Create Interactive Tour

Analysis Report GoogleUpdate.exe

Overview

General Information

Sample Name:	GoogleUpdate.exe
Analysis ID:	364388
MD5:	10adc07b8e83a4ebfe59bb94957c8e78
SHA1:	9d241f1ca14a3faa204bfac125b85b39b9c8dfbe
SHA256:	e5a4254a71a353c7c6d74a8ffe18cf287fde667e1006e8ae609477cdd417638e
Infos:
Most interesting Screenshot:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Potential time zone aware malware

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Detected potential crypto function

Entry point lies outside standard sections

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Installs a raw input device (often for capturing keystrokes)

PE file contains sections with non-standard names

PE file contains strange resources

Program does not show much activity (idle)

Yara signature match

Classification

Startup

System is w10x64

GoogleUpdate.exe (PID: 6424 cmdline: 'C:\Users\user\Desktop\GoogleUpdate.exe' MD5: 10ADC07B8E83A4EBFE59BB94957C8E78)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
GoogleUpdate.exe	SUSP_Unsigned_GoogleUpdate	Detects suspicious unsigned GoogleUpdate.exe	Florian Roth	0x168199:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 ...

Sigma Overview

No Sigma rule has matched

Signature Overview

• AV Detection
• Software Vulnerabilities
• Key, Mouse, Clipboard, Microphone and Screen Capturing
• System Summary
• Data Obfuscation
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: GoogleUpdate.exe

Avira: detected

Multi AV Scanner detection for submitted file

Show sources

Source: GoogleUpdate.exe	Virustotal: Detection: 42%	Perma Link
Source: GoogleUpdate.exe	Metadefender: Detection: 24%	Perma Link
Source: GoogleUpdate.exe	ReversingLabs: Detection: 78%

Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 4x nop then mov rdx, qword ptr [rsp+60h]	0_2_0054A660
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 4x nop then mov rdx, qword ptr [rsp+60h]	0_2_0054AAA0
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 4x nop then mov rsi, rdi	0_2_0042CE80

Source: GoogleUpdate.exe

Binary or memory string: GetAdaptersInfoGetClassInfoExWGetCommandLineWGetEnhMetaFileWGetMenuItemRectGetMonitorInfoWGetProcessTimesGetRawInputDataGetSecurityInfoGetStartupInfoWGetTextMetricsWHanifi_RohingyaIdempotency-KeyImpersonateSelfInsertMenuItemWIsWindowEnabledIsWindowVisibleIsWow

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: GoogleUpdate.exe, type: SAMPLE	Matched rule: Detects suspicious unsigned GoogleUpdate.exe Author: Florian Roth
Source: 0.0.GoogleUpdate.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects suspicious unsigned GoogleUpdate.exe Author: Florian Roth
Source: 0.2.GoogleUpdate.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects suspicious unsigned GoogleUpdate.exe Author: Florian Roth

Source: C:\Users\user\Desktop\GoogleUpdate.exe

Code function: 0_2_0046C2E0 NtWaitForSingleObject,

0_2_0046C2E0

Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_00494060	0_2_00494060
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_00556000	0_2_00556000
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_004D0020	0_2_004D0020
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_004500E0	0_2_004500E0
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_004DE0E0	0_2_004DE0E0
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_0043E080	0_2_0043E080
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_00416100	0_2_00416100
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_0040A1A0	0_2_0040A1A0
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_0049A1B8	0_2_0049A1B8
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_0044C2C0	0_2_0044C2C0
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_00554300	0_2_00554300
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_00472320	0_2_00472320
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_0054C520	0_2_0054C520
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_005125E0	0_2_005125E0
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_004CE5A0	0_2_004CE5A0
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_0049E640	0_2_0049E640
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_0054A660	0_2_0054A660
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_004646E0	0_2_004646E0
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_00406680	0_2_00406680
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_0051A6A0	0_2_0051A6A0
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_00442720	0_2_00442720
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_0054C720	0_2_0054C720
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_0055C780	0_2_0055C780
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_00540880	0_2_00540880
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_0040E8A0	0_2_0040E8A0
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_004109C0	0_2_004109C0
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_004589A0	0_2_004589A0
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_004C6A40	0_2_004C6A40
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_00428A20	0_2_00428A20
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_00548AE0	0_2_00548AE0
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_0054AAA0	0_2_0054AAA0
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_0054CB80	0_2_0054CB80
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_004FEC40	0_2_004FEC40
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_0055AC00	0_2_0055AC00
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_0055ACE0	0_2_0055ACE0
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_00500D60	0_2_00500D60
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_004F2D00	0_2_004F2D00
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_004ECDE0	0_2_004ECDE0
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_004FADE0	0_2_004FADE0
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_0041CE40	0_2_0041CE40
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_00448E40	0_2_00448E40
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_00514E40	0_2_00514E40
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_00508EE0	0_2_00508EE0
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_00518EE0	0_2_00518EE0
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_0054AEE0	0_2_0054AEE0
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_0042CE80	0_2_0042CE80
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_004DEF20	0_2_004DEF20
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_0041B040	0_2_0041B040
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_0049D140	0_2_0049D140
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_00405100	0_2_00405100
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_00417120	0_2_00417120
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: 0_2_00423240	0_2_00423240

Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: String function: 004389E0 appears 215 times
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: String function: 004AFFA0 appears 170 times
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: String function: 0043AC20 appears 294 times
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: String function: 0046A740 appears 41 times
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: String function: 004147C0 appears 196 times
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: String function: 004742A0 appears 38 times
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Code function: String function: 0052D120 appears 135 times

Source: GoogleUpdate.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: GoogleUpdate.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: GoogleUpdate.exe, type: SAMPLE	Matched rule: SUSP_Unsigned_GoogleUpdate date = 2019-08-05, author = Florian Roth, description = Detects suspicious unsigned GoogleUpdate.exe, reference = Internal Research, score = 5aa84aa5c90ec34b7f7d75eb350349ae3aa5060f3ad6dd0520e851626e9f8354
Source: 0.0.GoogleUpdate.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_Unsigned_GoogleUpdate date = 2019-08-05, author = Florian Roth, description = Detects suspicious unsigned GoogleUpdate.exe, reference = Internal Research, score = 5aa84aa5c90ec34b7f7d75eb350349ae3aa5060f3ad6dd0520e851626e9f8354
Source: 0.2.GoogleUpdate.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_Unsigned_GoogleUpdate date = 2019-08-05, author = Florian Roth, description = Detects suspicious unsigned GoogleUpdate.exe, reference = Internal Research, score = 5aa84aa5c90ec34b7f7d75eb350349ae3aa5060f3ad6dd0520e851626e9f8354

Source: classification engine

Classification label: mal76.evad.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\GoogleUpdate.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: GoogleUpdate.exe	Virustotal: Detection: 42%
Source: GoogleUpdate.exe	Metadefender: Detection: 24%
Source: GoogleUpdate.exe	ReversingLabs: Detection: 78%

Source: GoogleUpdate.exe	String found in binary or memory: heap_live= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=, elemsize=, npages = , settings:.WithCancel/Installed=/dev/stderr/dev/stdout/index.html/robots.txt30517578125: frame.sp=AppendMenuWBLAKE2b
Source: GoogleUpdate.exe	String found in binary or memory: gcwaiting= heap_live= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=, elemsize=, npages = , settings:.WithCancel/Installed=/dev/stderr/dev/stdout/index.html/robots.txt30517578125: frame.sp=AppendM
Source: GoogleUpdate.exe	String found in binary or memory: idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=, elemsize=, npages = , settings:.WithCancel/Installed=/dev/stderr/dev/stdout/index.html/robots.txt30517578125: frame.sp=AppendMenuWBLAKE2b-256BLAKE2b
Source: GoogleUpdate.exe	String found in binary or memory: KiB work, freeindex= gcwaiting= heap_live= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=, elemsize=, npages = , settings:.WithCancel/Installed=/dev/stderr/dev/stdout/index.html/robots.txt3051757
Source: GoogleUpdate.exe	String found in binary or memory: freeindex= gcwaiting= heap_live= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=, elemsize=, npages = , settings:.WithCancel/Installed=/dev/stderr/dev/stdout/index.html/robots.txt30517578125: frame
Source: GoogleUpdate.exe	String found in binary or memory: of size (targetpc= ErrCode=%v KiB work, freeindex= gcwaiting= heap_live= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=, elemsize=, npages = , settings:.WithCancel/Installed=/dev/stderr/dev/st
Source: GoogleUpdate.exe	String found in binary or memory: ws2_32.dll of size (targetpc= ErrCode=%v KiB work, freeindex= gcwaiting= heap_live= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=, elemsize=, npages = , settings:.WithCancel/Installed=/dev/std
Source: GoogleUpdate.exe	String found in binary or memory: (targetpc= ErrCode=%v KiB work, freeindex= gcwaiting= heap_live= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=, elemsize=, npages = , settings:.WithCancel/Installed=/dev/stderr/dev/stdout/index.
Source: GoogleUpdate.exe	String found in binary or memory: user32.dllws2_32.dll of size (targetpc= ErrCode=%v KiB work, freeindex= gcwaiting= heap_live= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=, elemsize=, npages = , settings:.WithCancel/Installe
Source: GoogleUpdate.exe	String found in binary or memory: , elemsize=, npages = , settings:.WithCancel/Installed=/dev/stderr/dev/stdout/index.html/robots.txt30517578125: frame.sp=AppendMenuWBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256Bad GatewayBad RequestClassHESIODCloseHandleCoGetObjectCookie.PathCreateFileWDefDlgP
Source: GoogleUpdate.exe	String found in binary or memory: , npages = , settings:.WithCancel/Installed=/dev/stderr/dev/stdout/index.html/robots.txt30517578125: frame.sp=AppendMenuWBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256Bad GatewayBad RequestClassHESIODCloseHandleCoGetObjectCookie.PathCreateFileWDefDlgProcWDeleteF
Source: GoogleUpdate.exe	String found in binary or memory: schedtick= span.list= timerslen=, elemsize=, npages = , settings:.WithCancel/Installed=/dev/stderr/dev/stdout/index.html/robots.txt30517578125: frame.sp=AppendMenuWBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256Bad GatewayBad RequestClassHESIODCloseHandleCoGetOb
Source: GoogleUpdate.exe	String found in binary or memory: timerslen=, elemsize=, npages = , settings:.WithCancel/Installed=/dev/stderr/dev/stdout/index.html/robots.txt30517578125: frame.sp=AppendMenuWBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256Bad GatewayBad RequestClassHESIODCloseHandleCoGetObjectCookie.PathCreateF
Source: GoogleUpdate.exe	String found in binary or memory: span.list= timerslen=, elemsize=, npages = , settings:.WithCancel/Installed=/dev/stderr/dev/stdout/index.html/robots.txt30517578125: frame.sp=AppendMenuWBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256Bad GatewayBad RequestClassHESIODCloseHandleCoGetObjectCookie.
Source: GoogleUpdate.exe	String found in binary or memory: p->status= s.nelems= schedtick= span.list= timerslen=, elemsize=, npages = , settings:.WithCancel/Installed=/dev/stderr/dev/stdout/index.html/robots.txt30517578125: frame.sp=AppendMenuWBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256Bad GatewayBad RequestClassHE
Source: GoogleUpdate.exe	String found in binary or memory: nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=, elemsize=, npages = , settings:.WithCancel/Installed=/dev/stderr/dev/stdout/index.html/robots.txt30517578125: frame.sp=AppendMenuWBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256Bad GatewayBad Req
Source: GoogleUpdate.exe	String found in binary or memory: s.nelems= schedtick= span.list= timerslen=, elemsize=, npages = , settings:.WithCancel/Installed=/dev/stderr/dev/stdout/index.html/robots.txt30517578125: frame.sp=AppendMenuWBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256Bad GatewayBad RequestClassHESIODCloseHa
Source: GoogleUpdate.exe	String found in binary or memory: mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=, elemsize=, npages = , settings:.WithCancel/Installed=/dev/stderr/dev/stdout/index.html/robots.txt30517578125: frame.sp=AppendMenuWBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s
Source: GoogleUpdate.exe	String found in binary or memory: in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=, elemsize=, npages = , settings:.WithCancel/Installed=/dev/stderr/dev/stdout/index.html/robots.txt30517578125: frame.sp=AppendMenuWBLAKE2b-256BLAKE2b-384BLAKE2b
Source: GoogleUpdate.exe	String found in binary or memory: ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=, elemsize=, npages = , settings:.WithCancel/Installed=/dev/stderr/dev/stdout/index.html/robots.txt30517578125: frame.sp=AppendMenuWBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256Bad Gat
Source: GoogleUpdate.exe	String found in binary or memory: cing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=, elemsize=, npages = , settings:.WithCancel/Installed=/dev/stderr/dev/stdout/index.html/robots.txt30517578125: frame.sp=AppendMenuWBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256Ba
Source: GoogleUpdate.exe	String found in binary or memory: .WithCancel/Installed=/dev/stderr/dev/stdout/index.html/robots.txt30517578125: frame.sp=AppendMenuWBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256Bad GatewayBad RequestClassHESIODCloseHandleCoGetObjectCookie.PathCreateFileWDefDlgProcWDeleteFileWDestroyIconDestroy

Source: GoogleUpdate.exe

Static file information: File size 1477120 > 1048576

Source: GoogleUpdate.exe

Static PE information: Raw size of .MPRESS1 is bigger than: 0x100000 < 0x164800

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\Desktop\GoogleUpdate.exe

Unpacked PE file: 0.2.GoogleUpdate.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:R; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:R;

Source: initial sample

Static PE information: section where entry point is pointing to: .MPRESS2

Source: GoogleUpdate.exe	Static PE information: section name: .MPRESS1
Source: GoogleUpdate.exe	Static PE information: section name: .MPRESS2

Source: C:\Users\user\Desktop\GoogleUpdate.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\GoogleUpdate.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Potential time zone aware malware

Show sources

Source: C:\Users\user\Desktop\GoogleUpdate.exe

System information queried: CurrentTimeZoneInformation

Jump to behavior

Source: C:\Users\user\Desktop\GoogleUpdate.exe

Code function: 0_2_0046A580 rdtsc

0_2_0046A580

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: GoogleUpdate.exe, 00000000.00000002.463795443.00000000000D0000.00000004.00000020.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\GoogleUpdate.exe

Code function: 0_2_0046A580 rdtsc

0_2_0046A580

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Command and Scripting Interpreter2	Path Interception	Path Interception	Software Packing1	Input Capture11	System Time Discovery1	Remote Services	Input Capture11	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Deobfuscate/Decode Files or Information1	LSASS Memory	Security Software Discovery11	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information2	Security Account Manager	System Information Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
GoogleUpdate.exe	42%	Virustotal		Browse
GoogleUpdate.exe	24%	Metadefender		Browse
GoogleUpdate.exe	79%	ReversingLabs	Win64.Trojan.WinGoCoinMiner
GoogleUpdate.exe	100%	Avira	HEUR/AGEN.1139256

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.0.GoogleUpdate.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1139256		Download File

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	364388
Start date:	08.03.2021
Start time:	04:00:18
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	GoogleUpdate.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.evad.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, UsoClient.exe

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	MS-DOS executable, MZ for MS-DOS
Entropy (8bit):	7.997928256829088
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	GoogleUpdate.exe
File size:	1477120
MD5:	10adc07b8e83a4ebfe59bb94957c8e78
SHA1:	9d241f1ca14a3faa204bfac125b85b39b9c8dfbe
SHA256:	e5a4254a71a353c7c6d74a8ffe18cf287fde667e1006e8ae609477cdd417638e
SHA512:	1b437e002d7bd8becb07c22b27966a8e95abcfb1b773d314549b72da04b234752a1e91ca1930fd118f9eac2225f0e63f5b5cd522414e7e8eb6952f81b2351bed
SSDEEP:	24576:JCfxYpqKZhf6XASrUfuNFTOcScInMgDDjzK30mVzb0cESXVPelUNpyfxSNodw:JCfQqKZhiXfr0AEPjzK3DWo0BJSNod
File Content Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d........DN.......".......'..6.......0R.......@...............................R.....@t.... ... ......0.......................................0R......@R.\|2.................................

