819
Opcode Fuzzy Hash: 88fb0382e5123990f6677db202d35db4755ffbdedc6bdaf96c6d3f2f2606965e
Instruction Fuzzy Hash: 60F0E530B483755BD722ABA5BC0DF172F64ABB1F78F050456E805D5294D3A8C9438AB1

Function 00D24932 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 00D2495A
GlobalAlloc.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00D24989
GetLastError.KERNEL32(?,00000000,00000000,00000000), ref: 00D249B3
GetLastError.KERNEL32(00000000,00D2B790,?,?,?,00000000,00000000,00000000), ref: 00D249F4
GlobalFree.KERNEL32(00000000), ref: 00D24A28

Strings

fileutil.cpp, xrefs: 00D24978, 00D249D1

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: ErrorLast$Global$AllocFree
String ID: fileutil.cpp
API String ID: 1145190524-2967768451
Opcode ID: 3c26425ddd2c73f06ad8a010c6f72e6dd53de98147c69c243b0b035c76c3bdf4
Instruction ID: a2230337b13eec534a06183508c92f433eabde38e5a6899be2322d81286bf705
Opcode Fuzzy Hash: 3c26425ddd2c73f06ad8a010c6f72e6dd53de98147c69c243b0b035c76c3bdf4
Instruction Fuzzy Hash: C521F775A40339ABD712ABA99D44AABFBA8EFA5368F104116FD05E7200D770DC40DAF0

Function 00CFE705 Relevance: 9.1, APIs: 6, Instructions: 85windowCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000082,?,?), ref: 00CFE734
SetWindowLongW.USER32(?,000000EB,00000000), ref: 00CFE743
SetWindowLongW.USER32(?,000000EB,?), ref: 00CFE757
DefWindowProcW.USER32(?,?,?,?), ref: 00CFE767
GetWindowLongW.USER32(?,000000EB), ref: 00CFE781
PostQuitMessage.USER32(00000000), ref: 00CFE7DE

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: Window$Long$Proc$MessagePostQuit
String ID:
API String ID: 3812958022-0
Opcode ID: 177fbc7e1059f12e376979abe8e64473734d88e238cb022962a9d29d9ce53388
Instruction ID: d2c303bce3661e1f05448c35148256a8a69df775c1001c2357efcdaff0295e08
Opcode Fuzzy Hash: 177fbc7e1059f12e376979abe8e64473734d88e238cb022962a9d29d9ce53388
Instruction Fuzzy Hash: 9D217C32104218BFDB21AFA4DC48EBA3BA9EF54360F144525FA16AA2B0C771DD11DB62

Function 00D210C5 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 149registrystringCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,000002C0,00000000,000002C0,00000000,00000000,000002C0,BundleUpgradeCode,00000410,000002C0,00000000,00000000,00000000,00000100,00000000), ref: 00D210ED
RegQueryValueExW.KERNELBASE(?,00000000,00000000,?,?,?,?,?,?,00CF6EF3,00000100,000000B0,00000088,00000410,000002C0), ref: 00D21126
lstrlenW.KERNEL32(?,?,?,00000000,?,-00000001,00000004,00000000), ref: 00D2121A

Strings

BundleUpgradeCode, xrefs: 00D210CC
regutil.cpp, xrefs: 00D21161

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: QueryValue$lstrlen
String ID: BundleUpgradeCode$regutil.cpp
API String ID: 3790715954-1648651458
Opcode ID: 8e08ebd72ad13a38bff557e4dbabd8074554b48870f196b5d72a96c72963f18b
Instruction ID: 3ee5192e6ee13ee27ae599bfe4960ade85c68a2b7e49cc808930ba28a9b5f42b
Opcode Fuzzy Hash: 8e08ebd72ad13a38bff557e4dbabd8074554b48870f196b5d72a96c72963f18b
Instruction Fuzzy Hash: CF41F639E0022AEFDB21CF99D881AAEB7B9EF64714F158169FD05DB210D630DD118BB4

Function 00D007E4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 99COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 00D0088A
GetLastError.KERNEL32(?,?,?), ref: 00D00894

Strings

Failed to move file pointer 0x%x bytes., xrefs: 00D008C5
Invalid seek type., xrefs: 00D00820
cabextract.cpp, xrefs: 00D008B8

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move file pointer 0x%x bytes.$Invalid seek type.$cabextract.cpp
API String ID: 2976181284-417918914
Opcode ID: 9b8396e3dffab349fcf69966719c2538c4b6973cc543f76511bb427b7319f743
Instruction ID: 6450184c127f9ee1b08647d5406a885a799d31671841d09566739012e19f9349
Opcode Fuzzy Hash: 9b8396e3dffab349fcf69966719c2538c4b6973cc543f76511bb427b7319f743
Instruction Fuzzy Hash: B5318375A0061AFFDB15DF69CC85A6ABBA9FB04720F04822AF919D7650D730ED118BE0

Function 00D08B73 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 86registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D20E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,00D25699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 00D20E52

CompareStringW.KERNEL32(00000000,00000001,00000000,000000FF,?,000000FF,00000000,00000000,00000000,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,00000000,00000100,00000100,000001B4), ref: 00D08BF7
RegCloseKey.ADVAPI32(00000000,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,00000000,00000100,00000100,000001B4,?,?,?,00CEF66B,00000001,00000100,000001B4,00000000), ref: 00D08C45

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00D08B94
Failed to open uninstall registry key., xrefs: 00D08BBA
Failed to enumerate uninstall key for related bundles., xrefs: 00D08C56

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: CloseCompareOpenString
String ID: Failed to enumerate uninstall key for related bundles.$Failed to open uninstall registry key.$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 2817536665-2531018330
Opcode ID: babd51078fc1cbfe558e4876ffa18fc61dc74089559092cea1177ba2316a764c
Instruction ID: 95140841c17d1ada545a255b55ecf78e5b0ef8e2acc6b3a6a158c7dfb4324828
Opcode Fuzzy Hash: babd51078fc1cbfe558e4876ffa18fc61dc74089559092cea1177ba2316a764c
Instruction Fuzzy Hash: 9921D632901228FFEB21AB90DC45FAEBB79EB00324F284665F454B60D1CB754E90E6B4