File Icon


Icon Hash:	6863eee6b292c6ee

Static PE Info

General
Entrypoint:	0x923085
Entrypoint Section:	.MPRESS2
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	TERMINAL_SERVER_AWARE, NX_COMPAT, HIGH_ENTROPY_VA
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	79b3362178937bf9559741c46bb9e035

Entrypoint Preview

Instruction
push edi
push esi
push ebx
push ecx
push edx
inc ecx
push eax
dec eax
lea eax, dword ptr [00000ADEh]
dec eax
mov esi, dword ptr [eax]
dec eax
add esi, eax
dec eax
sub eax, eax
dec eax
mov edi, esi
lodsw
shl eax, 0Ch
dec eax
mov ecx, eax
push eax
lodsd
sub ecx, eax
dec eax
add esi, ecx
mov ecx, eax
push edi
inc esp
mov eax, ecx
dec ecx
mov al, byte ptr [ecx+edi+06h]
mov byte ptr [ecx+esi], al
jne 00007F6FA0D34C17h
inc ecx
push ecx
push ebp
sub eax, eax
lodsb
mov ecx, eax
shr ecx, 04h
push ecx
and al, 0Fh
push eax
lodsb
mov ecx, eax
add cl, byte ptr [esp]
push eax
dec eax
mov ebp, FFFFFD00h
dec eax
shl ebp, cl
pop ecx
pop eax
dec eax
shl eax, 20h
dec eax
add ecx, eax
pop eax
dec eax
mov ebx, esp
dec eax
lea esp, dword ptr [esp+ebp*2-00000E70h]
push eax
push ecx
dec eax
sub ecx, ecx
push ecx
push ecx
dec eax
mov ecx, esp
push ecx
mov dx, word ptr [edi]
shl edx, 0Ch
push edx
push edi
dec esp
lea ecx, dword ptr [ecx+08h]
dec ecx
lea ecx, dword ptr [ecx+08h]
push esi
pop edx
dec eax
sub esp, 20h
call 00007F6FA0D34CEDh
dec eax
mov esp, ebx
pop ebp
inc ecx
pop ecx
pop esi
pop edx
sub edx, 00001000h
sub ecx, ecx
cmp ecx, edx
jnc 00007F6FA0D34C6Ch
mov ebx, ecx
lodsb
inc ecx
cmp al, FFh
jne 00007F6FA0D34C2Fh
mov al, byte ptr [esi]
and al, FDh
cmp al, 15h
jne 00007F6FA0D34C0Dh
lodsb
inc ecx
jmp 00007F6FA0D34C39h
cmp al, 8Dh
jne 00007F6FA0D34C2Fh
mov al, byte ptr [esi]
and al, C7h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x523000	0x88	.MPRESS2
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x524000	0x327c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x523028	0x10	.MPRESS2
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.MPRESS1	0x1000	0x522000	0x164800	unknown	unknown	unknown	unknown	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.MPRESS2	0x523000	0xb7f	0xc00	False	0.56640625	data	6.03474287856	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x524000	0x327c	0x3400	False	0.364032451923	data	5.1407117968	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x524220	0x128	GLS_BINARY_LSB_FIRST
RT_ICON	0x524348	0x568	GLS_BINARY_LSB_FIRST
RT_ICON	0x5248b0	0x2e8	data
RT_ICON	0x524b98	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 8816262, next used block 9868950
RT_ICON	0x525440	0x668	dBase IV DBT of `.DBF, block length 1536, next free block index 40, next free block 224, next used block 65281
RT_ICON	0x525aa8	0xea8	data
RT_GROUP_ICON	0x526950	0x5a	data
RT_VERSION	0x5269ac	0x2f0	SysEx File - IDP	English	United States
RT_MANIFEST	0x526c9c	0x5e0	XML 1.0 document, ASCII text	English	United States

Imports

DLL	Import
KERNEL32	GetModuleHandleA, GetProcAddress

Version Infos

Description	Data
LegalCopyright	Copyright 2018 Google LLC
InternalName	Google Update
FileVersion	1.3.35.451
CompanyName	Google LLC
ProductName	Google Update
ProductVersion	1.3.35.451
FileDescription	Google Installer
OriginalFilename	GoogleUpdate.exe
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

• GoogleUpdate.exe

Click to jump to process

Memory Usage

• GoogleUpdate.exe

Click to jump to process

System Behavior

Analysis Process: GoogleUpdate.exe PID: 6424 Parent PID: 5876

Function Logs

General

Start time:	04:01:02
Start date:	08/03/2021
Path:	C:\Users\user\Desktop\GoogleUpdate.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Desktop\GoogleUpdate.exe'
Imagebase:	0x400000
File size:	1477120 bytes
MD5 hash:	10ADC07B8E83A4EBFE59BB94957C8E78
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Analysis Process: GoogleUpdate.exe PID: 6424 Parent PID: 5876 GoogleUpdate.exeCOMMON

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	0%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	1

Show Legend

Hide Nodes/Edges

Executed Functions

Function 0046BEA0, Relevance: 1.3, APIs: 1, Instructions: 33
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 0046BEFC

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d0669b4985bb6d9f6c777a0c481a917c13449a21f5db6f7fa9467ce6b76b27dd
Instruction ID: a1a6e33c47751909b9b42f4365236514c08ba5fb32913429b50d4f02c5e18332
Opcode Fuzzy Hash: d0669b4985bb6d9f6c777a0c481a917c13449a21f5db6f7fa9467ce6b76b27dd
Instruction Fuzzy Hash: EBF03C76A11B8082EB21CB1EE95131D7370F748BD4F248216CF9DA3B24DB39E592C340

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004589A0, Relevance: 26.3, Strings: 20, Instructions: 1283COMMON

Download Yara Rule

Strings

, ..., fp:-0930.html.jpeg.json.wasm.webp/ping1562578125:***@:path<nil>AdlamAprilArcToBamumBatakBuhidCall ChordCountDograECDSAErrorFoundGetDCGreekHTTP/KhmerLatinLimbuLocalLstatMarchNushuOghamOriyaOsageP-224P-256P-384P-521RangeRealmRunicSHA-1STermStartTakriTamil, xrefs: 0045921F
stack=[_NewEnumaddress cgocheckcs deadlockdefault:exporterfinishedfs go1.15.7gs hashratehijackedhttp/1.1https://if-matchif-rangeinvalid locationloopbacklstrcpyWlstrlenWmcentralno anodeno-cacheno_proxyoleaut32pollDescpwsh.exer10 r11 r12 , xrefs: 0045A37D
unknown caller pcunrecognized namewait for GC cyclewglGetProcAddresswrong medium type but memory size because dotdotdot to non-Go memory , locked to thread298023223876953125: day out of rangeAdjustWindowRectExArab Standard TimeCaucasian_AlbanianCertGetNameSt, xrefs: 0045A493
max= ptr siz= tab= top= u_a= u_g=%s %q%s*%d%s=%s"'&+0330+0430+0530+0545+0630+0845+1030+1245+1345, ..., fp:-0930.html.jpeg.json.wasm.webp/ping1562578125:***@:path<nil>AdlamAprilArcToBamumBatakBuhidCall ChordCountDograECDSAErrorFoundGetDCGreekHTTP/, xrefs: 0045A3FD
gopa, xrefs: 004590F2
runtime: gs.state = schedtracesemacquireset-cookiesetsockoptsocks bindstackLargeterminatedticks.locktracefree(tracegc()unixpacketunknown pcuser-agentuser32.dllws2_32.dll of size (targetpc= ErrCode=%v KiB work, freeindex= gcwaiting= heap_live= idleprocs= i, xrefs: 0045A2C8
7, xrefs: 0045A4E9
fp= is lr: of on pc= sp: sp=%x><) = ) m=+Inf, n -Inf.bat.cmd.com.css.exe.gif.htm.jpg.mjs.pdf.png.svg.txt.xml/PID/hr=0x%x108015m 3125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomAtoiCESTChamDATADashDateEESTEtagFromGOGCGoneHostJulyJuneLEAFLisuMiaoModiNZDTNZST, xrefs: 00459365
gentraceback callback cannot be used with non-zero skipnet/http: invalid byte %q in %s; dropping invalid bytesnet/http: request canceled while waiting for connectionnewproc: function arguments too large for new goroutineos: invalid use of WriteAt on file opene, xrefs: 0045A4DE
runtime: unexpected return pc for schedule: spinning with local workslice bounds out of range [%x:%y:]slice bounds out of range [:%x:%y]stream error: stream ID %d; %v; %vtimeout waiting for client prefacetls: malformed key_share extensiontoo many references: c, xrefs: 00459E57
()*+,-./012456:;<=>?@BCLMNOPSZ["\, xrefs: 00459145
traceback did not unwind completelytransform: short destination buffertransport endpoint is not connectedunsupported signature algorithm: %vx509: decryption password incorrectx509: wrong Ed25519 public key size LastStreamID=%v ErrCode=%v Debug=%q) is larger th, xrefs: 0045A431
top= u_a= u_g=%s %q%s*%d%s=%s"'&+0330+0430+0530+0545+0630+0845+1030+1245+1345, ..., fp:-0930.html.jpeg.json.wasm.webp/ping1562578125:***@:path<nil>AdlamAprilArcToBamumBatakBuhidCall ChordCountDograECDSAErrorFoundGetDCGreekHTTP/KhmerLatinLimbuLocal, xrefs: 0045A325
runtime: unknown pc secured.mx-share.comsemaRoot rotateRighttime: invalid numbertrace: out of memoryunexpected network: unknown PSK identityunknown address typewirep: already in goworkbuf is not emptywrite of Go pointer ws2_32.dll not found of unexported metho, xrefs: 0045A1AC
gentraceback cannot trace user goroutine on its own stackreceived record with version %x when expecting version %xruntime:stoplockedm: g is not Grunnable or Gscanrunnablesync: WaitGroup misuse: Add called concurrently with Waittls: Ed25519 public keys are not, xrefs: 0045A4C5
] n=allgallpasn1avx2basebindbmi1bmi2boolcallcas1cas2cas3cas4cas5cas6chancoindatedeaddialermsetagfilefromftpsfuncgziphosthourhttpicmpidleigmpint8itabkindlinkmcIDopenpathpipepop3profquitreadrootsbrksmtpsse2sse3tag:tcp4tcp6trueudp4uintunixvaryxn-- ... H_T= H_a= , xrefs: 0045A3D6
panicparsepop3srangescav schedsleepslicesocksspinesse41sse42ssse3sudogsweeptext/tls: traceuint8usageutf-8write FROM Value addr= alloc base code= ctxt: curg= free goid jobs= list= m->p= next= p->m= prev= span= varp=% util(...), i = , not , val /p.txt390625, xrefs: 0045910E
runtime., xrefs: 004590DB
called from flushedWork heap_marked= idlethreads= in host name is nil, not nStackRoots= out of range s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (130.0.232.1453814697265625Accept-RangesAuthorization, xrefs: 00459E8E
: frame.sp=AppendMenuWBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256Bad GatewayBad RequestClassHESIODCloseHandleCoGetObjectCookie.PathCreateFileWDefDlgProcWDeleteFileWDestroyIconDestroyMenuDrawMenuBarENABLE_PUSHEND_HEADERSEarly HintsEnumWindowsExitProcessFindWin, xrefs: 0045A2F6

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID: stack=[_NewEnumaddress cgocheckcs deadlockdefault:exporterfinishedfs go1.15.7gs hashratehijackedhttp/1.1https://if-matchif-rangeinvalid locationloopbacklstrcpyWlstrlenWmcentralno anodeno-cacheno_proxyoleaut32pollDescpwsh.exer10 r11 r12 $ called from flushedWork heap_marked= idlethreads= in host name is nil, not nStackRoots= out of range s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (130.0.232.1453814697265625Accept-RangesAuthorization$ fp= is lr: of on pc= sp: sp=%x><) = ) m=+Inf, n -Inf.bat.cmd.com.css.exe.gif.htm.jpg.mjs.pdf.png.svg.txt.xml/PID/hr=0x%x108015m 3125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomAtoiCESTChamDATADashDateEESTEtagFromGOGCGoneHostJulyJuneLEAFLisuMiaoModiNZDTNZST$ max= ptr siz= tab= top= u_a= u_g=%s %q%s*%d%s=%s"'&+0330+0430+0530+0545+0630+0845+1030+1245+1345, ..., fp:-0930.html.jpeg.json.wasm.webp/ping1562578125:***@:path<nil>AdlamAprilArcToBamumBatakBuhidCall ChordCountDograECDSAErrorFoundGetDCGreekHTTP/$ top= u_a= u_g=%s %q%s*%d%s=%s"'&+0330+0430+0530+0545+0630+0845+1030+1245+1345, ..., fp:-0930.html.jpeg.json.wasm.webp/ping1562578125:***@:path<nil>AdlamAprilArcToBamumBatakBuhidCall ChordCountDograECDSAErrorFoundGetDCGreekHTTP/KhmerLatinLimbuLocal$()*+,-./012456:;<=>?@BCLMNOPSZ["\$, ..., fp:-0930.html.jpeg.json.wasm.webp/ping1562578125:***@:path<nil>AdlamAprilArcToBamumBatakBuhidCall ChordCountDograECDSAErrorFoundGetDCGreekHTTP/KhmerLatinLimbuLocalLstatMarchNushuOghamOriyaOsageP-224P-256P-384P-521RangeRealmRunicSHA-1STermStartTakriTamil$7$: frame.sp=AppendMenuWBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256Bad GatewayBad RequestClassHESIODCloseHandleCoGetObjectCookie.PathCreateFileWDefDlgProcWDeleteFileWDestroyIconDestroyMenuDrawMenuBarENABLE_PUSHEND_HEADERSEarly HintsEnumWindowsExitProcessFindWin$] n=allgallpasn1avx2basebindbmi1bmi2boolcallcas1cas2cas3cas4cas5cas6chancoindatedeaddialermsetagfilefromftpsfuncgziphosthourhttpicmpidleigmpint8itabkindlinkmcIDopenpathpipepop3profquitreadrootsbrksmtpsse2sse3tag:tcp4tcp6trueudp4uintunixvaryxn-- ... H_T= H_a= $gentraceback callback cannot be used with non-zero skipnet/http: invalid byte %q in %s; dropping invalid bytesnet/http: request canceled while waiting for connectionnewproc: function arguments too large for new goroutineos: invalid use of WriteAt on file opene$gentraceback cannot trace user goroutine on its own stackreceived record with version %x when expecting version %xruntime:stoplockedm: g is not Grunnable or Gscanrunnablesync: WaitGroup misuse: Add called concurrently with Waittls: Ed25519 public keys are not$gopa$panicparsepop3srangescav schedsleepslicesocksspinesse41sse42ssse3sudogsweeptext/tls: traceuint8usageutf-8write FROM Value addr= alloc base code= ctxt: curg= free goid jobs= list= m->p= next= p->m= prev= span= varp=% util(...), i = , not , val /p.txt390625$runtime.$runtime: gs.state = schedtracesemacquireset-cookiesetsockoptsocks bindstackLargeterminatedticks.locktracefree(tracegc()unixpacketunknown pcuser-agentuser32.dllws2_32.dll of size (targetpc= ErrCode=%v KiB work, freeindex= gcwaiting= heap_live= idleprocs= i$runtime: unexpected return pc for schedule: spinning with local workslice bounds out of range [%x:%y:]slice bounds out of range [:%x:%y]stream error: stream ID %d; %v; %vtimeout waiting for client prefacetls: malformed key_share extensiontoo many references: c$runtime: unknown pc secured.mx-share.comsemaRoot rotateRighttime: invalid numbertrace: out of memoryunexpected network: unknown PSK identityunknown address typewirep: already in goworkbuf is not emptywrite of Go pointer ws2_32.dll not found of unexported metho$traceback did not unwind completelytransform: short destination buffertransport endpoint is not connectedunsupported signature algorithm: %vx509: decryption password incorrectx509: wrong Ed25519 public key size LastStreamID=%v ErrCode=%v Debug=%q) is larger th$unknown caller pcunrecognized namewait for GC cyclewglGetProcAddresswrong medium type but memory size because dotdotdot to non-Go memory , locked to thread298023223876953125: day out of rangeAdjustWindowRectExArab Standard TimeCaucasian_AlbanianCertGetNameSt
API String ID: 0-4205282193
Opcode ID: b5f17980a09c201a4af694ff872d22f3b0d1e5d34422227166c1dab4bc202dfa
Instruction ID: 742a3a698a7e67998e1e0a09b5cf010ac9ed89fe6ab8d064a6e45bba35d44d0f
Opcode Fuzzy Hash: b5f17980a09c201a4af694ff872d22f3b0d1e5d34422227166c1dab4bc202dfa
Instruction Fuzzy Hash: EAD2F636209BC1C5DA609B12F4843AEB7A5F789B85F44911AEECD43B6ADF3CC494CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00556000, Relevance: 18.1, Strings: 14, Instructions: 605
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 005566A6
, xrefs: 00556CBF
$, xrefs: 00556CDF
, xrefs: 00556E97
$, xrefs: 00556B7F
, xrefs: 00556E8E
, xrefs: 00556A1F
, xrefs: 00556F09
, xrefs: 00556F12
, xrefs: 00556C3F
, xrefs: 00556C7F
$, xrefs: 00556B5F
, xrefs: 00556F25
, xrefs: 00556C9F

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID: $ $ $ $ $ $ $ $ $ $ $$$$$$
API String ID: 0-2929251723
Opcode ID: d75232f513e07c826254201d37348f49ed43ba8c7db788e846c562239d1a9afe
Instruction ID: aab03b5d8cc416b6a748023b47713856dd87ec1e2542a05428487429ec2691cd
Opcode Fuzzy Hash: d75232f513e07c826254201d37348f49ed43ba8c7db788e846c562239d1a9afe
Instruction Fuzzy Hash: 2B925EB2119BC4D5EBA0CB00F49839AB7A4F398358F504619E7C947B99DFBDC298CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00540880, Relevance: 16.8, Strings: 12, Instructions: 1826COMMON

Download Yara Rule

Strings

20060102150405.000000-070072759576141834259033203125: day-of-year out of rangeAddClipboardFormatListenerBougainville Standard TimeCentral Asia Standard TimeCertFreeCertificateContextDisableWindowsUpdateAccessDwmInvalidateIconicBitmapsE. Australia Standard Time, xrefs: 005426DD
unsupported type (%T)user defined signal 1user defined signal 2wglCreateLayerContext%SystemRoot%\system32\/lib/time/zoneinfo.zip4656612873077392578125Aleutian Standard TimeAtlantic Standard TimeCaucasus Standard TimeConvertSidToStringSidWConvertStringSidToSidW, xrefs: 0054104D
%02d%02d/Disable/version2.5.4.102.5.4.112.5.4.1748828125AbortDocAcceptExAcceptedAngleArcArmenianBalineseBopomofoBugineseCancelIoCherokeeClassANYConflictContinueCopyRectCurveID(CyrillicDNS nameDSA-SHA1DebuggerDecemberDeleteDCDrawIconDuployanDwmFlushEndPaintEqua, xrefs: 00542954
no such struct fieldnot an integer classnotetsleep not on g0number has no digitsout is not a pointerp mcache not flushedpacer: assist ratio=pad length too largepreempt off reason: reflect.Value.SetIntreflect.makeFuncStubruntime: double waitruntime: unknown pc , xrefs: 00540C13
reflect.Value.Uintreflect: Zero(nil)runtime.semacreateruntime.semawakeupruntime: npages = secured.4share.icusegmentation faultsequence truncatedstreams pipe errorsystem page size (tracebackancestorstruncated sequenceunexpected messageuse of closed filevalue ou, xrefs: 00542D8A, 00542DEC
_B>f, xrefs: 00541CA0
reflect.Value.Intreflect.Value.Lenreflect: New(nil)reflect: call of runtime.newosprocruntime/internal/runtime: level = runtime: nameOff runtime: next_gc=runtime: pointer runtime: summary[runtime: textOff runtime: typeOff scanobject n == 0secured.kakz.infoseeke, xrefs: 00542D42, 00542E34
CanSet() is falseCertFindExtensionChoosePixelFormatCk & Up triggeredCreateStdDispatchCryptDecodeObjectDeleteEnhMetaFileDnsRecordListFreeENHANCE_YOUR_CALMFLE Standard TimeFailed DependencyGC assist markingGMT Standard TimeGTB Standard TimeGetCaretBlinkTimeGetCu, xrefs: 00542BA2
@, xrefs: 00542593
not a boolnotifyListowner diedres binderres masterresumptionruntime: gs.state = schedtracesemacquireset-cookiesetsockoptsocks bindstackLargeterminatedticks.locktracefree(tracegc()unixpacketunknown pcuser-agentuser32.dllws2_32.dll of size (targetpc= ErrCode, xrefs: 00540E11
not a Float32not availableout of memoryparsing time procexp64.exesocks connectsrmount errortimer expiredtraceStackTabtrailing datatriggerRatio=unsupported: user canceledvalue method wglShareListsxadd64 failedxchg64 failed}sched={pc: but progSize nmidlelocke, xrefs: 00542381
unsupported slice type (%T)work.nwait was > work.nproc args stack map entries for 18189894035458564758300781259094947017729282379150390625Aus Central W. Standard TimeCanada Central Standard TimeCen. Australia Standard TimeCentral Europe Standard TimeCertCreate, xrefs: 00541B5F

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID: %02d%02d/Disable/version2.5.4.102.5.4.112.5.4.1748828125AbortDocAcceptExAcceptedAngleArcArmenianBalineseBopomofoBugineseCancelIoCherokeeClassANYConflictContinueCopyRectCurveID(CyrillicDNS nameDSA-SHA1DebuggerDecemberDeleteDCDrawIconDuployanDwmFlushEndPaintEqua$20060102150405.000000-070072759576141834259033203125: day-of-year out of rangeAddClipboardFormatListenerBougainville Standard TimeCentral Asia Standard TimeCertFreeCertificateContextDisableWindowsUpdateAccessDwmInvalidateIconicBitmapsE. Australia Standard Time$@$CanSet() is falseCertFindExtensionChoosePixelFormatCk & Up triggeredCreateStdDispatchCryptDecodeObjectDeleteEnhMetaFileDnsRecordListFreeENHANCE_YOUR_CALMFLE Standard TimeFailed DependencyGC assist markingGMT Standard TimeGTB Standard TimeGetCaretBlinkTimeGetCu$_B>f$no such struct fieldnot an integer classnotetsleep not on g0number has no digitsout is not a pointerp mcache not flushedpacer: assist ratio=pad length too largepreempt off reason: reflect.Value.SetIntreflect.makeFuncStubruntime: double waitruntime: unknown pc $not a Float32not availableout of memoryparsing time procexp64.exesocks connectsrmount errortimer expiredtraceStackTabtrailing datatriggerRatio=unsupported: user canceledvalue method wglShareListsxadd64 failedxchg64 failed}sched={pc: but progSize nmidlelocke$not a boolnotifyListowner diedres binderres masterresumptionruntime: gs.state = schedtracesemacquireset-cookiesetsockoptsocks bindstackLargeterminatedticks.locktracefree(tracegc()unixpacketunknown pcuser-agentuser32.dllws2_32.dll of size (targetpc= ErrCode$reflect.Value.Intreflect.Value.Lenreflect: New(nil)reflect: call of runtime.newosprocruntime/internal/runtime: level = runtime: nameOff runtime: next_gc=runtime: pointer runtime: summary[runtime: textOff runtime: typeOff scanobject n == 0secured.kakz.infoseeke$reflect.Value.Uintreflect: Zero(nil)runtime.semacreateruntime.semawakeupruntime: npages = secured.4share.icusegmentation faultsequence truncatedstreams pipe errorsystem page size (tracebackancestorstruncated sequenceunexpected messageuse of closed filevalue ou$unsupported slice type (%T)work.nwait was > work.nproc args stack map entries for 18189894035458564758300781259094947017729282379150390625Aus Central W. Standard TimeCanada Central Standard TimeCen. Australia Standard TimeCentral Europe Standard TimeCertCreate$unsupported type (%T)user defined signal 1user defined signal 2wglCreateLayerContext%SystemRoot%\system32\/lib/time/zoneinfo.zip4656612873077392578125Aleutian Standard TimeAtlantic Standard TimeCaucasus Standard TimeConvertSidToStringSidWConvertStringSidToSidW
API String ID: 0-4232857672
Opcode ID: 08718395af24f7d4eb5bd5dab76c96a26dabb5a8d7154de0941e633461cf93ac
Instruction ID: fede0f008ce42183ddaae83ac7f7f5212816edfeb5d039fbf7fe6aa026080f0d
Opcode Fuzzy Hash: 08718395af24f7d4eb5bd5dab76c96a26dabb5a8d7154de0941e633461cf93ac
Instruction Fuzzy Hash: 8F130336609F84C5CA60CF05F4803AAB7A5F399B88F549526EACD47B29DF7CC5A4CB40

Uniqueness

Uniqueness Score: -1.00%

Function 004C6A40, Relevance: 15.2, Strings: 10, Instructions: 2721COMMON

Download Yara Rule

Strings

: day-of-year out of rangeAddClipboardFormatListenerBougainville Standard TimeCentral Asia Standard TimeCertFreeCertificateContextDisableWindowsUpdateAccessDwmInvalidateIconicBitmapsE. Australia Standard TimeECDSA verification failureEkaterinburg Standard Time, xrefs: 004CA1BC
"\, xrefs: 004CA340
: day-of-year does not match monthOther_Default_Ignorable_Code_PointSetFileCompletionNotificationModesTLS 1.3, client CertificateVerify, xrefs: 004CA06F
minuteobjectpopcntremovesecondselectsendtoserversocketsocks socks5statusstringstructsweep sysmontelnettimersuint16uint32uint64unusedwindir %v=%v, (conn) (scan (scan) MB in Value> dying= flags= len=%d locks= m->g0= nmsys= s=nil zombie%v: %#x, goid=, j0 = --c, xrefs: 004C896F
monthntohspanicparsepop3srangescav schedsleepslicesocksspinesse41sse42ssse3sudogsweeptext/tls: traceuint8usageutf-8write FROM Value addr= alloc base code= ctxt: curg= free goid jobs= list= m->p= next= p->m= prev= span= varp=% util(...), i = , not , val /p, xrefs: 004C82D8
: extra text: <not Stringer>Accept-CharsetActivateActCtxCallNextHookExCertCloseStoreClientToScreenCloseClipboardCoInitializeExCoUninitializeContent-LengthControlServiceCreateEventExWCreateMutexExWCreateProcessWCreateServiceWCryptGenRandomDefWindowProcWDkim-Sig, xrefs: 004CA42C
hourhttpicmpidleigmpint8itabkindlinkmcIDopenpathpipepop3profquitreadrootsbrksmtpsse2sse3tag:tcp4tcp6trueudp4uintunixvaryxn-- ... H_T= H_a= H_g= MB, W_a= and cnt= h_a= h_g= h_t= max= ptr siz= tab= top= u_a= u_g=%s %q%s*%d%s=%s"'&+0330+0430+0530+, xrefs: 004C884F, 004C8A62
: day out of rangeAdjustWindowRectExArab Standard TimeCaucasian_AlbanianCertGetNameStringWCheckMenuRadioItemCloseServiceHandleCommandLineToArgvWCreateCompatibleDCCreateDialogParamWCreateDispTypeInfoCreateEnhMetaFileWCreateFileMappingWCreateWellKnownSidCryptUnp, xrefs: 004C934F
: day-of-year does not match dayCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyDwmModifyPreviousDxFrameDurationGetVolumePathNamesForVolumeNameWMapIter.Value called before NextRegisterPowerSettingNotificationSWbemServices is not InitializedWSAG, xrefs: 004C9F3E
out of range s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (130.0.232.1453814697265625Accept-RangesAuthorizationCLIENT_RANDOMCONNECT_ERRORCache-ControlCertOpenStoreCheckMenuItemCloseEventLogCoTaskMemFree, xrefs: 004C7069