Function 00CE4013 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(00CE533D,00CE53B5,00000000,00000000,?,00CF9EE4,00000000,00000000,00CE533D,00000000,00CE52B5,00000000,?,?,00CED4AC,00CE533D), ref: 00CE4021
GetLastError.KERNEL32(?,00CF9EE4,00000000,00000000,00CE533D,00000000,00CE52B5,00000000,?,?,00CED4AC,00CE533D,00000000,00000000), ref: 00CE402F
CreateDirectoryW.KERNEL32(00CE533D,00CE53B5,00CE5381,?,00CF9EE4,00000000,00000000,00CE533D,00000000,00CE52B5,00000000,?,?,00CED4AC,00CE533D,00000000), ref: 00CE4097
GetLastError.KERNEL32(?,00CF9EE4,00000000,00000000,00CE533D,00000000,00CE52B5,00000000,?,?,00CED4AC,00CE533D,00000000,00000000), ref: 00CE40A1

Strings

dirutil.cpp, xrefs: 00CE40CF

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: dirutil.cpp
API String ID: 1375471231-2193988115
Opcode ID: 7bd7c3dd9a02347ac87b681225bd045c9814a9133146ecba3c86b86b79a1d101
Instruction ID: 155460d0bc404e200a99e6aafaa246cfb8e88b7e6145f8070d63d2f62c2b83a1
Opcode Fuzzy Hash: 7bd7c3dd9a02347ac87b681225bd045c9814a9133146ecba3c86b86b79a1d101
Instruction Fuzzy Hash: AC11E1366003B1EBEB361AA35C44B3BB698EF51BA0F104136FF16EB150D7648D11A2E1

Function 00CE9D03 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 68COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00CE9D25

Strings

Failed to format path string., xrefs: 00CE9D30
Failed to set variable., xrefs: 00CE9D84
File search: %ls, did not find path: %ls, xrefs: 00CE9D90
Failed get file version., xrefs: 00CE9D65

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: Open@16
String ID: Failed get file version.$Failed to format path string.$Failed to set variable.$File search: %ls, did not find path: %ls
API String ID: 3613110473-2458530209
Opcode ID: 30fbb3203a25ba0e384398e6623464b9811a8b74e9e48fc3a86c136c864f1e33
Instruction ID: cf722d252e82093376748f3e53dfd33706731e61b0c6cd80702a3151be4bfe65
Opcode Fuzzy Hash: 30fbb3203a25ba0e384398e6623464b9811a8b74e9e48fc3a86c136c864f1e33
Instruction Fuzzy Hash: A2118132D00179BECB126E95DC819AEFB69EF14754B104165FC0467111D6325F64ABE1

Function 6CF66F60 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 196COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32(mbapreq.wxl,00000000,?,00000000,00000000,?,6CF61D15,00000000,mbapreq.wxl,?,00000000,?,00000000,?,?,?), ref: 6CF66FC0
GetSystemDefaultUILanguage.KERNEL32(00000000,00000000,00000000,00000000,00000000,?), ref: 6CF67078

Part of subcall function 6CF665CB: FindFirstFileW.KERNELBASE(00000000,?,00000000,00000000,?), ref: 6CF66606
Part of subcall function 6CF665CB: FindClose.KERNELBASE(00000000), ref: 6CF66612

Strings

%u\%ls, xrefs: 6CF66FD4, 6CF67037, 6CF6708C, 6CF670EB
mbapreq.wxl, xrefs: 6CF66F75

Memory Dump Source

Source File: 00000002.00000002.2976644492.000000006CF61000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF60000, based on PE: true

Associated: 00000002.00000002.2976608888.000000006CF60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976693645.000000006CF7F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976757688.000000006CF8A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976814931.000000006CF8C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cf60000_UNK_.jbxd

Similarity

API ID: DefaultFind$CloseFileFirstLangLanguageSystemUser
String ID: %u\%ls$mbapreq.wxl
API String ID: 2342833387-3698500817
Opcode ID: 2ecc83201a166ad1c8c18f1a3516a3cf3f7d1b8ce75bb349e59046a318a673f5
Instruction ID: 9f30c5f2d5aca46eee00969eb47decb0dc644c286c713f0f3c8d283e02f222ae
Opcode Fuzzy Hash: 2ecc83201a166ad1c8c18f1a3516a3cf3f7d1b8ce75bb349e59046a318a673f5
Instruction Fuzzy Hash: 8751A376D01519BBEB169AA2CC01FEE76B89F04714F1202A7FD00E7E50E735DE0997A0

Function 00D20D1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.KERNELBASE(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000002,00000100,00000000,00000000,?,?,00D08BD8), ref: 00D20D77
RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00D08BD8,00000000), ref: 00D20D99
RegEnumKeyExW.KERNELBASE(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000003,?,?,00D08BD8,00000000,00000000,00000000), ref: 00D20DF1

Strings

regutil.cpp, xrefs: 00D20DC1

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: Enum$InfoQuery
String ID: regutil.cpp
API String ID: 73471667-955085611
Opcode ID: a3026d7748266fcaee8a5b3077f33ef0e2a8fc25c267fcd4fe933169ee3c0b6a
Instruction ID: 8f957eaf690c49764f74097378d0525d2eadbb01aa69f8cc204aaba83c4704ee
Opcode Fuzzy Hash: a3026d7748266fcaee8a5b3077f33ef0e2a8fc25c267fcd4fe933169ee3c0b6a
Instruction Fuzzy Hash: 1231A3B6A01239FFEB218B999D44EBBBBACEF24354F110066BC04E7111D7309E5096B0

Function 00D088CF Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D20E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,00D25699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 00D20E52

RegCloseKey.KERNELBASE(00000000,00000000,00000088,00000000,000002C0,00000410,00020019,00000000,000002C0,00000000,?,?,?,00D08C14,00000000,00000000), ref: 00D0898C

Strings

Failed to ensure there is space for related bundles., xrefs: 00D0893F
Failed to open uninstall key for potential related bundle: %ls, xrefs: 00D088FB
Failed to initialize package from related bundle id: %ls, xrefs: 00D08972

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: CloseOpen
String ID: Failed to ensure there is space for related bundles.$Failed to initialize package from related bundle id: %ls$Failed to open uninstall key for potential related bundle: %ls
API String ID: 47109696-1717420724
Opcode ID: 76b67a06276a680ded615e7308f61729827014cab6ed6597420bb103746ea40a
Instruction ID: 9add936468c4245119863baedce9745be51d60d07add7ddb10dacfca6d933804
Opcode Fuzzy Hash: 76b67a06276a680ded615e7308f61729827014cab6ed6597420bb103746ea40a
Instruction Fuzzy Hash: E621713294022AFFDB12AA84DD06BFEBB69EB00711F144155F944A61D1DB719E20FFB1