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID: out of range s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (130.0.232.1453814697265625Accept-RangesAuthorizationCLIENT_RANDOMCONNECT_ERRORCache-ControlCertOpenStoreCheckMenuItemCloseEventLogCoTaskMemFree$"\$: day out of rangeAdjustWindowRectExArab Standard TimeCaucasian_AlbanianCertGetNameStringWCheckMenuRadioItemCloseServiceHandleCommandLineToArgvWCreateCompatibleDCCreateDialogParamWCreateDispTypeInfoCreateEnhMetaFileWCreateFileMappingWCreateWellKnownSidCryptUnp$: day-of-year does not match dayCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyDwmModifyPreviousDxFrameDurationGetVolumePathNamesForVolumeNameWMapIter.Value called before NextRegisterPowerSettingNotificationSWbemServices is not InitializedWSAG$: day-of-year does not match monthOther_Default_Ignorable_Code_PointSetFileCompletionNotificationModesTLS 1.3, client CertificateVerify$: day-of-year out of rangeAddClipboardFormatListenerBougainville Standard TimeCentral Asia Standard TimeCertFreeCertificateContextDisableWindowsUpdateAccessDwmInvalidateIconicBitmapsE. Australia Standard TimeECDSA verification failureEkaterinburg Standard Time$: extra text: <not Stringer>Accept-CharsetActivateActCtxCallNextHookExCertCloseStoreClientToScreenCloseClipboardCoInitializeExCoUninitializeContent-LengthControlServiceCreateEventExWCreateMutexExWCreateProcessWCreateServiceWCryptGenRandomDefWindowProcWDkim-Sig$hourhttpicmpidleigmpint8itabkindlinkmcIDopenpathpipepop3profquitreadrootsbrksmtpsse2sse3tag:tcp4tcp6trueudp4uintunixvaryxn-- ... H_T= H_a= H_g= MB, W_a= and cnt= h_a= h_g= h_t= max= ptr siz= tab= top= u_a= u_g=%s %q%s*%d%s=%s"'&+0330+0430+0530+$minuteobjectpopcntremovesecondselectsendtoserversocketsocks socks5statusstringstructsweep sysmontelnettimersuint16uint32uint64unusedwindir %v=%v, (conn) (scan (scan) MB in Value> dying= flags= len=%d locks= m->g0= nmsys= s=nil zombie%v: %#x, goid=, j0 = --c$monthntohspanicparsepop3srangescav schedsleepslicesocksspinesse41sse42ssse3sudogsweeptext/tls: traceuint8usageutf-8write FROM Value addr= alloc base code= ctxt: curg= free goid jobs= list= m->p= next= p->m= prev= span= varp=% util(...), i = , not , val /p
API String ID: 0-3839525414
Opcode ID: 919cf9db5de3ffea2f38526c22a56b25183b58af13faa43e8d5087f3dd782f6b
Instruction ID: 00a3bad7f98294c98e3493698fa7cc892cc247a8652803d1b0942a4f0e5ecac5
Opcode Fuzzy Hash: 919cf9db5de3ffea2f38526c22a56b25183b58af13faa43e8d5087f3dd782f6b
Instruction Fuzzy Hash: 4963E17A608BC481DBB08B16F48479AB7A4F389B94F44812ADEDD53B59DF3CC4A5CB04

Uniqueness

Uniqueness Score: -1.00%

Function 0041CE40, Relevance: 10.5, Strings: 8, Instructions: 535COMMON

Download Yara Rule

Strings

gcinggscanhchanhttpsimap2imap3imapsint16int32int64mheapmonthntohspanicparsepop3srangescav schedsleepslicesocksspinesse41sse42ssse3sudogsweeptext/tls: traceuint8usageutf-8write FROM Value addr= alloc base code= ctxt: curg= free goid jobs= list= m->p= next= , xrefs: 0041CF35, 0041D9D2
ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=, elemsize=, npages = , settings:.WithCancel/Installed=/dev/stderr/dev/stdout/index.html/robots.txt30517578125: frame.sp=AppendMenuWBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256Bad Gat, xrefs: 0041D54D
ms cpu, not in [ runtime= s.limit= s.state= selected threads= u_a/u_g= unmarked wbuf1.n= wbuf2.n=%s %q: %s%s %x %x(unknown), newval=, oldval=, size = , tail = 244140625: status=AUOptionsAuthorityBassa_VahBhaiksukiC:\Users\ClassINETCreateDCWCreateICWCreatePe, xrefs: 0041D767
+,-./012456:;<=>?@BCLMNOPSZ["\, xrefs: 0041D51B, 0041D6E5
(forced) -> node= blocked= defersc= in use) lockedg= lockedm= m->curg= marked ms cpu, not in [ runtime= s.limit= s.state= selected threads= u_a/u_g= unmarked wbuf1.n= wbuf2.n=%s %q: %s%s %x %x(unknown), newval=, oldval=, size = , tail = 244140625: status, xrefs: 0041D970
gc done but gcphase != _GCoffgfput: bad status (not Gdead)http2: client conn not usablehttp: idle connection timeoutinteger not minimally-encodedinternal error: took too muchinvalid header field value %qinvalid length of trace eventio: read/write on closed pip, xrefs: 0041D9FC
%: */*+00+01+03+04+05+06+07+08+09+10+11+12+13+14,h1-01-02-03-04-05-06-08-09-11-12.js////TN0.00125200204206304400404443500625://::1:\/???ACKADTASTAddAprArcAugBSTCATCDTCETCSTDSADecDltEATEDTEETEOFESTFebFriGETGMTGetHDTHSTHanIDTISTJSTJanJulJunKSTLaoMD4MD5MDTMSKMS, xrefs: 0041D3DD
MB, W_a= and cnt= h_a= h_g= h_t= max= ptr siz= tab= top= u_a= u_g=%s %q%s*%d%s=%s"'&+0330+0430+0530+0545+0630+0845+1030+1245+1345, ..., fp:-0930.html.jpeg.json.wasm.webp/ping1562578125:***@:path<nil>AdlamAprilArcToBamumBatakBuhidCall ChordCount, xrefs: 0041D7FA

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID: (forced) -> node= blocked= defersc= in use) lockedg= lockedm= m->curg= marked ms cpu, not in [ runtime= s.limit= s.state= selected threads= u_a/u_g= unmarked wbuf1.n= wbuf2.n=%s %q: %s%s %x %x(unknown), newval=, oldval=, size = , tail = 244140625: status$ MB, W_a= and cnt= h_a= h_g= h_t= max= ptr siz= tab= top= u_a= u_g=%s %q%s*%d%s=%s"'&+0330+0430+0530+0545+0630+0845+1030+1245+1345, ..., fp:-0930.html.jpeg.json.wasm.webp/ping1562578125:***@:path<nil>AdlamAprilArcToBamumBatakBuhidCall ChordCount$ ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=, elemsize=, npages = , settings:.WithCancel/Installed=/dev/stderr/dev/stdout/index.html/robots.txt30517578125: frame.sp=AppendMenuWBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256Bad Gat$ ms cpu, not in [ runtime= s.limit= s.state= selected threads= u_a/u_g= unmarked wbuf1.n= wbuf2.n=%s %q: %s%s %x %x(unknown), newval=, oldval=, size = , tail = 244140625: status=AUOptionsAuthorityBassa_VahBhaiksukiC:\Users\ClassINETCreateDCWCreateICWCreatePe$%: */*+00+01+03+04+05+06+07+08+09+10+11+12+13+14,h1-01-02-03-04-05-06-08-09-11-12.js////TN0.00125200204206304400404443500625://::1:\/???ACKADTASTAddAprArcAugBSTCATCDTCETCSTDSADecDltEATEDTEETEOFESTFebFriGETGMTGetHDTHSTHanIDTISTJSTJanJulJunKSTLaoMD4MD5MDTMSKMS$+,-./012456:;<=>?@BCLMNOPSZ["\$gc done but gcphase != _GCoffgfput: bad status (not Gdead)http2: client conn not usablehttp: idle connection timeoutinteger not minimally-encodedinternal error: took too muchinvalid header field value %qinvalid length of trace eventio: read/write on closed pip$gcinggscanhchanhttpsimap2imap3imapsint16int32int64mheapmonthntohspanicparsepop3srangescav schedsleepslicesocksspinesse41sse42ssse3sudogsweeptext/tls: traceuint8usageutf-8write FROM Value addr= alloc base code= ctxt: curg= free goid jobs= list= m->p= next=
API String ID: 0-2660686310
Opcode ID: fa8df3af4deca3cb9f1c618606378e9b2283d0319c0a542f18d2ad7c98a1b1e2
Instruction ID: 8f9fcee62205c2c93bfeb2158f9a687091227c4e6413fe61f017a978a033f44c
Opcode Fuzzy Hash: fa8df3af4deca3cb9f1c618606378e9b2283d0319c0a542f18d2ad7c98a1b1e2
Instruction Fuzzy Hash: 91521936609B85C9DB50DF15F8803AAB7A4F789788F509126DACD43B6ADF3CC0A4CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00514E40, Relevance: 10.5, Strings: 8, Instructions: 511COMMON

Download Yara Rule

Strings

setsockoptsocks bindstackLargeterminatedticks.locktracefree(tracegc()unixpacketunknown pcuser-agentuser32.dllws2_32.dll of size (targetpc= ErrCode=%v KiB work, freeindex= gcwaiting= heap_live= idleprocs= in status mallocing= ms clock, nBSSRoots= p->stat, xrefs: 00515454
tR, xrefs: 00514FB5
tcp4, xrefs: 00515777
tcp6, xrefs: 00515786
w, xrefs: 005157B4
EM, xrefs: 005157C5
bindbmi1bmi2boolcallcas1cas2cas3cas4cas5cas6chancoindatedeaddialermsetagfilefromftpsfuncgziphosthourhttpicmpidleigmpint8itabkindlinkmcIDopenpathpipepop3profquitreadrootsbrksmtpsse2sse3tag:tcp4tcp6trueudp4uintunixvaryxn-- ... H_T= H_a= H_g= MB, W_a= and cnt=, xrefs: 00515542
connectexcopystackctxt != 0d.nx != 0debugLockdxva2.dllempty urlfork/execfuncargs(gdi32.dllhchanLeafimage/gifimage/pnginterfaceinterruptipv6-icmpmSpanDeadmSpanFreemulticastnil errorntdll.dllole32.dllpanicwaitpclmulqdqpreemptedprotocol psapi.dllraw-writerecover:, xrefs: 005150DB

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID: tR$bindbmi1bmi2boolcallcas1cas2cas3cas4cas5cas6chancoindatedeaddialermsetagfilefromftpsfuncgziphosthourhttpicmpidleigmpint8itabkindlinkmcIDopenpathpipepop3profquitreadrootsbrksmtpsse2sse3tag:tcp4tcp6trueudp4uintunixvaryxn-- ... H_T= H_a= H_g= MB, W_a= and cnt=$connectexcopystackctxt != 0d.nx != 0debugLockdxva2.dllempty urlfork/execfuncargs(gdi32.dllhchanLeafimage/gifimage/pnginterfaceinterruptipv6-icmpmSpanDeadmSpanFreemulticastnil errorntdll.dllole32.dllpanicwaitpclmulqdqpreemptedprotocol psapi.dllraw-writerecover:$setsockoptsocks bindstackLargeterminatedticks.locktracefree(tracegc()unixpacketunknown pcuser-agentuser32.dllws2_32.dll of size (targetpc= ErrCode=%v KiB work, freeindex= gcwaiting= heap_live= idleprocs= in status mallocing= ms clock, nBSSRoots= p->stat$tcp4$tcp6$w$EM
API String ID: 0-1469767619
Opcode ID: ba44312f73ec51c1abc5c28ec7d09ca9a4b266f5d09807d02ab6c1fba9ee8023
Instruction ID: 27c511750066baeaf72d7685257a6857916cdbb755daa34071ee1edbe3759f1e
Opcode Fuzzy Hash: ba44312f73ec51c1abc5c28ec7d09ca9a4b266f5d09807d02ab6c1fba9ee8023
Instruction Fuzzy Hash: 3642F636609F80C5EA60CB15F4803AABBA4F7D9784F548526EADD43B69EF7CC194CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0049E640, Relevance: 8.1, Strings: 6, Instructions: 573COMMON