Function 00CF3955 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D20E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,00D25699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 00D20E52

RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000001,feclient.dll,?,?,?,00CF3E61,feclient.dll,?,00000000,?,?,?,00CE4A0C), ref: 00CF39F1

Part of subcall function 00D20F6E: RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00D20FE4
Part of subcall function 00D20F6E: RegQueryValueExW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00D2101F

Strings

SOFTWARE\Policies\Microsoft\Windows\Installer, xrefs: 00CF3966
Logging, xrefs: 00CF3983
feclient.dll, xrefs: 00CF395A

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: Logging$SOFTWARE\Policies\Microsoft\Windows\Installer$feclient.dll
API String ID: 1586453840-3596319545
Opcode ID: 335add7600ddfc26bd42b8ff0846c6dc9e54216309217cd9f07172fe79664d46
Instruction ID: 4870b375dfe5bf6e7f015136f5624ea5187f183cbfc7cc3e2c1b266dbf5e24c7
Opcode Fuzzy Hash: 335add7600ddfc26bd42b8ff0846c6dc9e54216309217cd9f07172fe79664d46
Instruction Fuzzy Hash: 1C11E633B4024CBBDB629B95DD46EBEBB78EB50741F404066E611A7140D2F19F81D721

Function 00D20658 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62filestringCOMMONLIBRARYCODE

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,00000000,00000000,00000000,?,?,00D1FF0B,?,?,00000000,00000000,0000FDE9), ref: 00D2066A
WriteFile.KERNELBASE(00000200,00000000,00000000,00000000,00000000,?,?,00D1FF0B,?,?,00000000,00000000,0000FDE9), ref: 00D206A6
GetLastError.KERNEL32(?,?,00D1FF0B,?,?,00000000,00000000,0000FDE9), ref: 00D206B0

Strings

logutil.cpp, xrefs: 00D206E0

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: ErrorFileLastWritelstrlen
String ID: logutil.cpp
API String ID: 606256338-3545173039
Opcode ID: ffc9132586b60833b3af967c33704b8cacd0634271e41a61bc0c21afb4203eab
Instruction ID: 1d23afcda9abdea7e37f7f7cdda0431d62f6beb4aefad96efa15360984b85067
Opcode Fuzzy Hash: ffc9132586b60833b3af967c33704b8cacd0634271e41a61bc0c21afb4203eab
Instruction Fuzzy Hash: A7110672A003346BC3209A6A9D44EAFBFACEBA1766B000215FE05D7241DA71ED1086F0

Function 00D1FD20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00000900,?,00000000,00000000,00000000,00000000,?,00000000,?,?,00D203EC,?,00000000,?,?,00000001), ref: 00D1FD3F
GetLastError.KERNEL32(?,00D203EC,?,00000000,?,?,00000001,?,00CE5523,?,?,00000000,?,?,00CE528D,00000002), ref: 00D1FD4B
LocalFree.KERNEL32(00000000,?,00000000,00000000,?,?,00D203EC,?,00000000,?,?,00000001,?,00CE5523,?,?), ref: 00D1FDB3

Strings

logutil.cpp, xrefs: 00D1FD69

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: logutil.cpp
API String ID: 1365068426-3545173039
Opcode ID: f08f16173c9260c080b6c0807fe3ba44836ec2cef6cf07d842fdd1bba2132f35
Instruction ID: 5884557544ccbba627e50d99b03e611b1ee286542c0eb26c52407ce93c33f437
Opcode Fuzzy Hash: f08f16173c9260c080b6c0807fe3ba44836ec2cef6cf07d842fdd1bba2132f35
Instruction Fuzzy Hash: B9119A32600219FADB22AF90AD05FFF7B69EF55720F41402AFD0596160DB708AA0E7B1

Function 6CF634D8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 54COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000005,?,?,?,?,?,?,?,?,?,?,00000005,00000000,?,00000000), ref: 6CF63527

Strings

Failed to start detecting chain., xrefs: 6CF63547
Running detect BA function, xrefs: 6CF634E6
Failed calling detect BA function., xrefs: 6CF63505

Memory Dump Source

Source File: 00000002.00000002.2976644492.000000006CF61000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF60000, based on PE: true

Associated: 00000002.00000002.2976608888.000000006CF60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976693645.000000006CF7F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976757688.000000006CF8A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976814931.000000006CF8C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cf60000_UNK_.jbxd

Similarity

API ID: ShowWindow
String ID: Failed calling detect BA function.$Failed to start detecting chain.$Running detect BA function
API String ID: 1268545403-266677022
Opcode ID: 05a483317f9c716229162bdaa2ff09ee663bfb5171bdecfee1fb2d1e6fab4f2f
Instruction ID: 64d847cf2868fe91d038aa04da86f230cf8fa77b57ff6e7452a0d480f3c06a48
Opcode Fuzzy Hash: 05a483317f9c716229162bdaa2ff09ee663bfb5171bdecfee1fb2d1e6fab4f2f
Instruction Fuzzy Hash: 5001D232B05A12AFC2199B15DC48FABBBA5AF45724F110159F500DBF90DF62EC0ACB90

Function 00D0074E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D0114F: SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,00D0077D,?,?,?), ref: 00D01177
Part of subcall function 00D0114F: GetLastError.KERNEL32(?,00D0077D,?,?,?), ref: 00D01181

ReadFile.KERNELBASE(?,?,?,?,00000000,?,?,?), ref: 00D0078B
GetLastError.KERNEL32 ref: 00D00795

Strings

Failed to read during cabinet extraction., xrefs: 00D007C3
cabextract.cpp, xrefs: 00D007B9

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: ErrorFileLast$PointerRead
String ID: Failed to read during cabinet extraction.$cabextract.cpp
API String ID: 2170121939-2426083571
Opcode ID: 78ef0a8952639cfab7f889d4d5b8aabd8e33d9f358eb19665363cca395d968e7
Instruction ID: e22c8d26e6d53dceb88d5da4f0518a743442051ebcabe28a7b0244f15d7ea916
Opcode Fuzzy Hash: 78ef0a8952639cfab7f889d4d5b8aabd8e33d9f358eb19665363cca395d968e7
Instruction Fuzzy Hash: 5A01C872A00364BFDB219FA9DD05E9A7BA9FF05760F01011AFD08D7650D7319A119BF4

Function 00D24840 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000080,00000001,00000000,00000003,00000080,00000000,000002C0,00000000,?,00D08A30,00000000,00000088,000002C0,BundleCachePath,00000000), ref: 00D24874
GetLastError.KERNEL32(?,00D08A30,00000000,00000088,000002C0,BundleCachePath,00000000,000002C0,BundleVersion,000000B8,000002C0,EngineVersion,000002C0,000000B0), ref: 00D24881

Strings

fileutil.cpp, xrefs: 00D24855, 00D248A5

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: CreateErrorFileLast
String ID: fileutil.cpp
API String ID: 1214770103-2967768451
Opcode ID: 45db1eeab895ba9e87fb58253166c69002123acf74762bd1f7d8239be00fb113
Instruction ID: 1641e4d4830b2383f4e064496cf791b12ce306081a29ab2943e9873656ac9741
Opcode Fuzzy Hash: 45db1eeab895ba9e87fb58253166c69002123acf74762bd1f7d8239be00fb113
Instruction Fuzzy Hash: 3401D632640370BBE72226A5AD09F7B7688DB51B75F014222FE45EB1D0C6A58D0552F5

Function 00D0114F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,00D0077D,?,?,?), ref: 00D01177
GetLastError.KERNEL32(?,00D0077D,?,?,?), ref: 00D01181

Strings

Failed to move to virtual file pointer., xrefs: 00D011AF
cabextract.cpp, xrefs: 00D011A5

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move to virtual file pointer.$cabextract.cpp
API String ID: 2976181284-3005670968
Opcode ID: d83ea575d6ba3d608aadd46d7d5aca290b5b357a11fb3caa460ac6f2edfaf518
Instruction ID: c81b65d453f9c9c3b2f689b83fa75f9c576c65b6540d3870360e9cb5b48bb25c
Opcode Fuzzy Hash: d83ea575d6ba3d608aadd46d7d5aca290b5b357a11fb3caa460ac6f2edfaf518
Instruction Fuzzy Hash: 0201D63A600735BBD7221A6A9C04E87BF99EF517B0B018126FD1CD6590D771DC20CAF5

Function 00D0051A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00D2B468,00000000,?,00D0145A,?,00000000,?,00CEC121,?,00CE52FD,?,00CF73B2,?,?,00CE52FD,?), ref: 00D00524
GetLastError.KERNEL32(?,00D0145A,?,00000000,?,00CEC121,?,00CE52FD,?,00CF73B2,?,?,00CE52FD,?,00CE533D,00000001), ref: 00D0052E

Strings

Failed to set begin operation event., xrefs: 00D0055C
cabextract.cpp, xrefs: 00D00552

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: ErrorEventLast
String ID: Failed to set begin operation event.$cabextract.cpp
API String ID: 3848097054-4159625223
Opcode ID: 81fcedf9dbe699b2cc4bf6485089d6bbb7b2849b5080199817d15e6d30db79d4
Instruction ID: 885f4d32521cce38136c17a24da10e72ba849bc0446aaa4fd797e757d56f1998
Opcode Fuzzy Hash: 81fcedf9dbe699b2cc4bf6485089d6bbb7b2849b5080199817d15e6d30db79d4
Instruction Fuzzy Hash: DBF0A073B007306AA72166B96C0AB9B7AD8CF057A0F01012AFD09E7190E654AD0156F9

Function 00CFEA09 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009000,00000000,?), ref: 00CFEA1E
GetLastError.KERNEL32 ref: 00CFEA28

Strings

Failed to post detect message., xrefs: 00CFEA56
EngineForApplication.cpp, xrefs: 00CFEA4C

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: EngineForApplication.cpp$Failed to post detect message.
API String ID: 2609174426-598219917
Opcode ID: 8fd32ddfbd41d5e23439aab705607a5362ee2d20693e7f103ac8750c68d21e8a
Instruction ID: d1ea6bf179d992eb58a229e26cc1bad0c1b8b61fb6121e14b65437a28926f65b
Opcode Fuzzy Hash: 8fd32ddfbd41d5e23439aab705607a5362ee2d20693e7f103ac8750c68d21e8a
Instruction Fuzzy Hash: 92F0A7327403306FE7216669AC09F877FD4EF15BA0F014112FD08E6191D6619D01D6F9

Function 00D20F6E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 126registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00D20FE4
RegQueryValueExW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00D2101F

Strings

regutil.cpp, xrefs: 00D21057

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: QueryValue
String ID: regutil.cpp
API String ID: 3660427363-955085611
Opcode ID: dd2489ae121c5e48a14fadae6a241d53490b3a7b5575c6c467ae5c69843f000b
Instruction ID: 99c66d60244c997cf35b0599d67650fc9c7079815a4a3c06192c020da479671c
Opcode Fuzzy Hash: dd2489ae121c5e48a14fadae6a241d53490b3a7b5575c6c467ae5c69843f000b
Instruction Fuzzy Hash: E241F135D0026AEFDF208F94D940AAEBBB8EF24314F1481A9ED10E7210C7318E41DBA0

Function 6CF63561 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00008066,00000000,?), ref: 6CF63638

Strings

Ignoring attempt to only cache a bundle that does not explicitly support it., xrefs: 6CF63605
Running detect complete BA function, xrefs: 6CF6357B

Memory Dump Source

Source File: 00000002.00000002.2976644492.000000006CF61000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF60000, based on PE: true

Associated: 00000002.00000002.2976608888.000000006CF60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976693645.000000006CF7F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976757688.000000006CF8A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976814931.000000006CF8C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cf60000_UNK_.jbxd

Similarity

API ID: MessagePost
String ID: Ignoring attempt to only cache a bundle that does not explicitly support it.$Running detect complete BA function
API String ID: 410705778-194666019
Opcode ID: 448cb2d6fc9c0970c978f32695c4f7fa38c06ef5c0a9d066f85404710d92f1d1
Instruction ID: 8c48b4d77e5b118ee8e505f2e5302c612ee1b1e1a24974aff2f8a172283d6a6d
Opcode Fuzzy Hash: 448cb2d6fc9c0970c978f32695c4f7fa38c06ef5c0a9d066f85404710d92f1d1
Instruction Fuzzy Hash: 2021E532601B019FEB345F278484B97B7F5EB44728F20482ED26647F50EB72AC49CB50