Download Yara Rule

Strings

methodargs(msimg32.dllmswsock.dllnetpollInitnil contextprocexp.exeraw-controlreflect.SetreflectOffsretry-afterruntime: P runtime: p scheddetailsechost.dllsecur32.dllshell32.dllshort writetls: alert(tracealloc(traffic updunreachableuserenv.dllversion.dll (sensi, xrefs: 0049EA72
)*+,-./012456:;<=>?@BCLMNOPSZ["\, xrefs: 0049EAC0, 0049EDEB
funcargs(gdi32.dllhchanLeafimage/gifimage/pnginterfaceinterruptipv6-icmpmSpanDeadmSpanFreemulticastnil errorntdll.dllole32.dllpanicwaitpclmulqdqpreemptedprotocol psapi.dllraw-writerecover: reflect: rwxrwxrwxscavtracestackpoolsucceededunderflowwbufSpanswebsocke, xrefs: 0049EDCC
reflect: funcLayout of non-func type runtime: allocation size out of rangesetprofilebucket: profile already setstartTheWorld: inconsistent mp->nextpsubtle: slices have different lengthstls: unsupported certificate key (%T)too many Additionals to pack (>65535)t, xrefs: 0049F1C1
%, xrefs: 0049F1CD
reflect: funcLayout with interface receiver runtime: lfstack.push invalid packing: node=tls: server sent an incorrect legacy versiontls: server's Finished message was incorrectuse of WriteTo with pre-connected connectionx509: internal error: cannot parse domai, xrefs: 0049F150

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID: %$)*+,-./012456:;<=>?@BCLMNOPSZ["\$funcargs(gdi32.dllhchanLeafimage/gifimage/pnginterfaceinterruptipv6-icmpmSpanDeadmSpanFreemulticastnil errorntdll.dllole32.dllpanicwaitpclmulqdqpreemptedprotocol psapi.dllraw-writerecover: reflect: rwxrwxrwxscavtracestackpoolsucceededunderflowwbufSpanswebsocke$methodargs(msimg32.dllmswsock.dllnetpollInitnil contextprocexp.exeraw-controlreflect.SetreflectOffsretry-afterruntime: P runtime: p scheddetailsechost.dllsecur32.dllshell32.dllshort writetls: alert(tracealloc(traffic updunreachableuserenv.dllversion.dll (sensi$reflect: funcLayout of non-func type runtime: allocation size out of rangesetprofilebucket: profile already setstartTheWorld: inconsistent mp->nextpsubtle: slices have different lengthstls: unsupported certificate key (%T)too many Additionals to pack (>65535)t$reflect: funcLayout with interface receiver runtime: lfstack.push invalid packing: node=tls: server sent an incorrect legacy versiontls: server's Finished message was incorrectuse of WriteTo with pre-connected connectionx509: internal error: cannot parse domai
API String ID: 0-2112030893
Opcode ID: 012cfa45cb04bbf02ed6b97cde0a69757412ee1eb509e257d3631e170a47bef2
Instruction ID: 58bf463e5957893574d0832d946c1ac4860908055e73aef046dc91e712e4103b
Opcode Fuzzy Hash: 012cfa45cb04bbf02ed6b97cde0a69757412ee1eb509e257d3631e170a47bef2
Instruction Fuzzy Hash: 6152F276608BC185DB60CF16F4803AAB7A5F788B84F548526EACD57B29DF3DC1A4CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00417120, Relevance: 5.7, Strings: 4, Instructions: 662COMMON

Download Yara Rule

Strings

-, xrefs: 00417C1A
runtime: invalid type runtime: netpoll failedruntime: s.allocCount= s.allocCount > s.nelemsschedule: holding lockssegment length too longshrinkstack at bad timespan has no free stacksstack growth after forksyntax error in patternsystem huge page size (text/cs, xrefs: 00417BCD
heapBitsSetType: called with non-pointer typehttp: no Client.Transport or DefaultTransporthttp: putIdleConn: connection is in bad stateinvalid request :path %q from URL.Opaque = %qnet/http: internal error: connCount underflowparsing/packing of this section has, xrefs: 00417C0F
heapBitsSetType: unexpected shifthttp2: invalid pseudo headers: %vhttp2: recursive push not allowedhttp: CloseIdleConnections calledhttp: invalid Read on closed Bodyindefinite length found (not DER)invalid username/password versionleafCounts[maxBits][maxBits] , xrefs: 00417B87

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID: -$heapBitsSetType: called with non-pointer typehttp: no Client.Transport or DefaultTransporthttp: putIdleConn: connection is in bad stateinvalid request :path %q from URL.Opaque = %qnet/http: internal error: connCount underflowparsing/packing of this section has$heapBitsSetType: unexpected shifthttp2: invalid pseudo headers: %vhttp2: recursive push not allowedhttp: CloseIdleConnections calledhttp: invalid Read on closed Bodyindefinite length found (not DER)invalid username/password versionleafCounts[maxBits][maxBits] $runtime: invalid type runtime: netpoll failedruntime: s.allocCount= s.allocCount > s.nelemsschedule: holding lockssegment length too longshrinkstack at bad timespan has no free stacksstack growth after forksyntax error in patternsystem huge page size (text/cs
API String ID: 0-4126286399
Opcode ID: 179c3db54f5f5cf756f061c9d150f6141f5bcb1bc5d29a0724fa8fa762093f64
Instruction ID: a7295c86e148af5ebf50f14d0eca51bea69b40ff4f8035708e4068574cc23f77
Opcode Fuzzy Hash: 179c3db54f5f5cf756f061c9d150f6141f5bcb1bc5d29a0724fa8fa762093f64
Instruction Fuzzy Hash: FB42987260CBD482DB20CB16E4407EABB66F389BD4F449126EE9E17B58DB7CC585CB04

Uniqueness

Uniqueness Score: -1.00%

Function 004ECDE0, Relevance: 5.6, Strings: 4, Instructions: 624COMMON

Download Yara Rule

Strings

tep, xrefs: 004ED910
tep, xrefs: 004ED930
tep, xrefs: 004ED8F0
tep, xrefs: 004ED8D4

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID: tep$tep$tep$tep
API String ID: 0-2333023350
Opcode ID: dd47b7ed9352cfa5b984992ebe819e41224ae81f94a3fb5c5fcc5905777c0911
Instruction ID: c65cc7f002dc397340729b09d4833917b651a80de2bc5417373774d8fc291d53
Opcode Fuzzy Hash: dd47b7ed9352cfa5b984992ebe819e41224ae81f94a3fb5c5fcc5905777c0911
Instruction Fuzzy Hash: CC527436A08BC4C5C760CB12E9403AEB766F38A785F858116EACE13B59DF7CC595CB09

Uniqueness

Uniqueness Score: -1.00%

Function 00500D60, Relevance: 5.4, Strings: 4, Instructions: 412COMMON

Download Yara Rule

Strings

, xrefs: 00501312
%%!%c(big.Int=%s), s.searchAddr = -- Log started : 0123456789ABCDEFX0123456789abcdefx060102150405Z07001192092895507812559604644775390625: missing method ; SameSite=StrictAdjustTokenGroupsCOMPRESSION_ERRORCanSet() is falseCertFindExtensionChoosePixelFormatCk & , xrefs: 005014BE
<nil>AdlamAprilArcToBamumBatakBuhidCall ChordCountDograECDSAErrorFoundGetDCGreekHTTP/KhmerLatinLimbuLocalLstatMarchNushuOghamOriyaOsageP-224P-256P-384P-521RangeRealmRunicSHA-1STermStartTakriTamilTypeA\Temp] = (allowargp=arraybad nchdirchmodclosedeferfalsefault, xrefs: 005013FD
%&'()*+,-./012456:;<=>?@BCLMNOPSZ["\, xrefs: 00500FFB, 00501130, 00501329

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID: $ %&'()*+,-./012456:;<=>?@BCLMNOPSZ["\$%%!%c(big.Int=%s), s.searchAddr = -- Log started : 0123456789ABCDEFX0123456789abcdefx060102150405Z07001192092895507812559604644775390625: missing method ; SameSite=StrictAdjustTokenGroupsCOMPRESSION_ERRORCanSet() is falseCertFindExtensionChoosePixelFormatCk & $<nil>AdlamAprilArcToBamumBatakBuhidCall ChordCountDograECDSAErrorFoundGetDCGreekHTTP/KhmerLatinLimbuLocalLstatMarchNushuOghamOriyaOsageP-224P-256P-384P-521RangeRealmRunicSHA-1STermStartTakriTamilTypeA\Temp] = (allowargp=arraybad nchdirchmodclosedeferfalsefault
API String ID: 0-1648593664
Opcode ID: 29221bdeb98d187857af06fe09cbd243fde030364925f1a9f41fcaa9662bc037
Instruction ID: 6841d679ae2107577dad816d84bbb4471f3450619e17e9e5a19c7d11aaf563d9
Opcode Fuzzy Hash: 29221bdeb98d187857af06fe09cbd243fde030364925f1a9f41fcaa9662bc037
Instruction Fuzzy Hash: 1B22F476608F8581DB64CB15F4803AEBBA5F388784F548926DACD83BA9DF7CC494CB41

Uniqueness

Uniqueness Score: -1.00%

Function 004FADE0, Relevance: 5.3, Strings: 4, Instructions: 347COMMON

Download Yara Rule

Strings

PATHEXTPolygonRadicalReaddirRefererSELECT SHA-224SHA-256SHA-384SHA-512SetMenuSetRectSharadaShavianSiddhamSinhalaSleepExSogdianSoyomboSubjectSwapperTagalogTibetanTirhutaToAsciiTrailerTuesdayTypeALLTypeOPTTypePTRTypeSOATypeSRVTypeTXTTypeWKSUNKNOWNUnknownUpgradeW, xrefs: 004FAE21
pathpipepop3profquitreadrootsbrksmtpsse2sse3tag:tcp4tcp6trueudp4uintunixvaryxn-- ... H_T= H_a= H_g= MB, W_a= and cnt= h_a= h_g= h_t= max= ptr siz= tab= top= u_a= u_g=%s %q%s*%d%s=%s"'&+0330+0430+0530+0545+0630+0845+1030+1245+1345, ..., fp:-0930, xrefs: 004FAFE9
./012456:;<=>?@BCLMNOPSZ["\, xrefs: 004FAF3C, 004FB44C
:\/???ACKADTASTAddAprArcAugBSTCATCDTCETCSTDSADecDltEATEDTEETEOFESTFebFriGETGMTGetHDTHSTHanIDTISTJSTJanJulJunKSTLaoMD4MD5MDTMSKMSTMarMayMonMroNDTNSTNULNaNNkoNovOctPC=PDTPKTPSTPieRSASETSatSepStdSunThuTueURIUTCVaiViaWATWed\\?]:addadxaesageavxdirendfinf, xrefs: 004FAF03

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID: ./012456:;<=>?@BCLMNOPSZ["\$:\/???ACKADTASTAddAprArcAugBSTCATCDTCETCSTDSADecDltEATEDTEETEOFESTFebFriGETGMTGetHDTHSTHanIDTISTJSTJanJulJunKSTLaoMD4MD5MDTMSKMSTMarMayMonMroNDTNSTNULNaNNkoNovOctPC=PDTPKTPSTPieRSASETSatSepStdSunThuTueURIUTCVaiViaWATWed\\?]:addadxaesageavxdirendfinf$PATHEXTPolygonRadicalReaddirRefererSELECT SHA-224SHA-256SHA-384SHA-512SetMenuSetRectSharadaShavianSiddhamSinhalaSleepExSogdianSoyomboSubjectSwapperTagalogTibetanTirhutaToAsciiTrailerTuesdayTypeALLTypeOPTTypePTRTypeSOATypeSRVTypeTXTTypeWKSUNKNOWNUnknownUpgradeW$pathpipepop3profquitreadrootsbrksmtpsse2sse3tag:tcp4tcp6trueudp4uintunixvaryxn-- ... H_T= H_a= H_g= MB, W_a= and cnt= h_a= h_g= h_t= max= ptr siz= tab= top= u_a= u_g=%s %q%s*%d%s=%s"'&+0330+0430+0530+0545+0630+0845+1030+1245+1345, ..., fp:-0930
API String ID: 0-2587307904
Opcode ID: 90b9243adc5095acd6383ea29746edbca03b6c38e68d95a8994317191b1aac4b
Instruction ID: 42af680962da6647b9e72a7f86cdac572e9ae5ec56be4b0ce77ae0ece87454c4
Opcode Fuzzy Hash: 90b9243adc5095acd6383ea29746edbca03b6c38e68d95a8994317191b1aac4b
Instruction Fuzzy Hash: A012BF36609BC585D660CB12F4803AAB3A5F799794F54862AEBCC43B29DF7CC1A4CB44

Uniqueness

Uniqueness Score: -1.00%

Function 0043E080, Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

forEachP: P did not run fnfreedefer with d.fn != nilhttp2: Framer %p: wrote %vid (%v) <= evictCount (%v)initSpan: unaligned lengthinvalid port %q after hostinvalid request descriptormalformed HTTP status codemalformed chunked encodingname not unique on network, xrefs: 0043E3E5
forEachP: not donegarbage collectionhttp: no such fileidentifier removedindex out of rangeinput/output errorinvalid character multihop attemptedno child processesno locks availablenon-minimal lengthoperation canceledproxy-authenticatereflect.Value.Elemreflect., xrefs: 0043E3FE
forEachP: sched.safePointWait != 0http2: aborting request body writehttp: connection has been hijackedhttp: persistConn.readLoop exitinghttp: read on closed response bodyinvalid padding bits in BIT STRINGmspan.ensureSwept: m is not lockedout of memory allocati, xrefs: 0043E417
", xrefs: 0043E422

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID: "$forEachP: P did not run fnfreedefer with d.fn != nilhttp2: Framer %p: wrote %vid (%v) <= evictCount (%v)initSpan: unaligned lengthinvalid port %q after hostinvalid request descriptormalformed HTTP status codemalformed chunked encodingname not unique on network$forEachP: not donegarbage collectionhttp: no such fileidentifier removedindex out of rangeinput/output errorinvalid character multihop attemptedno child processesno locks availablenon-minimal lengthoperation canceledproxy-authenticatereflect.Value.Elemreflect.$forEachP: sched.safePointWait != 0http2: aborting request body writehttp: connection has been hijackedhttp: persistConn.readLoop exitinghttp: read on closed response bodyinvalid padding bits in BIT STRINGmspan.ensureSwept: m is not lockedout of memory allocati
API String ID: 0-3165089773
Opcode ID: 82e0d613c8423c39a261c454dff78b4c0906b6e3f964256648cec9ba105f5955
Instruction ID: e65611c1a86124cf1e4cc5496913b91f93852a64197d31802b30eee869d3989c
Opcode Fuzzy Hash: 82e0d613c8423c39a261c454dff78b4c0906b6e3f964256648cec9ba105f5955
Instruction Fuzzy Hash: 47A1783660AB44C9DB109F56F48436AB7B4F389B98F14A227DA8D437A4DF7CC086CB05

Uniqueness

Uniqueness Score: -1.00%

Function 0041B040, Relevance: 5.1, Strings: 4, Instructions: 145COMMON

Download Yara Rule

Strings

MB) workers= called from flushedWork heap_marked= idlethreads= in host name is nil, not nStackRoots= out of range s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (130.0.232.1453814697265625Accept-Ranges, xrefs: 0041B285
+,-./012456:;<=>?@BCLMNOPSZ["\, xrefs: 0041B2AC
pacer: assist ratio=pad length too largepreempt off reason: reflect.Value.SetIntreflect.makeFuncStubruntime: double waitruntime: unknown pc secured.mx-share.comsemaRoot rotateRighttime: invalid numbertrace: out of memoryunexpected network: unknown PSK identity, xrefs: 0041B1D3
(scan (scan) MB in Value> dying= flags= len=%d locks= m->g0= nmsys= s=nil zombie%v: %#x, goid=, j0 = --chsak/Change19531252.5.4.32.5.4.52.5.4.62.5.4.72.5.4.82.5.4.99765625:method:scheme:statusApp runAvestanBengaliBrailleCONNECTChanDirCopySidCreatedCypriotD, xrefs: 0041B1FC

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID: (scan (scan) MB in Value> dying= flags= len=%d locks= m->g0= nmsys= s=nil zombie%v: %#x, goid=, j0 = --chsak/Change19531252.5.4.32.5.4.52.5.4.62.5.4.72.5.4.82.5.4.99765625:method:scheme:statusApp runAvestanBengaliBrailleCONNECTChanDirCopySidCreatedCypriotD$ MB) workers= called from flushedWork heap_marked= idlethreads= in host name is nil, not nStackRoots= out of range s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (130.0.232.1453814697265625Accept-Ranges$+,-./012456:;<=>?@BCLMNOPSZ["\$pacer: assist ratio=pad length too largepreempt off reason: reflect.Value.SetIntreflect.makeFuncStubruntime: double waitruntime: unknown pc secured.mx-share.comsemaRoot rotateRighttime: invalid numbertrace: out of memoryunexpected network: unknown PSK identity
API String ID: 0-3467930582
Opcode ID: 849aa93dfd93d6a7e34eec4a0e23616bcab60b7e56a21cdf6facbaeff9f76b6c
Instruction ID: b296e41b686c0d4cdd5a2e6cc762249ddfd8e47d8f65ba720e89cf30eec7ee14
Opcode Fuzzy Hash: 849aa93dfd93d6a7e34eec4a0e23616bcab60b7e56a21cdf6facbaeff9f76b6c
Instruction Fuzzy Hash: DC715E32919F448AD701EF26F88035AB765FB9A784F419316EACE16726DF3CC0A1CB01

Uniqueness

Uniqueness Score: -1.00%

Function 005125E0, Relevance: 4.3, Strings: 3, Instructions: 518COMMON

Download Yara Rule

Strings

dialermsetagfilefromftpsfuncgziphosthourhttpicmpidleigmpint8itabkindlinkmcIDopenpathpipepop3profquitreadrootsbrksmtpsse2sse3tag:tcp4tcp6trueudp4uintunixvaryxn-- ... H_T= H_a= H_g= MB, W_a= and cnt= h_a= h_g= h_t= max= ptr siz= tab= top= u_a= u_g=%s %q%s*%d, xrefs: 005127C4, 0051286B
$Lo, xrefs: 00513070
p, xrefs: 00512C69

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID: p$$Lo$dialermsetagfilefromftpsfuncgziphosthourhttpicmpidleigmpint8itabkindlinkmcIDopenpathpipepop3profquitreadrootsbrksmtpsse2sse3tag:tcp4tcp6trueudp4uintunixvaryxn-- ... H_T= H_a= H_g= MB, W_a= and cnt= h_a= h_g= h_t= max= ptr siz= tab= top= u_a= u_g=%s %q%s*%d
API String ID: 0-3730735478
Opcode ID: 7714dc06db4423edbbc6240d736268ece6fb865c956ee2ee86d17b8db4d00d1b
Instruction ID: c6b1268a1133e2364144a68420daef7f402918eb7129b69caf75162ddb162327
Opcode Fuzzy Hash: 7714dc06db4423edbbc6240d736268ece6fb865c956ee2ee86d17b8db4d00d1b
Instruction Fuzzy Hash: 9D42D336608BC4C5DB60CB16F4803AAB7A4F799B94F149526EACD43B69DF3CC1A1CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00428A20, Relevance: 4.2, Strings: 3, Instructions: 447COMMON

Download Yara Rule

Strings

grew heap, but no adequate free space foundheapBitsSetTypeGCProg: unexpected bit counthttp2: too many 1xx informational responseshttp2: unexpected ALPN protocol %q; want %qinterrupted system call should be restartedmultiple Read calls return no data or errorne, xrefs: 00429285
+, xrefs: 00429290
mheap.allocSpan called with no Pmime: expected token after slashnumerical argument out of domainpanic while printing panic valueread limit of %d bytes exhaustedreflect.nameFrom: tag too long: reflect: NumIn of non-func type reflect: NumOut of non-func typeremo, xrefs: 0042926B

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID: +$grew heap, but no adequate free space foundheapBitsSetTypeGCProg: unexpected bit counthttp2: too many 1xx informational responseshttp2: unexpected ALPN protocol %q; want %qinterrupted system call should be restartedmultiple Read calls return no data or errorne$mheap.allocSpan called with no Pmime: expected token after slashnumerical argument out of domainpanic while printing panic valueread limit of %d bytes exhaustedreflect.nameFrom: tag too long: reflect: NumIn of non-func type reflect: NumOut of non-func typeremo
API String ID: 0-1584643344
Opcode ID: 2002bc4bf0355b917ce5f50bf25a8ed0c0ce135af12adc36f35fb615616fe1fa
Instruction ID: b2bf7e8272bb60b8ed324820e0ad808a8ccd124dd83e446537c73d930490b7fe
Opcode Fuzzy Hash: 2002bc4bf0355b917ce5f50bf25a8ed0c0ce135af12adc36f35fb615616fe1fa
Instruction Fuzzy Hash: 0C224772209B9485DB208F16F08036EB7A5F789B94F94911AEBCD47B69DF3CC4A4CB44

Uniqueness

Uniqueness Score: -1.00%

Function 004D0020, Relevance: 4.0, Strings: 3, Instructions: 218COMMON

Download Yara Rule

Strings

DltEATEDTEETEOFESTFebFriGETGMTGetHDTHSTHanIDTISTJSTJanJulJunKSTLaoMD4MD5MDTMSKMSTMarMayMonMroNDTNSTNULNaNNkoNovOctPC=PDTPKTPSTPieRSASETSatSepStdSunThuTueURIUTCVaiViaWATWed\\?]:addadxaesageavxdirendfinfmaftpgc gp intip4ip6keymapnewnilobjpc=ptrsetssht, xrefs: 004D02FC
MUI_StdMakasarMandaicMarchenMaskBltMultaniMyanmarOctoberOsmanyaPATHEXTPolygonRadicalReaddirRefererSELECT SHA-224SHA-256SHA-384SHA-512SetMenuSetRectSharadaShavianSiddhamSinhalaSleepExSogdianSoyomboSubjectSwapperTagalogTibetanTirhutaToAsciiTrailerTuesdayTypeALLT, xrefs: 004D03C5
MUI_DltMUI_StdMakasarMandaicMarchenMaskBltMultaniMyanmarOctoberOsmanyaPATHEXTPolygonRadicalReaddirRefererSELECT SHA-224SHA-256SHA-384SHA-512SetMenuSetRectSharadaShavianSiddhamSinhalaSleepExSogdianSoyomboSubjectSwapperTagalogTibetanTirhutaToAsciiTrailerTuesdayT, xrefs: 004D0418

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID: DltEATEDTEETEOFESTFebFriGETGMTGetHDTHSTHanIDTISTJSTJanJulJunKSTLaoMD4MD5MDTMSKMSTMarMayMonMroNDTNSTNULNaNNkoNovOctPC=PDTPKTPSTPieRSASETSatSepStdSunThuTueURIUTCVaiViaWATWed\\?]:addadxaesageavxdirendfinfmaftpgc gp intip4ip6keymapnewnilobjpc=ptrsetssht$MUI_DltMUI_StdMakasarMandaicMarchenMaskBltMultaniMyanmarOctoberOsmanyaPATHEXTPolygonRadicalReaddirRefererSELECT SHA-224SHA-256SHA-384SHA-512SetMenuSetRectSharadaShavianSiddhamSinhalaSleepExSogdianSoyomboSubjectSwapperTagalogTibetanTirhutaToAsciiTrailerTuesdayT$MUI_StdMakasarMandaicMarchenMaskBltMultaniMyanmarOctoberOsmanyaPATHEXTPolygonRadicalReaddirRefererSELECT SHA-224SHA-256SHA-384SHA-512SetMenuSetRectSharadaShavianSiddhamSinhalaSleepExSogdianSoyomboSubjectSwapperTagalogTibetanTirhutaToAsciiTrailerTuesdayTypeALLT
API String ID: 0-2593938031
Opcode ID: ca723d6c65fe6937cdd9383e529cb05808d19d12a78662ff90c5b3a99f7db9e6
Instruction ID: 682608b09aa90c25535c5930847ae628ef1b8584448e60ee87598f4351df276c
Opcode Fuzzy Hash: ca723d6c65fe6937cdd9383e529cb05808d19d12a78662ff90c5b3a99f7db9e6
Instruction Fuzzy Hash: 87B1EF36609BC0C5DB60CB56F4903ABB7A4F799784F14856AEACC43B69DF7DC0948B40

Uniqueness

Uniqueness Score: -1.00%

Function 0049D140, Relevance: 3.1, Strings: 2, Instructions: 602COMMON

Download Yara Rule

Strings

v, xrefs: 0049DA7E
6_p, xrefs: 0049DCFB

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID: 6_p$v
API String ID: 0-1733490736
Opcode ID: 69ddb3281b42cca67a23256d8d4159e5a31010b70ed562a1aee7a6feaf13e2af
Instruction ID: e4a0b30078f55e9f5e1fb84d1fa5dc0085c51c88fa55a72b63e88235ca528e72
Opcode Fuzzy Hash: 69ddb3281b42cca67a23256d8d4159e5a31010b70ed562a1aee7a6feaf13e2af
Instruction Fuzzy Hash: 5C620036608B84C9DB20CF15F4803AABBA5F389784F948526EACD43B69DF7DC195CB44

Uniqueness

Uniqueness Score: -1.00%

Function 004DE0E0, Relevance: 2.9, Strings: 2, Instructions: 442COMMON

Download Yara Rule

Strings

\, xrefs: 004DE7FB
RemoveAllSamaritanSee OtherSendInputSeptemberSetBkModeSetCursorStartDocWStartPageSundaneseToo EarlyTrailer: TypeCNAMETypeHINFOTypeMINFOUnionRectUse ProxyWSASendToWednesdayWriteFile[%v = %d]atomicor8bad indirbad prunebroadcastbus errorchan sendcomplex64connecte, xrefs: 004DE163

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID: RemoveAllSamaritanSee OtherSendInputSeptemberSetBkModeSetCursorStartDocWStartPageSundaneseToo EarlyTrailer: TypeCNAMETypeHINFOTypeMINFOUnionRectUse ProxyWSASendToWednesdayWriteFile[%v = %d]atomicor8bad indirbad prunebroadcastbus errorchan sendcomplex64connecte$\
API String ID: 0-230351362
Opcode ID: 39d6a27548ba005a396aa6fdde10c24f4354a8f95a89f38c9717a513187ee482
Instruction ID: f81579aa38dbcb9f4de29d4c1ca20e5a9d1ba7c682dc0ad6ba63307cb81237ea
Opcode Fuzzy Hash: 39d6a27548ba005a396aa6fdde10c24f4354a8f95a89f38c9717a513187ee482
Instruction Fuzzy Hash: DF22FE36609BC585DA60DB02F4903AAB7A4F799B84F588527EACC47B69DF7CC090CB44

Uniqueness

Uniqueness Score: -1.00%

Function 004DEF20, Relevance: 2.9, Strings: 2, Instructions: 424COMMON

Download Yara Rule

Strings

CreateFileCreateIconCreateMenuCreatePipeDSA-SHA256DeleteMenuDeprecatedDevanagariDnsQuery_WDragFinishDrawIconExECDSA-SHA1END_STREAMException GC forcedGOMAXPROCSGetDlgItemGetIfEntryGetObjectWGetSubMenuGetVersionGlagoliticGlobalFreeGlobalLockHTTP_PROXYHost: %s, xrefs: 004DF1F3
FindFirstFileFindNextFileWFindResourceWFreeAddrInfoWGC sweep waitGetClassNameWGetClientRectGetDeviceCapsGetDriveTypeWGetMenuItemIDGetSystemMenuGetSystemTimeGetWindowRectGunjala_GondiIIDFromStringIf-None-MatchImageList_AddIntersectRectLast-ModifiedLoop Detected, xrefs: 004DF3B3

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID: CreateFileCreateIconCreateMenuCreatePipeDSA-SHA256DeleteMenuDeprecatedDevanagariDnsQuery_WDragFinishDrawIconExECDSA-SHA1END_STREAMException GC forcedGOMAXPROCSGetDlgItemGetIfEntryGetObjectWGetSubMenuGetVersionGlagoliticGlobalFreeGlobalLockHTTP_PROXYHost: %s$FindFirstFileFindNextFileWFindResourceWFreeAddrInfoWGC sweep waitGetClassNameWGetClientRectGetDeviceCapsGetDriveTypeWGetMenuItemIDGetSystemMenuGetSystemTimeGetWindowRectGunjala_GondiIIDFromStringIf-None-MatchImageList_AddIntersectRectLast-ModifiedLoop Detected
API String ID: 0-3646958983
Opcode ID: bdb70e572bdc062002b9cd6545581480a2cf4461b82e1d098ada12c1dbdfc679
Instruction ID: d956f56ff697bae7d4e94d83c40781bac12d09d0c95d385a4b59bf6248823ade
Opcode Fuzzy Hash: bdb70e572bdc062002b9cd6545581480a2cf4461b82e1d098ada12c1dbdfc679
Instruction Fuzzy Hash: EC22E836609B84C6CA75DB11F4903AAB7A8F7C8B44F544526EACD43B29DF7CD2A4CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00406680, Relevance: 2.9, Strings: 2, Instructions: 380COMMON

Download Yara Rule

Strings

unreachableuserenv.dllversion.dll (sensitive) KiB total, [recovered] allocCount found at *( gcscandone m->gsignal= minTrigger= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil, xrefs: 00406D85
G waiting list is corruptedGdipCreateBitmapFromHBITMAPGdipCreateHBITMAPFromBitmapGetSecurityDescriptorLengthGetUserPreferredUILanguagesLookupIconIdFromDirectoryExRegisterServiceCtrlHandlerWStartServiceCtrlDispatcherW\System32\SearchIndexer.exeaccess-control-al, xrefs: 00406D4B

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID: G waiting list is corruptedGdipCreateBitmapFromHBITMAPGdipCreateHBITMAPFromBitmapGetSecurityDescriptorLengthGetUserPreferredUILanguagesLookupIconIdFromDirectoryExRegisterServiceCtrlHandlerWStartServiceCtrlDispatcherW\System32\SearchIndexer.exeaccess-control-al$unreachableuserenv.dllversion.dll (sensitive) KiB total, [recovered] allocCount found at *( gcscandone m->gsignal= minTrigger= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil
API String ID: 0-476150916
Opcode ID: c050ea1040b5d187d5f16f802701a4006c4701cb634fa4911e03968e34def4d8
Instruction ID: 0bcbe8fa139fb5f95e2c8ebd8fb3741747dc6934064fbf0cf603e176f9be8caf
Opcode Fuzzy Hash: c050ea1040b5d187d5f16f802701a4006c4701cb634fa4911e03968e34def4d8
Instruction Fuzzy Hash: DC028D32208B80C5D7209F16F48439EBBA1F785B88F55902ADACD57B99DF7DC0A9CB05

Uniqueness

Uniqueness Score: -1.00%

Function 004646E0, Relevance: 2.8, Strings: 2, Instructions: 327COMMON

Download Yara Rule

Strings

r, xrefs: 004649E9
@#C, xrefs: 00464A8E, 00464B15, 00464BD7

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID: @#C$r
API String ID: 0-292122027
Opcode ID: 39a86d566a8af32a90edda4bd71d8b237d68c438df3afa6c443885fbc2de9eb8
Instruction ID: a6fc5663c5f3015ac43167787096205c1ee83887d6fcbec46c45ba0578dae9a7
Opcode Fuzzy Hash: 39a86d566a8af32a90edda4bd71d8b237d68c438df3afa6c443885fbc2de9eb8
Instruction Fuzzy Hash: E3F10736208B80C5DB609F55F0803AABBA4F7C5B94F55822BDA8D53B68DF3CC495CB06

Uniqueness

Uniqueness Score: -1.00%

Function 00416100, Relevance: 2.8, Strings: 2, Instructions: 296COMMON

Download Yara Rule

Strings

bulkBarrierPreWrite: unaligned argumentscannot free workbufs when work.full != 0cannot represent time as GeneralizedTimechacha20poly1305: invalid buffer overlapcrypto/cipher: message too large for GCMcrypto/cipher: output smaller than inputcrypto/rsa: input mu, xrefs: 004165C5
(, xrefs: 004165D0

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID: ($bulkBarrierPreWrite: unaligned argumentscannot free workbufs when work.full != 0cannot represent time as GeneralizedTimechacha20poly1305: invalid buffer overlapcrypto/cipher: message too large for GCMcrypto/cipher: output smaller than inputcrypto/rsa: input mu
API String ID: 0-293591660
Opcode ID: be20fb330afa77776346a5ebab8aecb1b0695373326c327de3a9ead68d0bf1aa
Instruction ID: bbfe1d2e18d8ef8ce3530e82381e659270cf659d568e2fb1d11f08c06108ff24
Opcode Fuzzy Hash: be20fb330afa77776346a5ebab8aecb1b0695373326c327de3a9ead68d0bf1aa
Instruction Fuzzy Hash: 45C16D76619B8486CB10DF15E0403DAB7A1F389BA4F65922BEBAD43798DF3CC481CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00405100, Relevance: 2.7, Strings: 2, Instructions: 222COMMON

Download Yara Rule

Strings

Go pointer stored into non-Go memoryIA5String contains invalid characterMStats vs MemStatsType size mismatchTime.UnmarshalBinary: invalid lengthUnable to determine system directoryaccessing a corrupted shared librarychacha20: wrong HChaCha20 nonce sizecompress, xrefs: 00405491
$, xrefs: 0040549C

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID: $$Go pointer stored into non-Go memoryIA5String contains invalid characterMStats vs MemStatsType size mismatchTime.UnmarshalBinary: invalid lengthUnable to determine system directoryaccessing a corrupted shared librarychacha20: wrong HChaCha20 nonce sizecompress
API String ID: 0-3725555576
Opcode ID: f3db3763be4b33f48b0b695d9483e848fa5187d87ad109b9c275488135cd9c2c
Instruction ID: c15cd3699e83c2f73581c002e6a9df10c5b09d856f8959bb5e711c9212ae5219
Opcode Fuzzy Hash: f3db3763be4b33f48b0b695d9483e848fa5187d87ad109b9c275488135cd9c2c
Instruction Fuzzy Hash: 98917C32618F8486D7109F65E04079AB7A4F399BA4F94422AEBAC53BD9DF3CC494CF05

Uniqueness

Uniqueness Score: -1.00%

Function 00423240, Relevance: 2.7, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

., xrefs: 00423555
released less than one physical page of memoryruntime: failed to create new OS thread (have runtime: name offset base pointer out of rangeruntime: panic before malloc heap initializedruntime: text offset base pointer out of rangeruntime: type offset base poin, xrefs: 0042354A

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID: .$released less than one physical page of memoryruntime: failed to create new OS thread (have runtime: name offset base pointer out of rangeruntime: panic before malloc heap initializedruntime: text offset base pointer out of rangeruntime: type offset base poin
API String ID: 0-223345315
Opcode ID: 5e093eca16b380460d321fe7cdbbd21032055bb8dd98d4c744e2d27c26c04c87
Instruction ID: 4382328243d7455162ff61b02853f8920e8c1be5a35e0ebaaed8db3a26db1bb5
Opcode Fuzzy Hash: 5e093eca16b380460d321fe7cdbbd21032055bb8dd98d4c744e2d27c26c04c87
Instruction Fuzzy Hash: 9E716922629F84D5D642DF21F48132AB375FB96380F909717EA8E22765EF3CD295CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00442720, Relevance: 2.6, Strings: 2, Instructions: 148COMMON

Download Yara Rule

Strings

internal lockOSThread errorinvalid HTTP header name %qinvalid dependent stream IDinvalid profile bucket typekey was rejected by servicemakechan: size out of rangemakeslice: cap out of rangemakeslice: len out of rangemspan.sweep: bad span statenet/http: invalid, xrefs: 004429EF
invalid m->lockedInt = left over markroot jobsmakechan: bad alignmentmalformed HTTP responsemalloc called with no Pmissing port in addressmissing protocol schememissing type in runfinqnanotime returning zeronet/http: abort Handlernetwork not implementedno appl, xrefs: 004429BE

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID: internal lockOSThread errorinvalid HTTP header name %qinvalid dependent stream IDinvalid profile bucket typekey was rejected by servicemakechan: size out of rangemakeslice: cap out of rangemakeslice: len out of rangemspan.sweep: bad span statenet/http: invalid$invalid m->lockedInt = left over markroot jobsmakechan: bad alignmentmalformed HTTP responsemalloc called with no Pmissing port in addressmissing protocol schememissing type in runfinqnanotime returning zeronet/http: abort Handlernetwork not implementedno appl
API String ID: 0-3338204782
Opcode ID: 9734c3a2be6acf51f70a0e5e3dc865d4908e253d9029829265b41d7b2dc33ffe
Instruction ID: 815f61414e8121d6bc47a5121d4e2611acaa3b27cfc564efd45e1940d29f87ee
Opcode Fuzzy Hash: 9734c3a2be6acf51f70a0e5e3dc865d4908e253d9029829265b41d7b2dc33ffe
Instruction Fuzzy Hash: CE716E32605B80C5E740AF21E4843AE77B0F789B88F89926AEA8D27755DF7CC495CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00494060, Relevance: 1.7, Strings: 1, Instructions: 408COMMON

Download Yara Rule

Strings

`, xrefs: 0049464E

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 95606da9dbf19eec57a7af7b40f676426c62c740b0d4d0963479cd556ef75f14
Instruction ID: c69566c63e648bafd0d1410aefe7d219c46f61fb8c6968e79f087d333a2e675c
Opcode Fuzzy Hash: 95606da9dbf19eec57a7af7b40f676426c62c740b0d4d0963479cd556ef75f14
Instruction Fuzzy Hash: 2F221136608BC485DA60CB51F4803AABBA5F7D9794F548226EADC53BA9DF7CC095CB00

Uniqueness

Uniqueness Score: -1.00%

Function 004CE5A0, Relevance: 1.6, Strings: 1, Instructions: 344COMMON

Download Yara Rule

Strings

,M3.2.0,M11.1.00601021504Z0700476837158203125: cannot parse <invalid Value>ASCII_Hex_DigitAccept-EncodingAccept-LanguageAddDllDirectoryCLSIDFromProgIDCLSIDFromStringCallWindowProcWClientAuthType(CreateHardLinkWCreatePopupMenuCreateWindowExWDefSubclassProcDevic, xrefs: 004CE76A

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID: ,M3.2.0,M11.1.00601021504Z0700476837158203125: cannot parse <invalid Value>ASCII_Hex_DigitAccept-EncodingAccept-LanguageAddDllDirectoryCLSIDFromProgIDCLSIDFromStringCallWindowProcWClientAuthType(CreateHardLinkWCreatePopupMenuCreateWindowExWDefSubclassProcDevic
API String ID: 0-1293734847
Opcode ID: 95d57cbc831344698a1547a7ce99f4ff2135db40b390a828ab2efe253a169bef
Instruction ID: c2d3760246a485eeb8b134f5b3846ad0c132f8a2a161df4cdab15b4f8318eabc
Opcode Fuzzy Hash: 95d57cbc831344698a1547a7ce99f4ff2135db40b390a828ab2efe253a169bef
Instruction Fuzzy Hash: 82023876A08BC481DB718B16F4813AAB7A1F7D9784F14912AEBCC03B59EF7CD1948B40

Uniqueness

Uniqueness Score: -1.00%

Function 0054AEE0, Relevance: 1.5, Strings: 1, Instructions: 279COMMON

Download Yara Rule

Strings

crypto/aes: invalid key size crypto/des: invalid key size crypto/rc4: invalid key size dup idle pconn %p in freelistexec: Wait was already calledexecuting on Go runtime stackgc done but gcphase != _GCoffgfput: bad status (not Gdead)http2: client conn not usabl, xrefs: 0054B2CD

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID: crypto/aes: invalid key size crypto/des: invalid key size crypto/rc4: invalid key size dup idle pconn %p in freelistexec: Wait was already calledexecuting on Go runtime stackgc done but gcphase != _GCoffgfput: bad status (not Gdead)http2: client conn not usabl
API String ID: 0-2713271537
Opcode ID: 7ed942f01d2ddbe2a74d2dcdee34c5a0fbea6a368f2df1208bfce96efd9b59fe
Instruction ID: b4a3ae8204565cff4bc8d1fad4e285512a6cb8243524ef4e8931429628483554
Opcode Fuzzy Hash: 7ed942f01d2ddbe2a74d2dcdee34c5a0fbea6a368f2df1208bfce96efd9b59fe
Instruction Fuzzy Hash: 29A15976318AA4C2EB14DF15E414BAEBF62F395BC8F849512EA9E07B45DF39C511CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00554300, Relevance: 1.4, Strings: 1, Instructions: 186COMMON

Download Yara Rule

Strings

, xrefs: 00554344

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 81c8664546aadf18ade52f95f14b2a779adddd68c1d8a33d8b13192cf94b8f93
Instruction ID: e4397d3189b56c5578b18e21f5b81262c6298f021dbfe5f63c54e89a4c620485
Opcode Fuzzy Hash: 81c8664546aadf18ade52f95f14b2a779adddd68c1d8a33d8b13192cf94b8f93
Instruction Fuzzy Hash: DE51D373B20A148BC70CCE5AC8A426D7B92F3C9B55B5EC729CF164779AC678D845CB80

Uniqueness

Uniqueness Score: -1.00%

Function 004500E0, Relevance: 1.4, Strings: 1, Instructions: 171COMMON

Download Yara Rule

Strings

string concatenation too longsyntax error scanning booleantimeBegin/EndPeriod not foundtls: DialWithDialer timed outtls: invalid NextProtos valuetls: invalid server key sharetls: too many ignored recordstls: use of closed connectiontoo many open files in syste, xrefs: 004503B9

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID: string concatenation too longsyntax error scanning booleantimeBegin/EndPeriod not foundtls: DialWithDialer timed outtls: invalid NextProtos valuetls: invalid server key sharetls: too many ignored recordstls: use of closed connectiontoo many open files in syste
API String ID: 0-1091143100
Opcode ID: 8ba1e451b64d37162dc41d25385759eb747891a60fd40f8bac11af5030044564
Instruction ID: d4833f3f3caa46462b649931565054c653213889da56137ad2fd6e7c5c049053
Opcode Fuzzy Hash: 8ba1e451b64d37162dc41d25385759eb747891a60fd40f8bac11af5030044564
Instruction Fuzzy Hash: 5D61683A609F8486DB608F52E58039AA761F789BC4F548017EECD57B1ACF7CC499CB05

Uniqueness

Uniqueness Score: -1.00%

Function 004109C0, Relevance: 1.4, Strings: 1, Instructions: 164COMMON

Download Yara Rule

Strings

e , xrefs: 00410A09

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID: e
API String ID: 0-3352636342
Opcode ID: c70df4eba19c116e1a5d4e362a8e32ddfa940c4fbce998734d09aa2b1c8c7b6f
Instruction ID: f76a896d196288201aa5d12adb984ba9c7ead43e385652ecfd436905e0edbd5b
Opcode Fuzzy Hash: c70df4eba19c116e1a5d4e362a8e32ddfa940c4fbce998734d09aa2b1c8c7b6f
Instruction Fuzzy Hash: 2671ABB3614B90C6D7249F16E4403997770F788B98F881126DB8917B16DB7CD8E6CB44

Uniqueness

Uniqueness Score: -1.00%

Function 0054CB80, Relevance: .9, Instructions: 893COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9418015ed09c56274df50ff77ce5009075635b254f31ef736e11112c2d405e17
Instruction ID: 2c84dbc8d7503053de6cac35e881aa9a3ffa74851952ca3b63c98167d2894860
Opcode Fuzzy Hash: 9418015ed09c56274df50ff77ce5009075635b254f31ef736e11112c2d405e17
Instruction Fuzzy Hash: 70921C62D18FCA55F21347389003EB56710BBA75F0F10EB2ABED5F1B23D7656A40AA31

Uniqueness

Uniqueness Score: -1.00%

Function 00508EE0, Relevance: .5, Instructions: 485COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0a2266e19da3ad4a92ae36231825a7e4c0a4880b23a5a15bd833c7cdded7196
Instruction ID: fa7b17d223f6240ecc9c7241214b5fe8055b7468946276cc83b10feacf9ee7b1
Opcode Fuzzy Hash: e0a2266e19da3ad4a92ae36231825a7e4c0a4880b23a5a15bd833c7cdded7196
Instruction Fuzzy Hash: FF427976209FC584CAB0CB42F4843AEB7A5F389B94F544526EBCD93B69DF78C1908B40

Uniqueness

Uniqueness Score: -1.00%

Function 0049A1B8, Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4ad617a327060ae331812cc78562c0b030992786edb6870da767f5a232b38a9
Instruction ID: 620a37f05dbb1b4f24a79512c70d4aa30b82922bb70baf557907546015b80a81
Opcode Fuzzy Hash: a4ad617a327060ae331812cc78562c0b030992786edb6870da767f5a232b38a9
Instruction Fuzzy Hash: 8132CF36208BC485CA60CF56F48039ABBA5F789B80F548526EBCD57B29DF7CC1A4CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00472320, Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a17dc627fec5613dcd4a1c1a2c837f0ea05886c51df0c499e1259b34ae983ec
Instruction ID: 8502274c849f3feeebc6b4e2a13415f5c1f2ea74cb455ff17fddfa52630ca69d
Opcode Fuzzy Hash: 0a17dc627fec5613dcd4a1c1a2c837f0ea05886c51df0c499e1259b34ae983ec
Instruction Fuzzy Hash: 3922E276609BC081CB648F16E1803AAB7A5F789B84F58D51AEBCD07B19DF7CC495CB04

Uniqueness

Uniqueness Score: -1.00%

Function 0044C2C0, Relevance: .4, Instructions: 395COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c083533a6f31999d04db230726980afff58f6fa983b68814dd6b950cab281f2
Instruction ID: 3a17ae6fb444966a3e76fd21d8225bd55185b0088ff068ef5937539fb89bdc55
Opcode Fuzzy Hash: 6c083533a6f31999d04db230726980afff58f6fa983b68814dd6b950cab281f2
Instruction Fuzzy Hash: 79F1C4B2306B8482EA40DB11E5803B9A762F785BD0F889137EB9E47798DF7CC155CB49

Uniqueness

Uniqueness Score: -1.00%

Function 00518EE0, Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29093a94f7bf476e287c91d33c8293991db766b8d8a11e501b2d00f65ee2fb53
Instruction ID: 9d7c1f8435cabbd6498887c7bc9b3fb3d74a29a3b82ad7bcf9e96e62ae79e72e
Opcode Fuzzy Hash: 29093a94f7bf476e287c91d33c8293991db766b8d8a11e501b2d00f65ee2fb53
Instruction Fuzzy Hash: 4EC1D532A08B8182EB049B25E0543AEAB62F7C5BC4F588616EB8D07B59DF7CD5D5CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0054A660, Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd779443f36d08ba03a191c0b8a2611c40af63b3058d1a83be43587d037cd6af
Instruction ID: 9acafd215b14c12fe8961c21a930e28caff7347ba7b1af1a0349796e52c18188
Opcode Fuzzy Hash: fd779443f36d08ba03a191c0b8a2611c40af63b3058d1a83be43587d037cd6af
Instruction Fuzzy Hash: ADA16A739045A08BD700CF16C48876FBB66F385B89F869506EF8B1B785DB38D914CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0054AAA0, Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4f8ab0e087bb41f2027ae506d40d4d45553594920e95c6138769a9a6542a279
Instruction ID: 0716234c03818211cb96d86d62d050eacff671e0e223db22908829d2f59445ca
Opcode Fuzzy Hash: c4f8ab0e087bb41f2027ae506d40d4d45553594920e95c6138769a9a6542a279
Instruction Fuzzy Hash: 41A135736045A08BD700CF16C45836FBB66F385B8AF869506EF8B1B741DB38D924DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0055C780, Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26d44d4866595268ae6a76173327cce3527029298b92284b063e9965ad1d4f83
Instruction ID: 593412d52b5be0b67316b4cccda83a04b89eaf3015b77929b907f87861026a0b
Opcode Fuzzy Hash: 26d44d4866595268ae6a76173327cce3527029298b92284b063e9965ad1d4f83
Instruction Fuzzy Hash: B2E11836B18BE481D3608F26B90174ABB64F398BE4F444616DEEC63B98CF39D449DB05

Uniqueness

Uniqueness Score: -1.00%

Function 00448E40, Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f77db903381a2d8f782eab49638fce40740f100481dcf12e28d0b5d807be3004
Instruction ID: e09f8834e60639ef44c5064062ed34ebb02e8d6d20d1d5f228279663328bcedf
Opcode Fuzzy Hash: f77db903381a2d8f782eab49638fce40740f100481dcf12e28d0b5d807be3004
Instruction Fuzzy Hash: 5EB1CD36259A8482EB20EF11E0103AEB326F309BC4F98511BDB8E57715EF7CD964D70A

Uniqueness

Uniqueness Score: -1.00%

Function 0054C720, Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b99a6f9565edd0f314e8e5538c7621c0a0264dbc87ff133fba9925a0b76dca3c
Instruction ID: 9e5b7d777bcc67563eb523f3a6af01f716591124511534d38b40e5da40e7ef6e
Opcode Fuzzy Hash: b99a6f9565edd0f314e8e5538c7621c0a0264dbc87ff133fba9925a0b76dca3c
Instruction Fuzzy Hash: E591A1E7E09FCA46E74753384043BB2A710AFBB6D4E10DB06BEE0B1653D764A311A220

Uniqueness

Uniqueness Score: -1.00%

Function 0042CE80, Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44a6230466f5c84d35e2ff357f17928aebd0e95f85c570628de32447b586be2c
Instruction ID: 1b74f26bca09aef343dbb5c784581636120df06bb661b871455af7171739038c
Opcode Fuzzy Hash: 44a6230466f5c84d35e2ff357f17928aebd0e95f85c570628de32447b586be2c
Instruction Fuzzy Hash: 33619D32B14B8482DB008F15F5803A9A762FB85BC4F885526EA9E43B99CF7CC091C749

Uniqueness

Uniqueness Score: -1.00%

Function 004F2D00, Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdefcfd1d754195e663ae0054488c213f06d1bee7dcc9668a73156e20771e586
Instruction ID: 0d8d79d06ed68bc4291018a94443f09bee092f6e9f60cee61b2a01ca14426efd
Opcode Fuzzy Hash: cdefcfd1d754195e663ae0054488c213f06d1bee7dcc9668a73156e20771e586
Instruction Fuzzy Hash: 50713976219B85C2C7588F12E1A013EBB74F789B80B18556BEBCA47B99CF7CC491DB04

Uniqueness

Uniqueness Score: -1.00%

Function 0051A6A0, Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c9bf2d3e4eaa40eef17412a2e84147d3926be84d84674aa4cfe1d38aae734be
Instruction ID: c04683c1cafbb40e66af046b8d9c232b162372491c691567e2d725bf170ff62c
Opcode Fuzzy Hash: 0c9bf2d3e4eaa40eef17412a2e84147d3926be84d84674aa4cfe1d38aae734be
Instruction Fuzzy Hash: 2E71E476209BC485D720CF56F48079ABBA5F389B84F54851AEBCD53B29CF38C5A6CB01

Uniqueness

Uniqueness Score: -1.00%

Function 0040A1A0, Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4edd20159968de3a585fda8ae4dbababb437c783e68994423174e4196730a888
Instruction ID: a076f94b7e552279a5d0a09c1a72d364b71c7c2389a971b3227ef3d1c91fd462
Opcode Fuzzy Hash: 4edd20159968de3a585fda8ae4dbababb437c783e68994423174e4196730a888
Instruction Fuzzy Hash: 205104A2714F4441DE08CB6DF8A213AA225A3C9BD4B487523DF1E97BE5DE3CE651C300

Uniqueness

Uniqueness Score: -1.00%

Function 004FEC40, Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf8547b16668ec223736d0b95490bc126b78527f504729b4929683920702e72a
Instruction ID: f9439c7fae0e364b70d3b887d1cf988f0122e489043e74d2b0f3ea2e261a788c
Opcode Fuzzy Hash: cf8547b16668ec223736d0b95490bc126b78527f504729b4929683920702e72a
Instruction Fuzzy Hash: 9C313562715B98828F10DB67E4004AAA322F398FD474C9A23DF5E27F19DB3DC502C309

Uniqueness

Uniqueness Score: -1.00%

Function 00548AE0, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5faad3d8e57d33a464d880c356bd2412c7079ddde0834172eab8c15b200e025
Instruction ID: d4f6ce9c32ce98898f64285434a786779fdef96242cfe924504fca857755f064
Opcode Fuzzy Hash: d5faad3d8e57d33a464d880c356bd2412c7079ddde0834172eab8c15b200e025
Instruction Fuzzy Hash: 14418BB2618B94C6DB10DF56E4446AEB760F389BC8F445912EF8E5BB19CF78C951CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0040E8A0, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a25e21bb8a779fbb84947869bac3c6dd4827213eb6c2d1aa42c6a6f9b7d1b739
Instruction ID: 4fdeb3c5e920d6b3ec57238c512e5f12730321cf3911ed8c60a57bf30204edb7
Opcode Fuzzy Hash: a25e21bb8a779fbb84947869bac3c6dd4827213eb6c2d1aa42c6a6f9b7d1b739
Instruction Fuzzy Hash: F631E7F2A14B448BC656EB3A9040356E316FF967D0F58C722EE1A37795E739E0E28740

Uniqueness

Uniqueness Score: -1.00%

Function 0054C520, Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f8a1e77894454a95626b71b306472bdb0533b020af776ef10de529f4a9f28b4
Instruction ID: 730996160adf781b926ded58b9bd4e8bd9b553e6f15004b6575079849050afa0
Opcode Fuzzy Hash: 9f8a1e77894454a95626b71b306472bdb0533b020af776ef10de529f4a9f28b4
Instruction Fuzzy Hash: 5A412367E59FCA52F613573D8003FB59B10AFA76E0E10EB06AED1F1623E7297150A221

Uniqueness

Uniqueness Score: -1.00%

Function 0055ACE0, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4dbe7f4af8ab6f5efa6b138ff72f079665ad2d917952bf615c5e81f8eb9b7a2
Instruction ID: 0f757c893e6ecc8ef85e61d7c9fe8d2bfeee47559e7028bd8c4ddaa73118baf5
Opcode Fuzzy Hash: f4dbe7f4af8ab6f5efa6b138ff72f079665ad2d917952bf615c5e81f8eb9b7a2
Instruction Fuzzy Hash: F4113E67E25FD956E30356399103BBA1714BFFB6D4E00E706BEC072A53DB188361A214

Uniqueness

Uniqueness Score: -1.00%

Function 0055AC00, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4a1e0a881541a0e90698050311dc00decaa0c10310025fbf2ebf89ca72c9931
Instruction ID: 3d06c4bb6fab1af5789cc2303751731580d4bf9edf5d07d5bc577ef0362c6bcc
Opcode Fuzzy Hash: d4a1e0a881541a0e90698050311dc00decaa0c10310025fbf2ebf89ca72c9931
Instruction Fuzzy Hash: 9E113DA7E25FC856E30757398103ABA2714FBFB6D4F00E706BEC472A53DB188261A254

Uniqueness

Uniqueness Score: -1.00%

Function 0046C2E0, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f545811a8824dcfd7653556878f585b369d9ffbf8ef67deda9e90c121b56628a
Instruction ID: 84c838b3fb7b0a40642e972e64e041a9ef35d4624cd6fc4a77d58a850683c17e
Opcode Fuzzy Hash: f545811a8824dcfd7653556878f585b369d9ffbf8ef67deda9e90c121b56628a
Instruction Fuzzy Hash: 1CD01726710A8481DB305B19E8023467320FB88BB8F980722AEBC077E4CE38C2228F40

Uniqueness

Uniqueness Score: -1.00%

Function 0046A580, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.463864075.0000000000401000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463851353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.465271872.00000000008FD000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465278589.0000000000905000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465284471.0000000000909000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465291582.0000000000923000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.465298804.0000000000924000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_GoogleUpdate.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31955753d26992f1b4a247edb4986d9bce4df9ad281d15b47e679220a7aa401f
Instruction ID: f4f3c5a64deb9b14f9a722475a7a496fdc319cc8580bf3e36b24324dfe21f925
Opcode Fuzzy Hash: 31955753d26992f1b4a247edb4986d9bce4df9ad281d15b47e679220a7aa401f
Instruction Fuzzy Hash: 53C08CB0908EA039FB21C300B101301BA898B09384D40C08181891021AE56C82904A13

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report GoogleUpdate.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Initial Sample

Sigma Overview

Signature Overview

AV Detection:

Software Vulnerabilities:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: GoogleUpdate.exe PID: 6424 Parent PID: 5876

General

File Activities

File Opened

File Attributes Queried

Volume Information Queried

Device IO

Section Activities

Sections loaded by Windows

Sections loaded by Program

Registry Activities

Key Opened

Function 0046BEA0, Relevance: 1.3, APIs: 1, Instructions: 33
memoryCOMMON

Function 00556000, Relevance: 18.1, Strings: 14, Instructions: 605
COMMON