Function 00CE501B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(burn.clean.room,?,?,?,?,00CE1104,?,?,00000000), ref: 00CE503A
CompareStringW.KERNELBASE(0000007F,00000001,?,0000000F,burn.clean.room,0000000F,?,?,?,?,00CE1104,?,?,00000000), ref: 00CE506A

Strings

burn.clean.room, xrefs: 00CE5027, 00CE5034, 00CE5061

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: CompareStringlstrlen
String ID: burn.clean.room
API String ID: 1433953587-3055529264
Opcode ID: 894265257328baaf90ba8772d2d54952ae2ea3b0bdc0b84de99bf35d984408ac
Instruction ID: ec407730b1adf790305974d047e18d10459d797e01336335edfdce6f0f7f3adb
Opcode Fuzzy Hash: 894265257328baaf90ba8772d2d54952ae2ea3b0bdc0b84de99bf35d984408ac
Instruction Fuzzy Hash: 3E01AD76600765AF83204F5EA885D73BB6CFB197687104216F919D2710C7B4AD40C6F1

Function 00CE33D7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,00CE10DD,?,00000000), ref: 00CE33F8
GetLastError.KERNEL32(?,?,?,00CE10DD,?,00000000), ref: 00CE340F

Strings

pathutil.cpp, xrefs: 00CE3433

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: pathutil.cpp
API String ID: 2776309574-741606033
Opcode ID: 3f5f735bdf263d831f225b9d1e2b3a4fbfb788294e373b5ed7d6c18036f428dd
Instruction ID: 2f29292d3a875bb38de1f5b73811fa633f781be858dabe661fa578e872747c72
Opcode Fuzzy Hash: 3f5f735bdf263d831f225b9d1e2b3a4fbfb788294e373b5ed7d6c18036f428dd
Instruction Fuzzy Hash: 21F0C233B003F06B9722666B9C4CE87BED9DB957A0B024122BD05EB190C671ED0186F0

Function 6CF6AC04 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 6CF6AC17
GetLastError.KERNEL32 ref: 6CF6AC21

Strings

thmutil.cpp, xrefs: 6CF6AC45

Memory Dump Source

Source File: 00000002.00000002.2976644492.000000006CF61000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF60000, based on PE: true

Associated: 00000002.00000002.2976608888.000000006CF60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976693645.000000006CF7F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976757688.000000006CF8A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976814931.000000006CF8C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cf60000_UNK_.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: thmutil.cpp
API String ID: 1948546556-2961750086
Opcode ID: 485f43004b695c47f69ba3df888aff13fc579c6d99fffd1aac4ee9938365a8e4
Instruction ID: c4ba1aad31d816451106cd5b9785cebbc7f00556dbf66d07259544416377123a
Opcode Fuzzy Hash: 485f43004b695c47f69ba3df888aff13fc579c6d99fffd1aac4ee9938365a8e4
Instruction Fuzzy Hash: 76E06D33A00239ABDB615EAA9C04BC77EA9EF05691F024221FE04E7510D722CC2097F4

Function 00CE37EA Relevance: 4.6, APIs: 3, Instructions: 79libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00CE3829
GetLastError.KERNEL32 ref: 00CE3833
LoadLibraryW.KERNELBASE(?,?,00000104,?), ref: 00CE389B

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: DirectoryErrorLastLibraryLoadSystem
String ID:
API String ID: 1230559179-0
Opcode ID: 80ae25324e41e6dddfb535a2638837f39ac7fc563f389220b01a091698fab3ba
Instruction ID: ef2b3e0afba1605c6a095130270b7990a7fcda9758a513fd026e35c90abbf314
Opcode Fuzzy Hash: 80ae25324e41e6dddfb535a2638837f39ac7fc563f389220b01a091698fab3ba
Instruction Fuzzy Hash: 792198B6D0136967DB309BA59C4DF9A776CAF44720F110166BD14E7281E670EE4486B0

Function 6CF6AD91 Relevance: 4.5, APIs: 3, Instructions: 40COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 6CF6ADA0
KiUserCallbackDispatcher.NTDLL(00000000,6CF62C02), ref: 6CF6ADCC
ShowWindow.USER32(00000000,6CF62C02,?,00000000), ref: 6CF6ADE1

Memory Dump Source

Source File: 00000002.00000002.2976644492.000000006CF61000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF60000, based on PE: true

Associated: 00000002.00000002.2976608888.000000006CF60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976693645.000000006CF7F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976757688.000000006CF8A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976814931.000000006CF8C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cf60000_UNK_.jbxd

Similarity

API ID: CallbackDispatcherItemShowUserWindow
String ID:
API String ID: 3248985991-0
Opcode ID: 7ab3284f5b66e6a03069765d4e8df03ad219c290f8415ea9ce76301ef6253c68
Instruction ID: 903ab56bb3c2cad095bf1058221db8e9ca8ce791c616cdc76f4ea98c80de7f0c
Opcode Fuzzy Hash: 7ab3284f5b66e6a03069765d4e8df03ad219c290f8415ea9ce76301ef6253c68
Instruction Fuzzy Hash: 97F0F036A01A34BB87124B2ADC88F977BBCFF46629710012AFE1653E40C771E801C7E0

Function 00CE3999 Relevance: 4.5, APIs: 3, Instructions: 20memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00CE3B34,00000000,?,00CE1472,00000000,80004005,00000000,80004005,00000000,000001C7,?,00CE13B7), ref: 00CE39A3
RtlFreeHeap.NTDLL(00000000,?,00CE3B34,00000000,?,00CE1472,00000000,80004005,00000000,80004005,00000000,000001C7,?,00CE13B7,000001C7,00000100), ref: 00CE39AA
GetLastError.KERNEL32(?,00CE3B34,00000000,?,00CE1472,00000000,80004005,00000000,80004005,00000000,000001C7,?,00CE13B7,000001C7,00000100,?), ref: 00CE39B4

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: Heap$ErrorFreeLastProcess
String ID:
API String ID: 406640338-0
Opcode ID: e92574e307ab1c3812bab980fd7280b9bfc6ef6240ab0512a3da23cd024471fa
Instruction ID: 5815bf38c4363bcf87d5ccbf0c9efca2ac9aa652d656c6e9760c821d18c9b523
Opcode Fuzzy Hash: e92574e307ab1c3812bab980fd7280b9bfc6ef6240ab0512a3da23cd024471fa
Instruction Fuzzy Hash: 8ED012326003346787212BFA5D0C697BF9CEF556F17014022FD09D2210D765991186F4

Function 00D2124D Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 76registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,00000008,00000000,00000000,00000000,000000B0,000002C0,00000000,00000000), ref: 00D2127B

Strings

regutil.cpp, xrefs: 00D212C5

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: QueryValue
String ID: regutil.cpp
API String ID: 3660427363-955085611
Opcode ID: 67c00ab6283270cbefa03a1b7da20d54619d5a2d409afda1737c1df8775d5197
Instruction ID: 1cd9300412b0e13cde6ff72c334d36de994cbf9fb53cdd67285490e0cd0bd5ce
Opcode Fuzzy Hash: 67c00ab6283270cbefa03a1b7da20d54619d5a2d409afda1737c1df8775d5197
Instruction Fuzzy Hash: FA219F3AA01229FFDF209E959C459AEBBA9EF35358F1481A9FD04E7210D2318E40D7B4

Function 00CEF5E0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D20E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,00D25699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 00D20E52

RegCloseKey.ADVAPI32(00000000,?,?,00000001,00000000,00000000,?,?,?,00CF7B4D,?,?,?), ref: 00CEF644

Part of subcall function 00D20EEC: RegQueryValueExW.ADVAPI32(00000004,?,00000000,00000000,?,00000000,00000000,?,?,?,00CEF619,00000000,Installed,00000000,?,?), ref: 00D20F10

Strings

Installed, xrefs: 00CEF60C

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Installed
API String ID: 3677997916-3662710971
Opcode ID: 1c556129609bbf3b0deef2c586db7d74ade978719e81851ee09a6477a551fa84
Instruction ID: a8fc088385e58d9616c6cc816168fc6628c26321a4d37d160184f67325fd5f4d
Opcode Fuzzy Hash: 1c556129609bbf3b0deef2c586db7d74ade978719e81851ee09a6477a551fa84
Instruction Fuzzy Hash: 1001A232810228FFCB11DB94C946BDEBBBCEF04321F1141A9F910A7120D3755E90DBA0

Function 00D20E3F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,00D25699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 00D20E52

Strings

regutil.cpp, xrefs: 00D20E8A

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: Open
String ID: regutil.cpp
API String ID: 71445658-955085611
Opcode ID: 6b3ed3e938a1100ca91f99855e7e10b0aa27e29c44c05c3780fee309e59ed6ea
Instruction ID: 845d4f8f94fee2a62f2c45378f82b1bbcc40287d7f5446969554facd86ff8d9e
Opcode Fuzzy Hash: 6b3ed3e938a1100ca91f99855e7e10b0aa27e29c44c05c3780fee309e59ed6ea
Instruction Fuzzy Hash: D2F027727012396BDF244A565C00BA73DC1DF156B0F028524BD49DA261D231CC1092E0

Function 00D1F349 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D1F35B

Part of subcall function 00D29814: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D29891
Part of subcall function 00D29814: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D298A2

Strings

PAYn, xrefs: 00D1F349, 00D1F355

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: PAYn
API String ID: 1269201914-1516412171
Opcode ID: 74e75791cf76355c23e84aa1a6098bac451c0119295c4a2d0047f4da92cc69b6
Instruction ID: bfc999401e1c9d2cbcab054403b901749cb1b75e3013ecb25e3529ae3809fd2f
Opcode Fuzzy Hash: 74e75791cf76355c23e84aa1a6098bac451c0119295c4a2d0047f4da92cc69b6
Instruction Fuzzy Hash: B3B012922AC4027E330413147C02C3A820CC1C1F29738C13AF540D0040EC805D481032

Function 00D1F37A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D1F35B

Part of subcall function 00D29814: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D29891
Part of subcall function 00D29814: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D298A2

Strings

PAYn, xrefs: 00D1F355

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: PAYn
API String ID: 1269201914-1516412171
Opcode ID: 40ac060a3fe716fdfa3472bfeab010dd6e2bb9f1af373d7176261510f4c02769
Instruction ID: e91722ca05c1a301c008fb04e92a3375f8c53a485accc2e30d34e70d12754044
Opcode Fuzzy Hash: 40ac060a3fe716fdfa3472bfeab010dd6e2bb9f1af373d7176261510f4c02769
Instruction Fuzzy Hash: 47B012912AC5027E334453183C02D3A814CC1C1F25738C13AF044C1140EC905C881032

Function 00D1F36A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D1F35B

Part of subcall function 00D29814: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D29891
Part of subcall function 00D29814: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D298A2

Strings

PAYn, xrefs: 00D1F355

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: PAYn
API String ID: 1269201914-1516412171
Opcode ID: d23bcec507b77692b8af337d9255358ce2615a65da716c1cbeb0f8021eeccf79
Instruction ID: c1263d92d0d53f22f4de4d7c2eb1f6457651f8fb1e9371192545ea20d2840a9e
Opcode Fuzzy Hash: d23bcec507b77692b8af337d9255358ce2615a65da716c1cbeb0f8021eeccf79
Instruction Fuzzy Hash: 8DB012912AC4027F334453183D03D3A814CC1C1F29738C03AF044C1140EC805C491032

Function 6CF6CFC9 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GdipDisposeImage.GDIPLUS(?), ref: 6CF6CFD8
GdipFree.GDIPLUS(?,?), ref: 6CF6CFEA

Memory Dump Source

Source File: 00000002.00000002.2976644492.000000006CF61000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF60000, based on PE: true

Associated: 00000002.00000002.2976608888.000000006CF60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976693645.000000006CF7F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976757688.000000006CF8A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976814931.000000006CF8C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cf60000_UNK_.jbxd

Similarity

API ID: Gdip$DisposeFreeImage
String ID:
API String ID: 1950503971-0
Opcode ID: 03f160872aa638f257772a3375396535bf462d28d2fd3953cbddc4bd9e40c7e6
Instruction ID: afb919e3bfe6276e1b8f160f150f848e1b51f38505ee96bc8db530c3559895c3
Opcode Fuzzy Hash: 03f160872aa638f257772a3375396535bf462d28d2fd3953cbddc4bd9e40c7e6
Instruction Fuzzy Hash: BEE0867214D21822DA152A55A901BC57ADC8F0575CF14841AFDE456E81CBE2648442F9

Function 00CE38D4 Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,000001C7,?,00CE2284,000001C7,00000001,80004005,8007139F,?,?,00D2015F,8007139F,?,00000000,00000000,8007139F), ref: 00CE38E5
RtlAllocateHeap.NTDLL(00000000,?,00CE2284,000001C7,00000001,80004005,8007139F,?,?,00D2015F,8007139F,?,00000000,00000000,8007139F), ref: 00CE38EC

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: e12f7f51613c009e760973d0c3fde93f9d80aa2ac541047e1bd9bcec83c9d9ff
Instruction ID: e2696d77bd1a9003139c8ccffeb5d399c8edf48feb6771f70312e9e1bdcd6968
Opcode Fuzzy Hash: e12f7f51613c009e760973d0c3fde93f9d80aa2ac541047e1bd9bcec83c9d9ff
Instruction Fuzzy Hash: 3BC01232190308A78B015FF4DC0EC5937ACA7247127048401B505C2210C77CE0248770

Function 00D23499 Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00D234CE

Part of subcall function 00D22F23: GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,00D234DF,00000000,?,00000000), ref: 00D22F3D
Part of subcall function 00D22F23: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00D0BDED,?,00CE52FD,?,00000000,?), ref: 00D22F49

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: ErrorHandleInitLastModuleVariant
String ID:
API String ID: 52713655-0
Opcode ID: 9538764486c414f746abd953f32ba22f35b5f2456ed19d6f4d1a506ea6e93c83
Instruction ID: 4154811b216230121e11d1e76d7ecd9ddbebb830e947e6150bb4384984e0e8e2
Opcode Fuzzy Hash: 9538764486c414f746abd953f32ba22f35b5f2456ed19d6f4d1a506ea6e93c83
Instruction Fuzzy Hash: 07311C76E006299BCB11DFA8D884ADEB7F8EF08710F01456AED15EB311D6749D058BA0

Function 00D2907D Relevance: 1.6, APIs: 1, Instructions: 81registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D28CFB: lstrlenW.KERNEL32(00000100,?,?,00D29098,000002C0,00000100,00000100,00000100,?,?,?,00D07B40,?,?,000001BC,00000000), ref: 00D28D1B

RegCloseKey.KERNELBASE(000002C0,000002C0,00000100,00000100,00000100,?,?,?,00D07B40,?,?,000001BC,00000000,00000000,00000000,00000100), ref: 00D29136

Part of subcall function 00D20E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,00D25699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 00D20E52

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: CloseOpenlstrlen
String ID:
API String ID: 514153755-0
Opcode ID: 433c73583e0be16a92508823e650a829c9bfe8cd11964b00de90ba17a22d0f0c
Instruction ID: 5d479bff0befd47b7e8bcf05c1d5552d1dd234d5aa8ff6c2d4040483d0f49696
Opcode Fuzzy Hash: 433c73583e0be16a92508823e650a829c9bfe8cd11964b00de90ba17a22d0f0c
Instruction Fuzzy Hash: 0B21B672C00239EBCF22AE65E85589EFAB5EF54754F154266FD00A3111D2328D60A6B0

Function 00CFEBA8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00CFEBE0

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: Open@16
String ID:
API String ID: 3613110473-0
Opcode ID: 29c1a251978a583d007ae1e4ec72e815610297a601cefb902dd62b68fe2ab955
Instruction ID: 565cb4d2d0076265370a742ac1c96fb0ef263ed3088e8295043577df99bdf7b2
Opcode Fuzzy Hash: 29c1a251978a583d007ae1e4ec72e815610297a601cefb902dd62b68fe2ab955
Instruction Fuzzy Hash: 9F11C47390021DBBCB50DF88CC80EAEBBA8EF14360F214569FA14A7210D731AE5097A1

Function 00D25728 Relevance: 1.6, APIs: 1, Instructions: 60registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(80070490,00000000,80070490,00D4AAA0,00000000,80070490,0095E858,?,00CF890E,WiX\Burn,PackageCache,00000000,00D4AAA0,00000000,00000000,80070490), ref: 00D25782

Part of subcall function 00D20F6E: RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00D20FE4
Part of subcall function 00D20F6E: RegQueryValueExW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00D2101F

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: QueryValue$Close
String ID:
API String ID: 1979452859-0
Opcode ID: 627fd4706e3d4f01a3f4f7dc7813734e32de0f1467d1f40aaee0c0e8be78a4bb
Instruction ID: 1428212554294aec8400deeedac3053186076a4b019917b7b2007a377f012b10
Opcode Fuzzy Hash: 627fd4706e3d4f01a3f4f7dc7813734e32de0f1467d1f40aaee0c0e8be78a4bb
Instruction Fuzzy Hash: 1811C67688053AEBCF216EA4FD81DAEB769EF34329B190279ED5167114C3314D50DAF0

Function 00CE34C5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,00000104,00000000,?,00CF89CA,0000001C,80070490,00000000,00000000,80070490), ref: 00CE34E5

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: ba7c99f697b473b0c6c675c46fb93bffb2da2153f2550edf84cfbf44739a004f
Instruction ID: 76c3253615e7ae12b239cde027cb30e0f5df147d9e4124546d7bd1252b2a1e28
Opcode Fuzzy Hash: ba7c99f697b473b0c6c675c46fb93bffb2da2153f2550edf84cfbf44739a004f
Instruction Fuzzy Hash: F8E012722012657BA6036E735C0EDEB7B9CEF157607048051BE40D7150E671E95096B0

Function 6CF64E81 Relevance: 1.5, APIs: 1, Instructions: 23windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00008068,00000000,?), ref: 6CF64EBE

Memory Dump Source

Source File: 00000002.00000002.2976644492.000000006CF61000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF60000, based on PE: true

Associated: 00000002.00000002.2976608888.000000006CF60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976693645.000000006CF7F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976757688.000000006CF8A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976814931.000000006CF8C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cf60000_UNK_.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: c45c5ccc0cf61748e54873e283af181eaef2b3a700d96ba038ae010f18af4d91
Instruction ID: fdd8369882e1b6d6fbf76ea10f03cd3e8e8acde5b607ee01627195758a40212f
Opcode Fuzzy Hash: c45c5ccc0cf61748e54873e283af181eaef2b3a700d96ba038ae010f18af4d91
Instruction Fuzzy Hash: 1BE01A30241305ABE750EF62E918BD53BE8AB11709F24C47AE519EDD91E772A457CA20

Function 00CE40E2 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000000,00000000,?,00CFA229,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,80070490), ref: 00CE40EB

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: db04101cfb27d4ee97be655a47a76e7b38447ef6a832e049182c21de5e29c2bd
Instruction ID: 0ad23d0cc560019bd4ec2a3a125bf2eb06c442a48d39bb93d59edc5829811d11
Opcode Fuzzy Hash: db04101cfb27d4ee97be655a47a76e7b38447ef6a832e049182c21de5e29c2bd
Instruction Fuzzy Hash: 5DD02B31201224174F2C8E6A8C0456E7B15DF227F23014215EC24CA1A0C3308D52E3D0

Function 6CF6B59C Relevance: 1.5, APIs: 1, Instructions: 12windowCOMMON

Download Yara Rule

APIs

IsDialogMessageW.USER32(?,?), ref: 6CF6B5AC

Memory Dump Source

Source File: 00000002.00000002.2976644492.000000006CF61000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF60000, based on PE: true

Associated: 00000002.00000002.2976608888.000000006CF60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976693645.000000006CF7F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976757688.000000006CF8A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2976814931.000000006CF8C000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6cf60000_UNK_.jbxd

Similarity

API ID: DialogMessage
String ID:
API String ID: 547518314-0
Opcode ID: 35fb3e471e5acab15ba1e2d1009432f12a82ebce3dd4f3ed06281c25c42fc39e
Instruction ID: 9e54414323e669c53b6aed2eafdf7fcd6f1247b05e6cb7f621ed475170ee8f4b
Opcode Fuzzy Hash: 35fb3e471e5acab15ba1e2d1009432f12a82ebce3dd4f3ed06281c25c42fc39e
Instruction Fuzzy Hash: 3CC08031218309DF9F41CF55DC40D5B77B9AB027007004414F804C2920D731DD60F750

Function 00D294D5 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D294E7

Part of subcall function 00D29814: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D29891
Part of subcall function 00D29814: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D298A2

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b5b0a4da1daced4174688701addf5da6310b74ceccd1e44e6b4ecc1b79ff96cd
Instruction ID: 79a295a4c238b7b458619a87142ca9a148b311c8efe30f58f7e2e2bc5b0e6e4d
Opcode Fuzzy Hash: b5b0a4da1daced4174688701addf5da6310b74ceccd1e44e6b4ecc1b79ff96cd
Instruction Fuzzy Hash: 0BB012852B85117E330832183C52C3A810CD6D0F14738C23AF100D10C4A8404C0A1433

Function 00D294F6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D294E7

Part of subcall function 00D29814: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D29891
Part of subcall function 00D29814: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D298A2

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2061cf3b12426b2c4c083b553954e6a5b3c3a95549f974af78a55156d4d13432
Instruction ID: 9009061b41d5259e0c858b23f8d37901217d90686f6acede77f487b30a76d696
Opcode Fuzzy Hash: 2061cf3b12426b2c4c083b553954e6a5b3c3a95549f974af78a55156d4d13432
Instruction Fuzzy Hash: 20B012862B84126E334872183C13D3A814CC2D0F14734C23AB504C21C0E8404C0E1432

Function 00D29506 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D294E7

Part of subcall function 00D29814: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D29891
Part of subcall function 00D29814: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D298A2

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a49c8d9699ccfbede770e505b5ac8ca3aef55e7d826201324c42f5a1966b608f
Instruction ID: f567402c0a712f9c76addc2c348e7fc6b6a8fcdf2863499fb22a2cd5139cb1d6
Opcode Fuzzy Hash: a49c8d9699ccfbede770e505b5ac8ca3aef55e7d826201324c42f5a1966b608f
Instruction Fuzzy Hash: D9B012852B86116E334872583E13D3A810CC6D0F14738823AF104C21C0E8414C0B1432

Function 00CE14B2 Relevance: 1.3, APIs: 1, Instructions: 54stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,00000000,00000000,?,?,00CE21B8,?,00000000,?,00000000,?,00CE38BD,00000000,?,00000104), ref: 00CE14E4

Part of subcall function 00CE3B51: GetProcessHeap.KERNEL32(00000000,000001C7,?,00CE21DC,000001C7,80004005,8007139F,?,?,00D2015F,8007139F,?,00000000,00000000,8007139F), ref: 00CE3B59
Part of subcall function 00CE3B51: HeapSize.KERNEL32(00000000,?,00CE21DC,000001C7,80004005,8007139F,?,?,00D2015F,8007139F,?,00000000,00000000,8007139F), ref: 00CE3B60

Memory Dump Source

Source File: 00000002.00000002.2974770335.0000000000CE1000.00000020.00000001.01000000.00000007.sdmp, Offset: 00CE0000, based on PE: true

Associated: 00000002.00000002.2974706706.0000000000CE0000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974868349.0000000000D2B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2974945125.0000000000D4A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2975001882.0000000000D4E000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ce0000_UNK_.jbxd

Similarity

API ID: Heap$ProcessSizelstrlen
String ID:
API String ID: 3492610842-0
Opcode ID: d7c8f9e79e04a08c435c518d63a10b37a582adc91c26ac3ceda71c45e2c1cdd3
Instruction ID: 79b51e0bcad1eb77a396600359310f9f853a58fa945588e5f043e1724d54520e
Opcode Fuzzy Hash: d7c8f9e79e04a08c435c518d63a10b37a582adc91c26ac3ceda71c45e2c1cdd3
Instruction Fuzzy Hash: A5012837200298AFCF215E56CC44F9A77A6AF41760F298225FE259B2A0D731ED609690

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: XRed

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Synaptics.exe_e414f81240f997f5a80d55495c221b9a78d76_455b7b6e_3401f65f-614f-49a0-a45f-984c9017e37e\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER37A1.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER427F.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER42A0.tmp.xml

C:\ProgramData\Synaptics\RCXF921.tmp

C:\ProgramData\Synaptics\Synaptics.exe

C:\ProgramData\Synaptics\Synaptics.exe:Zone.Identifier

C:\Users\user\AppData\Local\Temp\GYA7zi3n.xlsm

C:\Users\user\AppData\Local\Temp\Lmzx6kR.ini

C:\Users\user\AppData\Local\Temp\VY7C4oG.ini

Windows Analysis Report
file.exe

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre