Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1520476
MD5:	4d4ce788750f2f654e42e6bfccde419c
SHA1:	33f56a257b9af1d77c085413be668c5d24f9b2e7
SHA256:	d8ee72c297423711a6580c3bbcaa8e335459fd111352cf024e662d363752097a
Tags:	exeuser-Bitsight
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Found API chain indicative of debugger detection

Found API chain indicative of sandbox detection

Machine Learning detection for sample

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

PE file contains more sections than normal

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7408 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 4D4CE788750F2F654E42E6BFCCDE419C)

chrome.exe (PID: 7484 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7688 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1992,i,16318564871758861565,14889931342432350397,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 4516 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5312 --field-trial-handle=1992,i,16318564871758861565,14889931342432350397,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6068 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 --field-trial-handle=1992,i,16318564871758861565,14889931342432350397,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

String found in binary or memory: _.iq(p)+"/familylink/privacy/notice/embedded?langCountry="+_.iq(p);break;case "PuZJUb":a+="https://www.youtube.com/t/terms?chromeless=1&hl="+_.iq(m);break;case "fxTQxb":a+="https://youtube.com/t/terms?gl="+_.iq(_.rq(c))+"&hl="+_.iq(d)+"&override_hl=1"+(f?"&linkless=1":"");break;case "prAmvd":a+="https://www.google.com/intl/"+_.iq(m)+"/chromebook/termsofservice.html?languageCode="+_.iq(d)+"&regionCode="+_.iq(c);break;case "NfnTze":a+="https://policies.google.com/privacy/google-partners"+(f?"/embedded": equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: accounts.youtube.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 519sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"Content-Type: application/x-www-form-urlencoded;charset=UTF-8sec-ch-ua-full-version: "117.0.5938.134"sec-ch-ua-platform-version: "10.0.0"X-Goog-AuthUser: 0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*Origin: https://accounts.google.comX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: Google.Widevine.CDM.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Google.Widevine.CDM.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Google.Widevine.CDM.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Google.Widevine.CDM.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Google.Widevine.CDM.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Google.Widevine.CDM.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Google.Widevine.CDM.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Google.Widevine.CDM.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Google.Widevine.CDM.dll.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Google.Widevine.CDM.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: Google.Widevine.CDM.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: Google.Widevine.CDM.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Google.Widevine.CDM.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Google.Widevine.CDM.dll.2.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: sets.json.2.dr	String found in binary or memory: https://07c225f3.online
Source: sets.json.2.dr	String found in binary or memory: https://aajtak.in
Source: chromecache_164.4.dr	String found in binary or memory: https://accounts.google.com
Source: chromecache_164.4.dr	String found in binary or memory: https://accounts.google.com/TOS?loc=
Source: sets.json.2.dr	String found in binary or memory: https://alice.tw
Source: sets.json.2.dr	String found in binary or memory: https://ambitionbox.com
Source: chromecache_168.4.dr	String found in binary or memory: https://apis.google.com/js/api.js
Source: chromecache_164.4.dr	String found in binary or memory: https://apis.google.com/js/rpc:shindig_random.js?onload=credentialservice.postMessage
Source: sets.json.2.dr	String found in binary or memory: https://autobild.de
Source: sets.json.2.dr	String found in binary or memory: https://bild.de
Source: sets.json.2.dr	String found in binary or memory: https://blackrock.com
Source: sets.json.2.dr	String found in binary or memory: https://blackrockadvisorelite.it
Source: sets.json.2.dr	String found in binary or memory: https://bluradio.com
Source: sets.json.2.dr	String found in binary or memory: https://bolasport.com
Source: sets.json.2.dr	String found in binary or memory: https://bonvivir.com
Source: sets.json.2.dr	String found in binary or memory: https://bumbox.com
Source: sets.json.2.dr	String found in binary or memory: https://businessinsider.com.pl
Source: sets.json.2.dr	String found in binary or memory: https://businesstoday.in
Source: sets.json.2.dr	String found in binary or memory: https://cachematrix.com
Source: sets.json.2.dr	String found in binary or memory: https://cafemedia.com
Source: sets.json.2.dr	String found in binary or memory: https://caracoltv.com
Source: sets.json.2.dr	String found in binary or memory: https://carcostadvisor.be
Source: sets.json.2.dr	String found in binary or memory: https://carcostadvisor.com
Source: sets.json.2.dr	String found in binary or memory: https://carcostadvisor.fr
Source: sets.json.2.dr	String found in binary or memory: https://cardsayings.net
Source: sets.json.2.dr	String found in binary or memory: https://chennien.com
Source: sets.json.2.dr	String found in binary or memory: https://citybibleforum.org
Source: sets.json.2.dr	String found in binary or memory: https://closeronline.co.uk
Source: sets.json.2.dr	String found in binary or memory: https://clubelpais.com.uy
Source: sets.json.2.dr	String found in binary or memory: https://cognitive-ai.ru
Source: sets.json.2.dr	String found in binary or memory: https://cognitiveai.ru
Source: sets.json.2.dr	String found in binary or memory: https://commentcamarche.com
Source: sets.json.2.dr	String found in binary or memory: https://commentcamarche.net
Source: sets.json.2.dr	String found in binary or memory: https://computerbild.de
Source: sets.json.2.dr	String found in binary or memory: https://content-loader.com
Source: sets.json.2.dr	String found in binary or memory: https://cookreactor.com
Source: sets.json.2.dr	String found in binary or memory: https://css-load.com
Source: sets.json.2.dr	String found in binary or memory: https://deccoria.pl
Source: sets.json.2.dr	String found in binary or memory: https://deere.com
Source: sets.json.2.dr	String found in binary or memory: https://desimartini.com
Source: sets.json.2.dr	String found in binary or memory: https://drimer.io
Source: sets.json.2.dr	String found in binary or memory: https://drimer.travel
Source: sets.json.2.dr	String found in binary or memory: https://efront.com
Source: sets.json.2.dr	String found in binary or memory: https://eleconomista.net
Source: sets.json.2.dr	String found in binary or memory: https://elfinancierocr.com
Source: sets.json.2.dr	String found in binary or memory: https://elgrafico.com
Source: sets.json.2.dr	String found in binary or memory: https://ella.sv
Source: sets.json.2.dr	String found in binary or memory: https://elpais.com.uy
Source: sets.json.2.dr	String found in binary or memory: https://elpais.uy
Source: sets.json.2.dr	String found in binary or memory: https://etfacademy.it
Source: sets.json.2.dr	String found in binary or memory: https://eworkbookcloud.com
Source: sets.json.2.dr	String found in binary or memory: https://eworkbookrequest.com
Source: sets.json.2.dr	String found in binary or memory: https://fakt.pl
Source: chromecache_159.4.dr	String found in binary or memory: https://families.google.com/intl/
Source: sets.json.2.dr	String found in binary or memory: https://finn.no
Source: sets.json.2.dr	String found in binary or memory: https://firstlook.biz
Source: chromecache_168.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/productlogos/drive_2020q4/v10/192px.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/productlogos/gmail_2020q4/v10/web-48dp/logo_gmail_2020q4_color_2x_web_
Source: chromecache_168.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/productlogos/maps/v7/192px.svg
Source: chromecache_164.4.dr	String found in binary or memory: https://g.co/recover
Source: sets.json.2.dr	String found in binary or memory: https://gallito.com.uy
Source: sets.json.2.dr	String found in binary or memory: https://geforcenow.com
Source: sets.json.2.dr	String found in binary or memory: https://gliadomain.com
Source: sets.json.2.dr	String found in binary or memory: https://gnttv.com
Source: sets.json.2.dr	String found in binary or memory: https://graziadaily.co.uk
Source: sets.json.2.dr	String found in binary or memory: https://grid.id
Source: sets.json.2.dr	String found in binary or memory: https://gridgames.app
Source: sets.json.2.dr	String found in binary or memory: https://grupolpg.sv
Source: sets.json.2.dr	String found in binary or memory: https://gujaratijagran.com
Source: sets.json.2.dr	String found in binary or memory: https://hapara.com
Source: sets.json.2.dr	String found in binary or memory: https://hc1.com
Source: sets.json.2.dr	String found in binary or memory: https://hc1.global
Source: sets.json.2.dr	String found in binary or memory: https://hc1cas.com
Source: sets.json.2.dr	String found in binary or memory: https://hc1cas.global
Source: sets.json.2.dr	String found in binary or memory: https://healthshots.com
Source: sets.json.2.dr	String found in binary or memory: https://hearty.app
Source: sets.json.2.dr	String found in binary or memory: https://hearty.gift
Source: sets.json.2.dr	String found in binary or memory: https://hearty.me
Source: sets.json.2.dr	String found in binary or memory: https://heartymail.com
Source: sets.json.2.dr	String found in binary or memory: https://heatworld.com
Source: sets.json.2.dr	String found in binary or memory: https://hindustantimes.com
Source: sets.json.2.dr	String found in binary or memory: https://hj.rs
Source: sets.json.2.dr	String found in binary or memory: https://hjck.com
Source: sets.json.2.dr	String found in binary or memory: https://html-load.cc
Source: sets.json.2.dr	String found in binary or memory: https://html-load.com
Source: sets.json.2.dr	String found in binary or memory: https://idbs-cloud.com
Source: sets.json.2.dr	String found in binary or memory: https://idbs-dev.com
Source: sets.json.2.dr	String found in binary or memory: https://idbs-eworkbook.com
Source: sets.json.2.dr	String found in binary or memory: https://idbs-staging.com
Source: sets.json.2.dr	String found in binary or memory: https://img-load.com
Source: sets.json.2.dr	String found in binary or memory: https://indiatoday.in
Source: sets.json.2.dr	String found in binary or memory: https://indiatodayne.in
Source: sets.json.2.dr	String found in binary or memory: https://infoedgeindia.com
Source: sets.json.2.dr	String found in binary or memory: https://interia.pl
Source: sets.json.2.dr	String found in binary or memory: https://intoday.in
Source: sets.json.2.dr	String found in binary or memory: https://iolam.it
Source: sets.json.2.dr	String found in binary or memory: https://ishares.com
Source: sets.json.2.dr	String found in binary or memory: https://jagran.com
Source: sets.json.2.dr	String found in binary or memory: https://johndeere.com
Source: sets.json.2.dr	String found in binary or memory: https://journaldesfemmes.com
Source: sets.json.2.dr	String found in binary or memory: https://journaldesfemmes.fr
Source: sets.json.2.dr	String found in binary or memory: https://journaldunet.com
Source: sets.json.2.dr	String found in binary or memory: https://journaldunet.fr
Source: sets.json.2.dr	String found in binary or memory: https://joyreactor.cc
Source: sets.json.2.dr	String found in binary or memory: https://joyreactor.com
Source: sets.json.2.dr	String found in binary or memory: https://kaksya.in
Source: sets.json.2.dr	String found in binary or memory: https://kompas.com
Source: sets.json.2.dr	String found in binary or memory: https://kompas.tv
Source: sets.json.2.dr	String found in binary or memory: https://kompasiana.com
Source: sets.json.2.dr	String found in binary or memory: https://lanacion.com.ar
Source: sets.json.2.dr	String found in binary or memory: https://landyrev.com
Source: sets.json.2.dr	String found in binary or memory: https://landyrev.ru
Source: sets.json.2.dr	String found in binary or memory: https://laprensagrafica.com
Source: sets.json.2.dr	String found in binary or memory: https://lateja.cr
Source: sets.json.2.dr	String found in binary or memory: https://libero.it
Source: sets.json.2.dr	String found in binary or memory: https://linternaute.com
Source: sets.json.2.dr	String found in binary or memory: https://linternaute.fr
Source: sets.json.2.dr	String found in binary or memory: https://livehindustan.com
Source: sets.json.2.dr	String found in binary or memory: https://livemint.com
Source: sets.json.2.dr	String found in binary or memory: https://max.auto
Source: sets.json.2.dr	String found in binary or memory: https://medonet.pl
Source: sets.json.2.dr	String found in binary or memory: https://mercadolibre.cl
Source: sets.json.2.dr	String found in binary or memory: https://mercadolibre.co.cr
Source: sets.json.2.dr	String found in binary or memory: https://mercadolibre.com
Source: sets.json.2.dr	String found in binary or memory: https://mercadolibre.com.ar
Source: sets.json.2.dr	String found in binary or memory: https://mercadolibre.com.bo
Source: sets.json.2.dr	String found in binary or memory: https://mercadolibre.com.co
Source: sets.json.2.dr	String found in binary or memory: https://mercadolibre.com.do
Source: sets.json.2.dr	String found in binary or memory: https://mercadolibre.com.ec
Source: sets.json.2.dr	String found in binary or memory: https://mercadolibre.com.gt
Source: sets.json.2.dr	String found in binary or memory: https://mercadolibre.com.hn
Source: sets.json.2.dr	String found in binary or memory: https://mercadolibre.com.mx
Source: sets.json.2.dr	String found in binary or memory: https://mercadolibre.com.ni
Source: sets.json.2.dr	String found in binary or memory: https://mercadolibre.com.pa
Source: sets.json.2.dr	String found in binary or memory: https://mercadolibre.com.pe
Source: sets.json.2.dr	String found in binary or memory: https://mercadolibre.com.py
Source: sets.json.2.dr	String found in binary or memory: https://mercadolibre.com.sv
Source: sets.json.2.dr	String found in binary or memory: https://mercadolibre.com.uy
Source: sets.json.2.dr	String found in binary or memory: https://mercadolibre.com.ve
Source: sets.json.2.dr	String found in binary or memory: https://mercadolivre.com
Source: sets.json.2.dr	String found in binary or memory: https://mercadolivre.com.br
Source: sets.json.2.dr	String found in binary or memory: https://mercadopago.cl
Source: sets.json.2.dr	String found in binary or memory: https://mercadopago.com
Source: sets.json.2.dr	String found in binary or memory: https://mercadopago.com.ar
Source: sets.json.2.dr	String found in binary or memory: https://mercadopago.com.br
Source: sets.json.2.dr	String found in binary or memory: https://mercadopago.com.co
Source: sets.json.2.dr	String found in binary or memory: https://mercadopago.com.ec
Source: sets.json.2.dr	String found in binary or memory: https://mercadopago.com.mx
Source: sets.json.2.dr	String found in binary or memory: https://mercadopago.com.pe
Source: sets.json.2.dr	String found in binary or memory: https://mercadopago.com.uy
Source: sets.json.2.dr	String found in binary or memory: https://mercadopago.com.ve
Source: sets.json.2.dr	String found in binary or memory: https://mercadoshops.cl
Source: sets.json.2.dr	String found in binary or memory: https://mercadoshops.com
Source: sets.json.2.dr	String found in binary or memory: https://mercadoshops.com.ar
Source: sets.json.2.dr	String found in binary or memory: https://mercadoshops.com.br
Source: sets.json.2.dr	String found in binary or memory: https://mercadoshops.com.co
Source: sets.json.2.dr	String found in binary or memory: https://mercadoshops.com.mx
Source: sets.json.2.dr	String found in binary or memory: https://mighty-app.appspot.com
Source: sets.json.2.dr	String found in binary or memory: https://mightytext.net
Source: sets.json.2.dr	String found in binary or memory: https://mittanbud.no
Source: sets.json.2.dr	String found in binary or memory: https://motherandbaby.com
Source: sets.json.2.dr	String found in binary or memory: https://mystudentdashboard.com
Source: sets.json.2.dr	String found in binary or memory: https://nacion.com
Source: sets.json.2.dr	String found in binary or memory: https://naukri.com
Source: sets.json.2.dr	String found in binary or memory: https://nidhiacademyonline.com
Source: sets.json.2.dr	String found in binary or memory: https://nien.co
Source: sets.json.2.dr	String found in binary or memory: https://nien.com
Source: sets.json.2.dr	String found in binary or memory: https://nien.org
Source: sets.json.2.dr	String found in binary or memory: https://noticiascaracol.com
Source: sets.json.2.dr	String found in binary or memory: https://nourishingpursuits.com
Source: sets.json.2.dr	String found in binary or memory: https://nvidia.com
Source: sets.json.2.dr	String found in binary or memory: https://onet.pl
Source: sets.json.2.dr	String found in binary or memory: https://ottplay.com
Source: sets.json.2.dr	String found in binary or memory: https://paula.com.uy
Source: sets.json.2.dr	String found in binary or memory: https://pdmp-apis.no
Source: sets.json.2.dr	String found in binary or memory: https://phonandroid.com
Source: chromecache_159.4.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_164.4.dr	String found in binary or memory: https://play.google.com/work/enroll?identifier=
Source: chromecache_159.4.dr	String found in binary or memory: https://play.google/intl/
Source: sets.json.2.dr	String found in binary or memory: https://plejada.pl
Source: chromecache_159.4.dr	String found in binary or memory: https://policies.google.com/privacy
Source: chromecache_159.4.dr	String found in binary or memory: https://policies.google.com/privacy/additional
Source: chromecache_159.4.dr	String found in binary or memory: https://policies.google.com/privacy/google-partners
Source: chromecache_159.4.dr	String found in binary or memory: https://policies.google.com/technologies/cookies
Source: chromecache_159.4.dr	String found in binary or memory: https://policies.google.com/technologies/location-data
Source: chromecache_159.4.dr	String found in binary or memory: https://policies.google.com/terms
Source: chromecache_159.4.dr	String found in binary or memory: https://policies.google.com/terms/location
Source: chromecache_159.4.dr	String found in binary or memory: https://policies.google.com/terms/service-specific
Source: sets.json.2.dr	String found in binary or memory: https://pomponik.pl
Source: sets.json.2.dr	String found in binary or memory: https://portalinmobiliario.com
Source: sets.json.2.dr	String found in binary or memory: https://prisjakt.no
Source: sets.json.2.dr	String found in binary or memory: https://punjabijagran.com
Source: sets.json.2.dr	String found in binary or memory: https://reactor.cc
Source: sets.json.2.dr	String found in binary or memory: https://salemoveadvisor.com
Source: sets.json.2.dr	String found in binary or memory: https://salemovefinancial.com
Source: sets.json.2.dr	String found in binary or memory: https://salemovetravel.com
Source: sets.json.2.dr	String found in binary or memory: https://shock.co
Source: sets.json.2.dr	String found in binary or memory: https://smaker.pl
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-email-pin.gif
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-password.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-sms-or-voice-pin.gif
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-sms-pin.gif
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/account-recovery-stop-go-landing-page_1x.png
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/animation/
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/ble_device.png
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/ble_pin.png
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync.png
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync_1x.png
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync_2x.png
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/contacts_backup_sync_darkmode_1x.png
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/continue_on_your_phone.png
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/device_phone_number_verification.png
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/device_prompt_silent_tap_yes_darkmode.gif
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/device_prompt_tap_yes.gif
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/device_prompt_tap_yes_darkmode.gif
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kid_success.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kid_success_darkmode.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use_dark_v2.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use_updated.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use_updated_darkmode.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidfork_who_will_use_v2.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignin_not_ready.png
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignin_stick_around_1.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignin_stick_around_dark_1.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_child_account_1.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_child_account_darkmode_1.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_child_privacy_1.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_child_privacy_darkmode_1.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_created.png
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_double_device.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_double_device_darkmode.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_full_house.png
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_link_accounts_1.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_link_accounts_darkmode_1.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_app_decision.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_app_decision_darkmode.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_supervision_1.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_parent_supervision_darkmode_1.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_respect_others_1.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_respect_others_darkmode_1.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_single_device.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_single_device_darkmode.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/kidsignup_stop.png
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/personalization_reminders.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/phone_number_sign_in_2x.png
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/return_to_desktop.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/return_to_desktop_darkmode.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key.gif
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_ios_center.png
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_laptop.gif
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_nfc_discovered.gif
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_nfc_discovered_darkmode.gif
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/security_key_phone.gif
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/signin_googleapp_ios.gif
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/signin_googleapp_pulldown.gif
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/signin_tapyes.gif
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/smart_lock_2x.png
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/usb_key.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/web_and_app_activity.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/who_will_be_using_this_device.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/embedded/you_tube_history.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/feature_not_available.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/feature_not_available_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/gmail_ios_authzen.gif
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/paaskey.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_challenge.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_challenge_darkmode.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_darkmode.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_cross_device.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_cross_device_darkmode.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_darkmode.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_error.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_error_darkmode.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_reauth.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_enrollment_reauth_darkmode.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_success.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkey_success_darkmode.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkeyerror.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/passkeyerror_darkmode.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/red_globe_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/red_globe_light.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/screenlock.png
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_ipad.gif
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_iphone.gif
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_iphone_nfc.gif
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_iphone_usb.gif
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_key_phone.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/security_keys.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/success_checkmark_2.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/marc/success_checkmark_2_darkmode.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/ui/loading_spinner_gm.gif
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/ui/progress_spinner_color_20dp_4x.gif
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/accounts/ui/success-gm-default_2x.png
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/apps/signup/resources/custom-email-address.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/images/hpp/shield_security_checkup_green_2x_web_96dp.png
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/account_setup_chapter_dark_1.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/account_setup_chapter_v1.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/device_setup_chapter_dark_v1.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/device_setup_chapter_v1.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/parental_control_chapter_dark_v1.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/chaptering/parental_control_chapter_v1.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/conversion/conversion_accountslinked.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/conversion/conversion_accountslinked_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/conversion/conversion_childneedshelp.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/conversion/conversion_childneedshelp_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/conversion/conversion_nextstepsforparents.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/conversion/conversion_nextstepsforparents_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_allset.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_allset_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_apps_devices.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_apps_devices_darkmode.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_areyousurekid.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_areyousurekid_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_birthdayemail.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_birthdayemail_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_choose_apps.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_choose_apps_darkmode.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_confirmation.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_exploremore.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_exploremore_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_intro.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_intro_darkmode.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_privacy_terms_a18.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_privacy_terms_a18_darkmode.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_privacyterms.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_privacyterms_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_review_settings.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_review_settings_darkmode.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_safe_search.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_safe_search_darkmode.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_success_unchanged_a18.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_success_unchanged_a18_darkmode.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_success_update_a18.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_success_update_a18_darkmode.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervision_choice.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervision_choice_a18.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervision_choice_a18_darkmode.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervision_choice_darkmode.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervisiongrad.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/graduation/graduation_supervisiongrad_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/guardianlinking/linking_complete_0.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/guardianlinking/linking_complete_dark_0.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/ads_personalization.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/ads_personalization_darkmode.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/confirmation.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/confirmation_darkmode.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/eligibility_error.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/eligibility_error_darkmode.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/fork.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/fork_darkmode.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/intro.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/intro_darkmode.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/personal_results.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/personal_results_darkmode.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/safe_search.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/minormodeexit/safe_search_darkmode.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/check_notifications.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/check_notifications_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_installing_family_link_2.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_installing_family_link_dark_2.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_location_sharing_2.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_location_sharing_dark_2.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_parental_controls_2.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_parental_controls_dark_2.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_school_time_2.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/kid_watch_set_up_school_time_dark_2.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/location_sharing_enabled_2.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/location_sharing_enabled_dark_3.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/parent_sign_in_prologue_1.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/parent_sign_in_prologue_dark_1.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_complete_1.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_complete_dark_1.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_contacts_2.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_contacts_dark_2.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_family_link_boy_1.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_family_link_boy_dark_1.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_family_link_girl_2.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/set_up_family_link_girl_dark_2.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/ulp_continue_without_gmail_dark_v2.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/onboarding/ulp_continue_without_gmail_v2.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/all_set.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/all_set_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/are_you_sure_parent.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/are_you_sure_parent_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/content_restriction.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/content_restriction_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/error.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/error_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/how_controls_work.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/how_controls_work_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/next_steps.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/next_steps_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/setup_controls.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/setup_controls_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/who_parent.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/who_parent_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/who_teen.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teensupervisionreview/who_teen_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teentoadultgraduation/supervision_choice.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/teentoadultgraduation/supervision_choice_darkmode.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/kid_setup_parent_escalation.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/kid_setup_parent_escalation_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/send_email_confirmation.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/send_email_confirmation_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/success_sent_email.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/ulp_appblock/success_sent_email_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/ulpupgrade/kidprofileupgrade_all_set.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/images/ulpupgrade/kidprofileupgrade_all_set_darkmode.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/all_set.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/all_set_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/almost_done_kids_space_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/almost_done_kids_space_v2.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_tablet_v2.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_tablet_v2_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_v2.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/devices_connected_v2_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/emailinstallfamilylink.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/emailinstallfamilylink_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/familylinkinstalling.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/familylinkinstalling_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/hand_over_device_dark_v2.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/hand_over_device_v2.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/linking_accounts_v2.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/linking_accounts_v2_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/locationsetup.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/locationsetup_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_email.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_email_v2.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_email_v2_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_v2.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/manage_parental_controls_v2_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/open_family_link_v2.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/open_family_link_v2_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/parents_help.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/parents_help_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/set_up_kids_space.png
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/set_up_kids_space_dark.png
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setupcontrol.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setupcontrol_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setuplocation.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setuplocation_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setuptimelimits.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/setuptimelimits_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/supervision_ready_v2.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/supervision_ready_v2_dark.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/youtubeaccess.svg
Source: chromecache_168.4.dr	String found in binary or memory: https://ssl.gstatic.com/kids/onboarding/illustrations/youtubeaccess_dark.svg
Source: sets.json.2.dr	String found in binary or memory: https://supereva.it
Source: chromecache_164.4.dr	String found in binary or memory: https://support.google.com/accounts?hl=
Source: chromecache_159.4.dr	String found in binary or memory: https://support.google.com/accounts?p=new-si-ui
Source: chromecache_164.4.dr	String found in binary or memory: https://support.google.com/websearch/answer/4358949?hl=ko&ref_topic=3285072
Source: sets.json.2.dr	String found in binary or memory: https://takeabreak.co.uk
Source: sets.json.2.dr	String found in binary or memory: https://teacherdashboard.com
Source: sets.json.2.dr	String found in binary or memory: https://terazgotuje.pl
Source: sets.json.2.dr	String found in binary or memory: https://textyserver.appspot.com
Source: sets.json.2.dr	String found in binary or memory: https://thirdspace.org.au
Source: sets.json.2.dr	String found in binary or memory: https://top.pl
Source: sets.json.2.dr	String found in binary or memory: https://tribunnews.com
Source: sets.json.2.dr	String found in binary or memory: https://tucarro.com
Source: sets.json.2.dr	String found in binary or memory: https://tucarro.com.co
Source: sets.json.2.dr	String found in binary or memory: https://tucarro.com.ve
Source: chromecache_168.4.dr	String found in binary or memory: https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=
Source: sets.json.2.dr	String found in binary or memory: https://welt.de
Source: sets.json.2.dr	String found in binary or memory: https://wieistmeineip.de
Source: sets.json.2.dr	String found in binary or memory: https://wordle.at
Source: sets.json.2.dr	String found in binary or memory: https://www.asadcdn.com
Source: chromecache_164.4.dr	String found in binary or memory: https://www.google.com
Source: chromecache_159.4.dr	String found in binary or memory: https://www.google.com/intl/
Source: chromecache_168.4.dr	String found in binary or memory: https://www.gstatic.com/accounts/speedbump/authzen_optin_illustration.gif
Source: chromecache_168.4.dr	String found in binary or memory: https://www.gstatic.com/images/branding/product/2x/chrome_48dp.png
Source: chromecache_168.4.dr	String found in binary or memory: https://www.gstatic.com/images/branding/product/2x/googleg_48dp.png
Source: chromecache_168.4.dr	String found in binary or memory: https://www.gstatic.com/images/branding/product/2x/gsa_48dp.png
Source: chromecache_168.4.dr	String found in binary or memory: https://www.gstatic.com/images/branding/product/2x/play_prism_48dp.png
Source: chromecache_168.4.dr	String found in binary or memory: https://www.gstatic.com/images/branding/product/2x/youtube_48dp.png
Source: chromecache_159.4.dr	String found in binary or memory: https://www.gstatic.com/images/branding/productlogos/googleg/v6/36px.svg
Source: chromecache_159.4.dr	String found in binary or memory: https://www.youtube.com/t/terms?chromeless=1&hl=
Source: sets.json.2.dr	String found in binary or memory: https://yours.co.uk
Source: file.exe, 00000000.00000002.2551686883.00000000040C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: file.exe, 00000000.00000002.2550878643.0000000001809000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd6
Source: file.exe, 00000000.00000002.2551247088.0000000003B6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdQ
Source: file.exe, 00000000.00000002.2551686883.00000000040C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdX
Source: file.exe, 00000000.00000002.2550878643.0000000001809000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdcessx
Source: file.exe, 00000000.00000002.2551686883.00000000040C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdp
Source: file.exe, 00000000.00000002.2551686883.00000000040C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdx
Source: chromecache_159.4.dr	String found in binary or memory: https://youtube.com/t/terms?gl=

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56939
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56941
Source: unknown	Network traffic detected: HTTP traffic on port 56947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.7:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.7:49753 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0021EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_0021EAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0021ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_0021ED6A

Source: C:\Users\user\Desktop\file.exe

0_2_0021EAFF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0020AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_0020AA57

Source: file.exe, 00000000.00000002.2550329167.0000000001518000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: _WINAPI_REGISTERRAWINPUTDEVICES

memstr_6f8e99a9-c

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00239576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00239576

System Summary

Binary is likely a compiled AutoIt script file

Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: file.exe, 00000000.00000000.1288860115.0000000000262000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_54778cd1-a
Source: file.exe, 00000000.00000000.1288860115.0000000000262000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_986359d1-0
Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_44870cf4-6
Source: file.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_d0a502b5-0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0020D5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_0020D5EB

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00201201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00201201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0020E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_0020E8F6

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7484_659994726	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7484_659994726\sets.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7484_659994726\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7484_659994726\LICENSE	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7484_659994726\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7484_659994726\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7484_659994726\manifest.fingerprint	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7484_821695454	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7484_821695454\Google.Widevine.CDM.dll	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7484_821695454\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7484_821695454\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7484_821695454\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7484_821695454\manifest.fingerprint	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\chrome_BITS_7484_955694822

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001ABF40	0_2_001ABF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00212046	0_2_00212046
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001A8060	0_2_001A8060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00208298	0_2_00208298
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001DE4FF	0_2_001DE4FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001D676B	0_2_001D676B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00234873	0_2_00234873
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001CCAA0	0_2_001CCAA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001ACAF0	0_2_001ACAF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001BCC39	0_2_001BCC39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001D6DD9	0_2_001D6DD9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001BB119	0_2_001BB119
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001A91C0	0_2_001A91C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C1394	0_2_001C1394
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C1706	0_2_001C1706
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C781B	0_2_001C781B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001A7920	0_2_001A7920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001B997D	0_2_001B997D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C19B0	0_2_001C19B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C7A4A	0_2_001C7A4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C1C77	0_2_001C1C77
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C7CA7	0_2_001C7CA7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0022BE44	0_2_0022BE44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001D9EEE	0_2_001D9EEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C1F32	0_2_001C1F32

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 001BF9F2 appears 40 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 001A9CB3 appears 31 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 001C0A30 appears 46 times

Source: Google.Widevine.CDM.dll.2.dr

Static PE information: Number of sections : 12 > 10

Source: file.exe, 00000000.00000002.2550329167.0000000001518000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FV_ORIGINALFILENAME vs file.exe
Source: file.exe, 00000000.00000002.2550329167.0000000001518000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FV_ORIGINALFILENAME=+ vs file.exe
Source: file.exe, 00000000.00000002.2550329167.0000000001518000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename2+ vs file.exe
Source: file.exe, 00000000.00000002.2551273969.0000000003B80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Comments\|CompanyName\|FileDescription\|FileVersion\|InternalName\|LegalCopyright\|LegalTrademarks\|OriginalFilename\|ProductName\|ProductVersion\|PrivateBuild\|SpecialBuildUnknoR vs file.exe
Source: file.exe, 00000000.00000002.2551273969.0000000003B80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Comments\|CompanyName\|FileDescription\|FileVersion\|InternalName\|LegalCopyright\|LegalTrademarks\|OriginalFilename\|ProductName\|ProductVersion\|PrivateBuild\|SpecialBuildlatfo^ vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal68.evad.winEXE@38/41@12/8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_002137B5 GetLastError,FormatMessageW,

0_2_002137B5

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002010BF AdjustTokenPrivileges,CloseHandle,		0_2_002010BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002016C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_002016C3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_002151CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_002151CD

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0022A67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_0022A67C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0021648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_0021648E

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001A42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_001A42A2

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 28%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1992,i,16318564871758861565,14889931342432350397,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5312 --field-trial-handle=1992,i,16318564871758861565,14889931342432350397,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 --field-trial-handle=1992,i,16318564871758861565,14889931342432350397,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1992,i,16318564871758861565,14889931342432350397,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5312 --field-trial-handle=1992,i,16318564871758861565,14889931342432350397,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 --field-trial-handle=1992,i,16318564871758861565,14889931342432350397,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 1167360 > 1048576

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: Google.Widevine.CDM.dll.pdb source: Google.Widevine.CDM.dll.2.dr

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001A42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_001A42DE

Source: Google.Widevine.CDM.dll.2.dr	Static PE information: section name: .00cfg
Source: Google.Widevine.CDM.dll.2.dr	Static PE information: section name: .gxfg
Source: Google.Widevine.CDM.dll.2.dr	Static PE information: section name: .retplne
Source: Google.Widevine.CDM.dll.2.dr	Static PE information: section name: .voltbl
Source: Google.Widevine.CDM.dll.2.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001C0A76 push ecx; ret

0_2_001C0A89

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7484_821695454\Google.Widevine.CDM.dll

Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7484_821695454\Google.Widevine.CDM.dll

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001BF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_001BF98E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00231C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00231C41

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\file.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-98537

Source: C:\Users\user\Desktop\file.exe

Window / User API: threadDelayed 6691

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

API coverage: 3.3 %

Source: C:\Users\user\Desktop\file.exe TID: 7412

Thread sleep time: -66910s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

Thread sleep count: Count: 6691 delay: -10

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0020DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_0020DBBE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001DC2A2 FindFirstFileExW,	0_2_001DC2A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002168EE FindFirstFileW,FindClose,	0_2_002168EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0021698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_0021698F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0020D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0020D076
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0020D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_0020D3A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00219642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00219642
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0021979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0021979D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00219B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00219B2B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00215C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00215C97

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001A42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_001A42DE

Source: file.exe, 00000000.00000002.2550329167.0000000001518000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: file.exe, 00000000.00000002.2550329167.0000000001518000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}z

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\file.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_0-97073

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0021EAA2 BlockInput,

0_2_0021EAA2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001D2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_001D2622

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001A42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_001A42DE

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001C4CE8 mov eax, dword ptr fs:[00000030h]

0_2_001C4CE8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00200B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00200B62

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001D2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_001D2622
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_001C083F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C09D5 SetUnhandledExceptionFilter,	0_2_001C09D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_001C0C21

Source: C:\Users\user\Desktop\file.exe

0_2_00201201

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001E2BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_001E2BA5

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0020B226 SendInput,keybd_event,

0_2_0020B226

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_002222DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_002222DA

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00200B62

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00201663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00201663

Source: file.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001C0698 cpuid

0_2_001C0698

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00218195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_00218195

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001FD27A GetUserNameW,

0_2_001FD27A

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001DB952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

0_2_001DB952

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001A42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_001A42DE

Source: file.exe	Binary or memory string: WIN_81
Source: file.exe	Binary or memory string: WIN_XP
Source: file.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: file.exe	Binary or memory string: WIN_XPe
Source: file.exe, 00000000.00000002.2550459194.0000000001602000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_XPq
Source: file.exe	Binary or memory string: WIN_VISTA
Source: file.exe	Binary or memory string: WIN_7
Source: file.exe	Binary or memory string: WIN_8

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00221204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_00221204
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00221806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00221806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	31 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	31 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	1 File Deletion	LSA Secrets	221 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Masquerading	Cached Domain Credentials	22 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Valid Accounts	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	22 Virtualization/Sandbox Evasion	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	29%	ReversingLabs
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7484_821695454\Google.Widevine.CDM.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://wieistmeineip.de	0%	URL Reputation	safe
https://mercadoshops.com.co	0%	URL Reputation	safe
https://gliadomain.com	0%	URL Reputation	safe
https://mercadolivre.com	0%	URL Reputation	safe
https://nourishingpursuits.com	0%	URL Reputation	safe
https://medonet.pl	0%	URL Reputation	safe
https://mercadoshops.com.br	0%	URL Reputation	safe
https://johndeere.com	0%	URL Reputation	safe
https://supereva.it	0%	URL Reputation	safe
https://elfinancierocr.com	0%	URL Reputation	safe
https://bolasport.com	0%	URL Reputation	safe
https://desimartini.com	0%	URL Reputation	safe
https://hearty.app	0%	URL Reputation	safe
https://hearty.gift	0%	URL Reputation	safe
https://mercadoshops.com	0%	URL Reputation	safe
https://heartymail.com	0%	URL Reputation	safe
https://finn.no	0%	URL Reputation	safe
https://hc1.com	0%	URL Reputation	safe
https://kompas.tv	0%	URL Reputation	safe
https://mystudentdashboard.com	0%	URL Reputation	safe
https://smaker.pl	0%	URL Reputation	safe
https://mercadopago.com.mx	0%	URL Reputation	safe
https://mercadopago.com.pe	0%	URL Reputation	safe
https://cardsayings.net	0%	URL Reputation	safe
https://apis.google.com/js/api.js	0%	URL Reputation	safe
https://mightytext.net	0%	URL Reputation	safe
https://joyreactor.com	0%	URL Reputation	safe
https://cookreactor.com	0%	URL Reputation	safe
https://eworkbookcloud.com	0%	URL Reputation	safe
https://cognitiveai.ru	0%	URL Reputation	safe
https://nacion.com	0%	URL Reputation	safe
https://chennien.com	0%	URL Reputation	safe
https://drimer.travel	0%	URL Reputation	safe
https://deccoria.pl	0%	URL Reputation	safe
https://mercadopago.cl	0%	URL Reputation	safe
https://bonvivir.com	0%	URL Reputation	safe
https://carcostadvisor.be	0%	URL Reputation	safe
https://salemovetravel.com	0%	URL Reputation	safe
https://welt.de	0%	URL Reputation	safe
https://drimer.io	0%	URL Reputation	safe
https://infoedgeindia.com	0%	URL Reputation	safe
https://blackrockadvisorelite.it	0%	URL Reputation	safe
https://policies.google.com/privacy	0%	URL Reputation	safe
https://cognitive-ai.ru	0%	URL Reputation	safe
https://cafemedia.com	0%	URL Reputation	safe
https://graziadaily.co.uk	0%	URL Reputation	safe
https://thirdspace.org.au	0%	URL Reputation	safe
https://mercadoshops.com.ar	0%	URL Reputation	safe
https://elpais.uy	0%	URL Reputation	safe
https://landyrev.com	0%	URL Reputation	safe
https://commentcamarche.com	0%	URL Reputation	safe
https://tucarro.com.ve	0%	URL Reputation	safe
https://eleconomista.net	0%	URL Reputation	safe
https://mercadolivre.com.br	0%	URL Reputation	safe
https://salemovefinancial.com	0%	URL Reputation	safe
https://mercadopago.com.br	0%	URL Reputation	safe
https://commentcamarche.net	0%	URL Reputation	safe
https://etfacademy.it	0%	URL Reputation	safe
https://mighty-app.appspot.com	0%	URL Reputation	safe
https://hj.rs	0%	URL Reputation	safe
https://hearty.me	0%	URL Reputation	safe
https://mercadolibre.com.gt	0%	URL Reputation	safe
https://indiatodayne.in	0%	URL Reputation	safe
https://idbs-staging.com	0%	URL Reputation	safe
https://blackrock.com	0%	URL Reputation	safe
https://idbs-eworkbook.com	0%	URL Reputation	safe
https://motherandbaby.com	0%	URL Reputation	safe
https://mercadolibre.co.cr	0%	URL Reputation	safe
https://hjck.com	0%	URL Reputation	safe
https://prisjakt.no	0%	URL Reputation	safe
https://kompas.com	0%	URL Reputation	safe
https://mercadopago.com.ar	0%	URL Reputation	safe
https://tucarro.com.co	0%	URL Reputation	safe
https://terazgotuje.pl	0%	URL Reputation	safe
https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
youtube-ui.l.google.com	142.250.185.110	true	false	unknown
www3.l.google.com	142.250.185.206	true	false	unknown
play.google.com	216.58.206.78	true	false	unknown
www.google.com	142.250.186.68	true	false	unknown
youtube.com	142.250.186.46	true	false	unknown
accounts.youtube.com	unknown	unknown	false	unknown
www.youtube.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://www.google.com/favicon.ico	false	unknown
https://play.google.com/log?format=json&hasfast=true&authuser=0	false	unknown
https://play.google.com/log?hasfast=true&authuser=0&format=json	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://wieistmeineip.de	sets.json.2.dr	false	URL Reputation: safe	unknown
https://mercadoshops.com.co	sets.json.2.dr	false	URL Reputation: safe	unknown
https://gliadomain.com	sets.json.2.dr	false	URL Reputation: safe	unknown
https://mercadolivre.com	sets.json.2.dr	false	URL Reputation: safe	unknown
https://play.google.com/work/enroll?identifier=	chromecache_164.4.dr	false		unknown
https://policies.google.com/terms/service-specific	chromecache_159.4.dr	false		unknown
https://nourishingpursuits.com	sets.json.2.dr	false	URL Reputation: safe	unknown
https://medonet.pl	sets.json.2.dr	false	URL Reputation: safe	unknown
https://mercadoshops.com.br	sets.json.2.dr	false	URL Reputation: safe	unknown
https://joyreactor.cc	sets.json.2.dr	false		unknown
https://policies.google.com/technologies/cookies	chromecache_159.4.dr	false		unknown
https://johndeere.com	sets.json.2.dr	false	URL Reputation: safe	unknown
https://supereva.it	sets.json.2.dr	false	URL Reputation: safe	unknown
https://elfinancierocr.com	sets.json.2.dr	false	URL Reputation: safe	unknown
https://bolasport.com	sets.json.2.dr	false	URL Reputation: safe	unknown
https://www.youtube.com/t/terms?chromeless=1&hl=	chromecache_159.4.dr	false		unknown
https://desimartini.com	sets.json.2.dr	false	URL Reputation: safe	unknown
https://hearty.app	sets.json.2.dr	false	URL Reputation: safe	unknown
https://hearty.gift	sets.json.2.dr	false	URL Reputation: safe	unknown
https://mercadoshops.com	sets.json.2.dr	false	URL Reputation: safe	unknown
https://heartymail.com	sets.json.2.dr	false	URL Reputation: safe	unknown
https://finn.no	sets.json.2.dr	false	URL Reputation: safe	unknown
https://hc1.com	sets.json.2.dr	false	URL Reputation: safe	unknown
https://kompas.tv	sets.json.2.dr	false	URL Reputation: safe	unknown
https://mystudentdashboard.com	sets.json.2.dr	false	URL Reputation: safe	unknown
https://smaker.pl	sets.json.2.dr	false	URL Reputation: safe	unknown
https://mercadopago.com.mx	sets.json.2.dr	false	URL Reputation: safe	unknown
https://mercadopago.com.pe	sets.json.2.dr	false	URL Reputation: safe	unknown
https://cardsayings.net	sets.json.2.dr	false	URL Reputation: safe	unknown
https://apis.google.com/js/api.js	chromecache_168.4.dr	false	URL Reputation: safe	unknown
https://mightytext.net	sets.json.2.dr	false	URL Reputation: safe	unknown
https://joyreactor.com	sets.json.2.dr	false	URL Reputation: safe	unknown
https://cookreactor.com	sets.json.2.dr	false	URL Reputation: safe	unknown
https://eworkbookcloud.com	sets.json.2.dr	false	URL Reputation: safe	unknown
https://cognitiveai.ru	sets.json.2.dr	false	URL Reputation: safe	unknown
https://nacion.com	sets.json.2.dr	false	URL Reputation: safe	unknown
https://chennien.com	sets.json.2.dr	false	URL Reputation: safe	unknown
https://drimer.travel	sets.json.2.dr	false	URL Reputation: safe	unknown
https://deccoria.pl	sets.json.2.dr	false	URL Reputation: safe	unknown
https://mercadopago.cl	sets.json.2.dr	false	URL Reputation: safe	unknown
https://naukri.com	sets.json.2.dr	false		unknown
https://interia.pl	sets.json.2.dr	false		unknown
https://bonvivir.com	sets.json.2.dr	false	URL Reputation: safe	unknown
https://carcostadvisor.be	sets.json.2.dr	false	URL Reputation: safe	unknown
https://salemovetravel.com	sets.json.2.dr	false	URL Reputation: safe	unknown
https://welt.de	sets.json.2.dr	false	URL Reputation: safe	unknown
https://drimer.io	sets.json.2.dr	false	URL Reputation: safe	unknown
https://infoedgeindia.com	sets.json.2.dr	false	URL Reputation: safe	unknown
https://blackrockadvisorelite.it	sets.json.2.dr	false	URL Reputation: safe	unknown
https://policies.google.com/privacy	chromecache_159.4.dr	false	URL Reputation: safe	unknown
https://cognitive-ai.ru	sets.json.2.dr	false	URL Reputation: safe	unknown
https://cafemedia.com	sets.json.2.dr	false	URL Reputation: safe	unknown
https://graziadaily.co.uk	sets.json.2.dr	false	URL Reputation: safe	unknown
https://thirdspace.org.au	sets.json.2.dr	false	URL Reputation: safe	unknown
https://mercadoshops.com.ar	sets.json.2.dr	false	URL Reputation: safe	unknown
https://elpais.uy	sets.json.2.dr	false	URL Reputation: safe	unknown
https://landyrev.com	sets.json.2.dr	false	URL Reputation: safe	unknown
https://commentcamarche.com	sets.json.2.dr	false	URL Reputation: safe	unknown
https://tucarro.com.ve	sets.json.2.dr	false	URL Reputation: safe	unknown
https://eleconomista.net	sets.json.2.dr	false	URL Reputation: safe	unknown
https://mercadolivre.com.br	sets.json.2.dr	false	URL Reputation: safe	unknown
https://07c225f3.online	sets.json.2.dr	false		unknown
https://salemovefinancial.com	sets.json.2.dr	false	URL Reputation: safe	unknown
https://mercadopago.com.br	sets.json.2.dr	false	URL Reputation: safe	unknown
https://commentcamarche.net	sets.json.2.dr	false	URL Reputation: safe	unknown
https://etfacademy.it	sets.json.2.dr	false	URL Reputation: safe	unknown
https://mighty-app.appspot.com	sets.json.2.dr	false	URL Reputation: safe	unknown
https://hj.rs	sets.json.2.dr	false	URL Reputation: safe	unknown
https://hearty.me	sets.json.2.dr	false	URL Reputation: safe	unknown
https://mercadolibre.com.gt	sets.json.2.dr	false	URL Reputation: safe	unknown
https://indiatodayne.in	sets.json.2.dr	false	URL Reputation: safe	unknown
https://idbs-staging.com	sets.json.2.dr	false	URL Reputation: safe	unknown
https://blackrock.com	sets.json.2.dr	false	URL Reputation: safe	unknown
https://idbs-eworkbook.com	sets.json.2.dr	false	URL Reputation: safe	unknown
https://motherandbaby.com	sets.json.2.dr	false	URL Reputation: safe	unknown
https://mercadolibre.co.cr	sets.json.2.dr	false	URL Reputation: safe	unknown
https://hjck.com	sets.json.2.dr	false	URL Reputation: safe	unknown
https://prisjakt.no	sets.json.2.dr	false	URL Reputation: safe	unknown
https://kompas.com	sets.json.2.dr	false	URL Reputation: safe	unknown
https://idbs-dev.com	sets.json.2.dr	false		unknown
https://mercadolibre.cl	sets.json.2.dr	false		unknown
https://mercadopago.com.ar	sets.json.2.dr	false	URL Reputation: safe	unknown
https://mercadolibre.com.hn	sets.json.2.dr	false		unknown
https://apis.google.com/js/rpc:shindig_random.js?onload=credentialservice.postMessage	chromecache_164.4.dr	false		unknown
https://linternaute.com	sets.json.2.dr	false		unknown
https://tucarro.com.co	sets.json.2.dr	false	URL Reputation: safe	unknown
https://landyrev.ru	sets.json.2.dr	false		unknown
https://terazgotuje.pl	sets.json.2.dr	false	URL Reputation: safe	unknown
https://nien.com	sets.json.2.dr	false		unknown
https://policies.google.com/privacy/additional	chromecache_159.4.dr	false		unknown
https://punjabijagran.com	sets.json.2.dr	false		unknown
https://indiatoday.in	sets.json.2.dr	false		unknown
https://grupolpg.sv	sets.json.2.dr	false		unknown
https://uberproxy-pen-redirect.corp.google.com/uberproxy/pen?url=	chromecache_168.4.dr	false	URL Reputation: safe	unknown
https://gallito.com.uy	sets.json.2.dr	false		unknown
https://mercadolibre.com.ve	sets.json.2.dr	false		unknown
https://support.google.com/accounts?hl=	chromecache_164.4.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.46	youtube.com	United States	15169	GOOGLEUS	false
142.250.186.68	www.google.com	United States	15169	GOOGLEUS	false
142.250.185.206	www3.l.google.com	United States	15169	GOOGLEUS	false
216.58.206.78	play.google.com	United States	15169	GOOGLEUS	false
142.250.185.110	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
142.250.181.238	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.7

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1520476
Start date and time:	2024-09-27 11:28:20 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal68.evad.winEXE@38/41@12/8
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 45 Number of non-executed functions: 307
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.67, 142.250.184.238, 108.177.15.84, 34.104.35.123, 142.250.186.99, 142.250.181.234, 216.58.212.170, 142.250.74.202, 142.250.186.42, 142.250.184.234, 142.250.186.106, 216.58.206.42, 172.217.16.138, 172.217.18.10, 172.217.16.202, 172.217.18.106, 142.250.184.202, 142.250.186.74, 142.250.186.170, 142.250.186.138, 216.58.206.74, 142.250.185.74, 142.250.185.170, 142.250.185.138, 142.250.185.202, 142.250.185.234, 142.250.185.106, 93.184.221.240, 142.250.181.227, 142.251.173.84, 216.58.212.174
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, time.windows.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	8y4qT1eVpi.exe	Get hash	malicious	Amadey, Stealc	Browse
	https://strato.de-sys.online/HJd9cn-2tRRO-rDZDs-D6p99-HbdYU-wK4oY-FICwzl/index.html	Get hash	malicious	HTMLPhisher	Browse
	https://www.vossloh-events.com/EMOS/Login.aspx?ReturnUrl=%2femos	Get hash	malicious	Unknown	Browse
	https://ojbkjs.vip/yb.js	Get hash	malicious	Unknown	Browse
	https://bgbonline.cecchinatoonline.top/	Get hash	malicious	HtmlDropper	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	http://aucution-addopenandmaking81.s3-website.us-east-2.amazonaws.com/	Get hash	malicious	HTMLPhisher	Browse
	https://jbrizuelablplegal.taplink.ws/	Get hash	malicious	HTMLPhisher	Browse
	https://sothebys.us.com/4RAoTxB4GI1Anz01wI1Achm3T2APW4Q3E4RAha4RA4DCm3TB4G4RAaunz01coTxq01	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	8y4qT1eVpi.exe	Get hash	malicious	Amadey, Stealc	Browse	52.165.165.26 184.28.90.27
	https://strato.de-sys.online/HJd9cn-2tRRO-rDZDs-D6p99-HbdYU-wK4oY-FICwzl/index.html	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26 184.28.90.27
	https://www.vossloh-events.com/EMOS/Login.aspx?ReturnUrl=%2femos	Get hash	malicious	Unknown	Browse	52.165.165.26 184.28.90.27
	https://ojbkjs.vip/yb.js	Get hash	malicious	Unknown	Browse	52.165.165.26 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	52.165.165.26 184.28.90.27
	http://aucution-addopenandmaking81.s3-website.us-east-2.amazonaws.com/	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26 184.28.90.27
	https://jbrizuelablplegal.taplink.ws/	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26 184.28.90.27
	https://sothebys.us.com/4RAoTxB4GI1Anz01wI1Achm3T2APW4Q3E4RAha4RA4DCm3TB4G4RAaunz01coTxq01	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26 184.28.90.27
	file.exe	Get hash	malicious	Unknown	Browse	52.165.165.26 184.28.90.27
	http://home-103607.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26 184.28.90.27

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7484_821695454\Google.Widevine.CDM.dll	https://bgbonline.cecchinatoonline.top/	Get hash	malicious	HtmlDropper	Browse
	https://mintlink5.vercel.app/	Get hash	malicious	HTMLPhisher	Browse
	http://moollhanot.freewebhostmost.com/	Get hash	malicious	Unknown	Browse
	https://qrco.de/bfQgn5	Get hash	malicious	Unknown	Browse
	https://risingstarsyouthfootballcamp.com/modules/psgdpr/css/bonde/auth/dV9oBz/index.php/	Get hash	malicious	Unknown	Browse
	http://maskconnect.gitbook.io/us	Get hash	malicious	HTMLPhisher	Browse
	http://email.technologycurrent.co/c/eJxszruutCoAxfGn0ZJwRwqLk0z2a-xwVcQBLyiMT38yu_7a__oVy45MOig4692IBBaIMYpFP48ODYNEDhPqjbFSUey0hpQJq9g39GHEEFMoMYUMEyqA-5MDR9YOimjaUVicmVNe8_Qx13G4VIDJ_TrOpWwd-a_DPx3-KYcyEfxLfnfy08rakReFYX-awMuMypWgRfapXu8T1PmuftcLv-dtd5VbhPiVeQs-yHuQDC9GfvSHn1JMktV7Njxd2kXYbrgt4QnvayKuCHMINKmdf05bzXORKcbdTfCsJkQRs7ggoS2fKYeDyeRpDj7qwHTektYEyhg1zFUKZvWnyCP4p7nFipqkTwshdD6Xmdvn_eSMq0ttOLem5HQZb9d9XYlgDuuIMtS6rbtQHeYuzB153dsauUe0yORK2xe8yJrTCWMM60TvWj3G79Jh_vt7lvfWkdcZVUvpr-S0lo685v4Y1eoPZzM4N3eo9KiOwuo2BdzVl7GBM6qQIcD7swMIEEEFBQ8Weui0AVnFu4LvQwWQMHt_j_j_AAAA__8ljcBo	Get hash	malicious	Unknown	Browse
	a#U77e5.docx	Get hash	malicious	Unknown	Browse
	Inv_Doc_18#908.pdf	Get hash	malicious	Unknown	Browse
	https://alie.kr/8IuPro4	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7484_659994726\LICENSE

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	5.11458514637545
Encrypted:	false
SSDEEP:	48:OBOCrYJ4rYJVwUCLHDy43HV713XEyMmZ3teTHn:LCrYJ4rYJVwUCHZ3Z13XtdUTH
MD5:	EE002CB9E51BB8DFA89640A406A1090A
SHA1:	49EE3AD535947D8821FFDEB67FFC9BC37D1EBBB2
SHA-256:	3DBD2C90050B652D63656481C3E5871C52261575292DB77D4EA63419F187A55B
SHA-512:	D1FDCC436B8CA8C68D4DC7077F84F803A535BF2CE31D9EB5D0C466B62D6567B2C59974995060403ED757E92245DB07E70C6BDDBF1C3519FED300CC5B9BF9177C
Malicious:	false
Reputation:	high, very likely benign file
Preview:	// Copyright 2015 The Chromium Authors. All rights reserved..//.// Redistribution and use in source and binary forms, with or without.// modification, are permitted provided that the following conditions are.// met:.//.// * Redistributions of source code must retain the above copyright.// notice, this list of conditions and the following disclaimer..// * Redistributions in binary form must reproduce the above.// copyright notice, this list of conditions and the following disclaimer.// in the documentation and/or other materials provided with the.// distribution..// * Neither the name of Google Inc. nor the names of its.// contributors may be used to endorse or promote products derived from.// this software without specific prior written permission..//.// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT.// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR.// A PARTICULAR

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7484_659994726\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	6.021127689065198
Encrypted:	false
SSDEEP:	48:p/hUI1atAdI567akUmYWEFw/3+ovGJ4F3jkZUbvzk98g5m7:RnYQI47avYUwvVGJ41jkZIzxgA7
MD5:	68E6B5733E04AB7BF19699A84D8ABBC2
SHA1:	1C11F06CA1AD3ED8116D356AB9164FD1D52B5CF0
SHA-256:	F095F969D6711F53F97747371C83D5D634EAEF21C54CB1A6A1CC5B816D633709
SHA-512:	9DC5D824A55C969820D5D1FBB0CA7773361F044AE0C255E7C48D994E16CE169FCEAC3DE180A3A544EBEF32337EA535683115584D592370E5FE7D85C68B86C891
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJMSUNFTlNFIiwicm9vdF9oYXNoIjoiUGIwc2tBVUxaUzFqWldTQnctV0hIRkltRlhVcExiZDlUcVkwR2ZHSHBWcyJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiIyNXB3SWdtQWU2QTVoeDVVTG9OV0laODBLbzJjbktOTHpacUdjbjlLT2c4In0seyJwYXRoIjoic2V0cy5qc29uIiwicm9vdF9oYXNoIjoiOWVza0FuRlBsM3VCQzkwUmFWakxNaVI3NXZIQi0wQUVmMmg0RzU3ZXNpcyJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6ImdvbnBlbWRna2pjZWNkZ2JuYWFiaXBwcGJtZ2ZnZ2JlIiwiaXRlbV92ZXJzaW9uIjoiMjAyNC44LjEwLjAiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"dU2MmRUQSugaJAJvEN4uaQHx-KXdOkjj0yK8_aH4Afr3kN7DPOZRt6yLTS3UchBE5M-dgPPPBuKADj4KEK4B22SO6WQquL5J27AUPqQBGgr44-iFGVJdOLLlfirFlJmcYv6DUFRYiPsQFGMr1JFqInj19jgkOxzR6qqcNuTCB0wGEMeTU80r-igCjeQG6TIzPro7yKd_-UxsxO6OGAySmlIJIoU54X0p0ATNoZyAfkhb8kb0oN8unOU

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7484_659994726\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.9159446964030753
Encrypted:	false
SSDEEP:	3:Sq5TQRaELVHecsUDBAeHD5k:Sq5gJ+csHej5k
MD5:	CFB54589424206D0AE6437B5673F498D
SHA1:	D1EF6314F0F68EFDD0BA8F6CA9E59BFF863B1609
SHA-256:	285AC183C35350B4B77332172413902F83726CA8F53D63859B5DA082FD425A1C
SHA-512:	70FDCA4A1E6B7A5FFED3414E2DB74FECA7E0FD17482B8CB30393DFEE20AB9AD2B0B00FF0C590DD0E8D744D0EAD876CE8844519AF66618ED14666BCA56DF2DA21
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1.dbf288588465463a914bdfc5e86d465fb3592b2f1261dc0e40fcc5c1adc8e7e4

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7484_659994726\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.4533115571544695
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFCmMARWHJqS1tean:F6VlM8aRWpqS1ln
MD5:	C3419069A1C30140B77045ABA38F12CF
SHA1:	11920F0C1E55CADC7D2893D1EEBB268B3459762A
SHA-256:	DB9A702209807BA039871E542E8356219F342A8D9C9CA34BCD9A86727F4A3A0F
SHA-512:	C5E95A4E9F5919CB14F4127539C4353A55C5F68062BF6F95E1843B6690CEBED3C93170BADB2412B7FB9F109A620385B0AE74783227D6813F26FF8C29074758A1
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "First Party Sets",. "version": "2024.8.10.0".}

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7484_659994726\sets.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9748
Entropy (8bit):	4.629326694042306
Encrypted:	false
SSDEEP:	96:Mon4mvC4qX19s1blbw/BNKLcxbdmf56MFJtRTGXvcxN43uP+8qJq:v5C4ql7BkIVmtRTGXvcxBsq
MD5:	EEA4913A6625BEB838B3E4E79999B627
SHA1:	1B4966850F1B117041407413B70BFA925FD83703
SHA-256:	20EF4DE871ECE3C5F14867C4AE8465999C7A2CC1633525E752320E61F78A373C
SHA-512:	31B1429A5FACD6787F6BB45216A4AB1C724C79438C18EBFA8C19CED83149C17783FD492A03197110A75AAF38486A9F58828CA30B58D41E0FE89DFE8BDFC8A004
Malicious:	false
Preview:	{"primary":"https://bild.de","associatedSites":["https://welt.de","https://autobild.de","https://computerbild.de","https://wieistmeineip.de"],"serviceSites":["https://www.asadcdn.com"]}.{"primary":"https://blackrock.com","associatedSites":["https://blackrockadvisorelite.it","https://cachematrix.com","https://efront.com","https://etfacademy.it","https://ishares.com"]}.{"primary":"https://cafemedia.com","associatedSites":["https://cardsayings.net","https://nourishingpursuits.com"]}.{"primary":"https://caracoltv.com","associatedSites":["https://noticiascaracol.com","https://bluradio.com","https://shock.co","https://bumbox.com","https://hjck.com"]}.{"primary":"https://carcostadvisor.com","ccTLDs":{"https://carcostadvisor.com":["https://carcostadvisor.be","https://carcostadvisor.fr"]}}.{"primary":"https://citybibleforum.org","associatedSites":["https://thirdspace.org.au"]}.{"primary":"https://cognitiveai.ru","associatedSites":["https://cognitive-ai.ru"]}.{"primary":"https://drimer.io","asso

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7484_821695454\Google.Widevine.CDM.dll

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2877728
Entropy (8bit):	6.868480682648069
Encrypted:	false
SSDEEP:	49152:GB6BoH5sOI2CHusbKOdskuoHHVjcY94RNETO2WYA4oPToqnQ3dK5zuqvGKGxofFo:M67hlnVjcYGRNETO2WYA4oLoqnJuZI5
MD5:	477C17B6448695110B4D227664AA3C48
SHA1:	949FF1136E0971A0176F6ADEA8ADCC0DD6030F22
SHA-256:	CB190E7D1B002A3050705580DD51EBA895A19EB09620BDD48D63085D5D88031E
SHA-512:	1E267B01A78BE40E7A02612B331B1D9291DA8E4330DEA10BF786ACBC69F25E0BAECE45FB3BAFE1F4389F420EBAA62373E4F035A45E34EADA6F72C7C61D2302ED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: a#U77e5.docx, Detection: malicious, Browse Filename: Inv_Doc_18#908.pdf, Detection: malicious, Browse Filename: , Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....fd.........." ......(..........A&.......................................,.......,...`A.........................................V......V......`,......`+..p....+. )...p,......D.8....................C.(.....(.8...........p\..............................text.....(.......(................. ..`.rdata..h.....(.......(.............@..@.data....l......&.................@....pdata...p...`+..r.................@..@.00cfg..(.....+......p+.............@..@.gxfg....$....+..&...r+.............@..@.retplnel.... ,.......+..................tls.........0,.......+.............@....voltbl.D....@,.......+................._RDATA.......P,.......+.............@..@.rsrc........`,.......+.............@..@.reloc.......p,.......+.............@..B........................................................................................................................................

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7484_821695454\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1778
Entropy (8bit):	6.02086725086136
Encrypted:	false
SSDEEP:	48:p/hCdQAdJjRkakCi0LXjX9mqjW6JmfQkNWQzXXf2gTs:RtQ1aaxXrjW6JuQEWQKas
MD5:	3E839BA4DA1FFCE29A543C5756A19BDF
SHA1:	D8D84AC06C3BA27CCEF221C6F188042B741D2B91
SHA-256:	43DAA4139D3ED90F4B4635BD4D32346EB8E8528D0D5332052FCDA8F7860DB729
SHA-512:	19B085A9CFEC4D6F1B87CC6BBEEB6578F9CBA014704D05C9114CFB0A33B2E7729AC67499048CB33823C884517CBBDC24AA0748A9BB65E9C67714E6116365F1AB
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJHb29nbGUuV2lkZXZpbmUuQ0RNLmRsbCIsInJvb3RfaGFzaCI6Im9ZZjVLQ2Z1ai1MYmdLYkQyWFdBS1E5Nkp1bTR1Q2dCZTRVeEpGSExSNWMifSx7InBhdGgiOiJtYW5pZmVzdC5qc29uIiwicm9vdF9oYXNoIjoiYk01YTJOU1d2RkY1LW9Tdml2eFdqdXVwZ05pblVGakdPQXRrLTBJcGpDZyJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6Im5laWZhb2luZGdnZmNqaWNmZmtncG1ubHBwZWZmYWJkIiwiaXRlbV92ZXJzaW9uIjoiMS4wLjI3MzguMCIsInByb3RvY29sX3ZlcnNpb24iOjF9","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"KTPeHzS0ybFaz3_br3ASYWHjb6Ctul92067u2JMwtNYYm-4KxLiSkJZNBIzhm6hNSEW2p5kUEvHD0TjhhFGCZnWm9titj2bqJayCOAGxZb5BO74JJCRfy5Kwr1KSS4nvocsZepnHBmCiG2OV3by-Lyf1h1uU3X3bDfD92O0vJzrA8rwL2LrwIk-BolLo5nlM0I_MZwg8DhZ8SFBu9GGRVB2XrailDrv4SgupFE9gqA1HY6kjRjoyoAHbRRxZdBNNt9IKNdxNyaF9NcNRY8dAedNQ9Tw3YNp5jB7R9lcjO4knn58RdH2h_GiJ4l96StcXA4e7cqbJ77P-c

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7484_821695454\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.974403644129192
Encrypted:	false
SSDEEP:	3:SLVV8T+WSq2ykFDJp9qBn:SLVqZS5p0B
MD5:	D30A5BBC00F7334EEDE0795D147B2E80
SHA1:	78F3A6995856854CAD0C524884F74E182F9C3C57
SHA-256:	A08C1BC41DE319392676C7389048D8B1C7424C4B74D2F6466BCF5732B8D86642
SHA-512:	DACF60E959C10A3499D55DC594454858343BF6A309F22D73BDEE86B676D8D0CED10E86AC95ECD78E745E8805237121A25830301680BD12BFC7122A82A885FF4B
Malicious:	false
Preview:	1.c900ba9a2d8318263fd43782ee6fd5fb50bad78bf0eb2c972b5922c458af45ed

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7484_821695454\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	145
Entropy (8bit):	4.595307058143632
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFooG+HhFFKS18CWjhXLXGPQ3TRpvF/FHddTcplFHddTcVYA:F6VlM5PpKS18hRIA
MD5:	BBC03E9C7C5944E62EFC9C660B7BD2B6
SHA1:	83F161E3F49B64553709994B048D9F597CDE3DC6
SHA-256:	6CCE5AD8D496BC5179FA84AF8AFC568EEBA980D8A75058C6380B64FB42298C28
SHA-512:	FB80F091468A299B5209ACC30EDAF2001D081C22C3B30AAD422CBE6FEA7E5FE36A67A8E000D5DD03A30C60C30391C85FA31F3931E804C351AB0A71E9A978CC0F
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "windows-mf-cdm",. "version": "1.0.2738.0",. "accept_arch": [. "x64",. "x86_64",. "x86_64h". ].}

Chrome Cache Entry: 155

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (681)
Category:	downloaded
Size (bytes):	4070
Entropy (8bit):	5.362700670482359
Encrypted:	false
SSDEEP:	96:GUpT+TmXtdW1qsHFcn7t7CnyWYvNTcLaQOw:lpT+qXW1PFcn7tGnyWY1TGb
MD5:	ED368A20CB303C0E7C6A3E6E43C2E14F
SHA1:	429A5C538B45221F80405163D1F87912DD73C05A
SHA-256:	93BA77AD4B11E0A70C0D36576F0DF24E27F50001EA02BAA6D357E034532D97F2
SHA-512:	DE74BBADE910475DD245FFEFD4E1FD10137DE710B1C920D33BA52554911496E1339EF3C1F6D9D315CBC98A60ABE5687A3E7D8BEE483708E18D25722E794BDBE9
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=A1yn5d,A7fCU,AvtSve,CMcBD,E87wgc,EEDORb,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,Ug7Xab,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZakeSe,ZfAoz,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,ebZ3mb,f8Gu1e,fKUV3e,gJzDyc,gychg,hc6Ubd,inNHtf,iyZMqd,kWgXee,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,y5vRwf,yDVVkb,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGbG-r9dBZftM0U0ZDPTNCqugT4jw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=sOXFj,q0xTif,ZZ4WUe"
Preview:	"use strict";_F_installCss(".N7rBcd{overflow-x:auto}sentinel{}");.this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.zg(_.dqa);._.k("sOXFj");.var ou=function(a){_.X.call(this,a.Fa)};_.J(ou,_.X);ou.Ba=_.X.Ba;ou.prototype.aa=function(a){return a()};_.iu(_.cqa,ou);._.l();._.k("oGtAuc");._.oya=new _.uf(_.dqa);._.l();._.k("q0xTif");.var iza=function(a){var b=function(d){_.Zn(d)&&(_.Zn(d).Gc=null,_.yu(d,null));d.XyHi9&&(d.XyHi9=null)};b(a);a=a.querySelectorAll("[c-wiz]");for(var c=0;c<a.length;c++)b(a[c])},Ku=function(a){_.et.call(this,a.Fa);this.Qa=this.dom=null;if(this.Vk()){var b=_.Jm(this.Mg(),[_.Om,_.Nm]);b=_.ri([b[_.Om],b[_.Nm]]).then(function(c){this.Qa=c[0];this.dom=c[1]},null,this);_.cu(this,b)}this.Ra=a.Xl.Hda};_.J(Ku,_.et);Ku.Ba=function(){return{Xl:{Hda:function(a){return _.Ye(a)}}}};Ku.prototype.yp=function(a){return this.Ra.yp(a)};.Ku.prototype.getData=function(a){return this.Ra.getData(a)};Ku.prototype.vp=function(){_.Ft(this.d

Chrome Cache Entry: 156

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1694)
Category:	downloaded
Size (bytes):	32499
Entropy (8bit):	5.361345284201954
Encrypted:	false
SSDEEP:	768:mLX1O+aL6fgyIiREM4RKmh90toLoTswtF3ATcbDR6kIsnJd9DPyMv/FI:U2M4oltoLoTswtFoc/tIsnXFLI
MD5:	D5C3FB8EAE24AB7E40009338B5078496
SHA1:	5638BF5986A6445A88CD79A9B690B744B126BEC2
SHA-256:	597C14D360D690BCFDC2B8D315E6BB8879AEF33DE6C30D274743079BDB63C6B0
SHA-512:	6AE434850D473BEF15AA694AB4862596982CDDA6BD3991991D3ADD8F4A5F61DFBF8756D0DA98B72EF083909D68CF7B6B148A6488E9381F92FBF15CCB20176A0E
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGbG-r9dBZftM0U0ZDPTNCqugT4jw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{.var qua=function(a,b){this.da=a;this.ea=b;if(!c){var c=new _.gp("//www.google.com/images/cleardot.gif");_.rp(c)}this.ka=c};_.h=qua.prototype;_.h.Vc=null;_.h.QY=1E4;_.h.Iz=!1;_.h.TP=0;_.h.qJ=null;_.h.DU=null;_.h.setTimeout=function(a){this.QY=a};_.h.start=function(){if(this.Iz)throw Error("dc");this.Iz=!0;this.TP=0;rua(this)};_.h.stop=function(){sua(this);this.Iz=!1};.var rua=function(a){a.TP++;navigator!==null&&"onLine"in navigator&&!navigator.onLine?_.om((0,_.eg)(a.JG,a,!1),0):(a.aa=new Image,a.aa.onload=(0,_.eg)(a.Xia,a),a.aa.onerror=(0,_.eg)(a.Wia,a),a.aa.onabort=(0,_.eg)(a.Via,a),a.qJ=_.om(a.Yia,a.QY,a),a.aa.src=String(a.ka))};_.h=qua.prototype;_.h.Xia=function(){this.JG(!0)};_.h.Wia=function(){this.JG(!1)};_.h.Via=function(){this.JG(!1)};_.h.Yia=function(){this.JG(!1)};._.h.JG=function(a){sua(this);a?(this.Iz=!1,this.da.call(this.ea,!0)):this.TP<=0?rua(this):(this.Iz=!1,

Chrome Cache Entry: 157

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (755)
Category:	downloaded
Size (bytes):	1416
Entropy (8bit):	5.299417038163051
Encrypted:	false
SSDEEP:	24:kMYD7JqrxsNL90YIzFK/Hb5eNhz1uktdDuvKKKGbLZ99GbSSF/ZR8OkdnprGJ:o7JopFN+ASCKKGbF99GbSS3RY7rw
MD5:	6AEAE74D22F7C2D9658B057EA5D85069
SHA1:	2F4644F53FB4E8EC4AFD49A31C55853F062D284C
SHA-256:	EBFE7B5A1020808B9A02667ECC0E7E460643CBDE84F0B9C410C70A91C9726667
SHA-512:	C43F067D649CBC3091B9878715F718E47CD753C860EBEB20CD387C325640C2EF3CA9556D0689852CEF667C8E83BF42568BEF33C8A92BC07FDB91CB7EA608162D
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=A1yn5d,A7fCU,AvtSve,CMcBD,E87wgc,EEDORb,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,Ug7Xab,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZfAoz,ZwDk9d,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,ebZ3mb,f8Gu1e,fKUV3e,gJzDyc,gychg,hc6Ubd,inNHtf,iyZMqd,kWgXee,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,y5vRwf,yDVVkb,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGbG-r9dBZftM0U0ZDPTNCqugT4jw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=P6sQOc"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("P6sQOc");.var MZa=!!(_.Nh[1]&16);var OZa=function(a,b,c,d,e){this.ea=a;this.ta=b;this.ka=c;this.Ca=d;this.Ga=e;this.aa=0;this.da=NZa(this)},PZa=function(a){var b={};_.Ma(a.hS(),function(e){b[e]=!0});var c=a.WR(),d=a.cS();return new OZa(a.XO(),c.aa()1E3,a.oR(),d.aa()1E3,b)},NZa=function(a){return Math.random()Math.min(a.taMath.pow(a.ka,a.aa),a.Ca)},HG=function(a,b){return a.aa>=a.ea?!1:b!=null?!!a.Ga[b]:!0};var IG=function(a){_.X.call(this,a.Fa);this.da=a.Ea.mV;this.ea=a.Ea.metadata;a=a.Ea.lga;this.fetch=a.fetch.bind(a)};_.J(IG,_.X);IG.Ba=function(){return{Ea:{mV:_.KZa,metadata:_.HZa,lga:_.AZa}}};IG.prototype.aa=function(a,b){if(this.ea.getType(a.Md())!==1)return _.Vm(a);var c=this.da.JU;return(c=c?PZa(c):null)&&HG(c)?_.mya(a,QZa(this,a,b,c)):_.Vm(a)};.var QZa=function(a,b,c,d){return c.then(function(e){return e},function(e){if(MZa)if(e instanceof _.qf){if(!e.status\|\|

Chrome Cache Entry: 158

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	5430
Entropy (8bit):	3.6534652184263736
Encrypted:	false
SSDEEP:	48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B
MD5:	F3418A443E7D841097C714D69EC4BCB8
SHA1:	49263695F6B0CDD72F45CF1B775E660FDC36C606
SHA-256:	6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770
SHA-512:	82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563
Malicious:	false
URL:	https://www.google.com/favicon.ico
Preview:	............ .h...&... .... .........(....... ..... ............................................0...................................................................................................................................v.].X.:.X.:.r.Y........................................q.X.S.4.S.4.S.4.S.4.S.4.S.4...X....................0........q.W.S.4.X.:.................J...A...g.........................K.H.V.8..........................F..B.....................,.......................................B..............................................B..B..B..B..B...u..........................................B..B..B..B..B...{.................5.......k...........................................................7R..8F.................................................2........Vb..5C..;I..................R^.....................0................Xc..5C..5C..5C..5C..5C..5C..lv..........................................]i..<J..:G..Zf....................................................

Chrome Cache Entry: 159

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3190)
Category:	downloaded
Size (bytes):	339369
Entropy (8bit):	5.533022690974177
Encrypted:	false
SSDEEP:	3072:9hFx8tVGv15Iyr4t4s2GvgHVTYDh+rvVvurtVEWzcLmLyszIm8j2kzU:9NlvE+zTYDh+rvh8cLMijFg
MD5:	FF16B667178352EFDF164CE3F16A8F55
SHA1:	E9B1BC661337502E31306B5E7AE37D93C0551455
SHA-256:	625EC33FBA1BFF3734490AC15C8430CDB5850E9159B80F607E093BB73B7F243B
SHA-512:	F197393CB05F94BCEDA0FE3176842E09CFCFC2348DE22C9815DD8369D5D333038E8F93F426994482E2E9731A859FA9B6B6062BAD4AA3BFD3C0730281C4CCADB9
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGbG-r9dBZftM0U0ZDPTNCqugT4jw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,XVq9Qb,STuCOe,njlZCf,m9oV,vjKJJ,y5vRwf,iyZMqd,NTMZac,mzzZzc,rCcCxc,vvMGie,NOeYWe,O6y8ed,L9OGUe,PrPYRd,MpJwZc,qPfo0c,cYShmd,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,WpP9Yc,lwddkf,gJzDyc,SpsfSb,aC1iue,tUnxGc,aW3pY,ZakeSe,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,MY7mZe,xBaz7b,GwYlN,eVCnO,EIOG1e,LDQI"
Preview:	"use strict";_F_installCss(".EE6QGf{border-bottom-style:solid;border-bottom-width:1px;padding:16px;width:100%;z-index:6;background:#fff;background:var(--gm3-sys-color-surface-container-lowest,#fff);border-color:#c4c7c5;border-color:var(--gm3-sys-color-outline-variant,#c4c7c5);display:block;position:relative}.EE6QGf~.S7xv8,.EE6QGf~.gfM9Zd{padding-top:inherit}@media (min-width:600px){.EE6QGf{align-items:center;display:flex;left:0;position:fixed;top:0}.EE6QGf~.S7xv8,.EE6QGf~.gfM9Zd{padding-top:150px}}@media (min-width:600px) and (orientation:landscape){.EE6QGf{display:block;position:relative}.EE6QGf~.S7xv8,.EE6QGf~.gfM9Zd{padding-top:inherit}}@media (min-width:960px) and (orientation:landscape){.EE6QGf{align-items:center;display:flex;left:0;position:fixed;top:0}.EE6QGf~.S7xv8,.EE6QGf~.gfM9Zd{padding-top:150px}}.PZB4Lc{display:flex;width:100%}.YLIzab{font-family:\"Google Sans\",roboto,\"Noto Sans Myanmar UI\",arial,sans-serif;font-size:1rem;font-weight:500;letter-spacing:0rem;line-height:1

Chrome Cache Entry: 160

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (683)
Category:	downloaded
Size (bytes):	3131
Entropy (8bit):	5.3750044852869046
Encrypted:	false
SSDEEP:	48:o7zfN/cD498xdg+Y5jNQ8js6npwk0OmNAEZbpMzR4EQBcW5QcHj9KWfGAeFKRrw:oCD9dA5jOEGh+EFqR4rhqUhzff9w
MD5:	39693D34EE3D1829DBB1627C4FC6687B
SHA1:	A03303C2F027F3749B48D5134D1F8FB3E495C6E9
SHA-256:	03B0C1B4E402E0BCF75D530DD9085B25357EEFD09E238453DE1F3A042542C076
SHA-512:	AC0749EDC33DA0EC0E40470388DD797B6528AD08B8FAC1C2AC42F85198131052BA1B533E90409D35DA237607E8B07D591FA6BA580B6A90B0D0AB2282A01F7585
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=A1yn5d,A7fCU,AvtSve,CMcBD,E87wgc,EEDORb,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,Ug7Xab,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZfAoz,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,ebZ3mb,f8Gu1e,fKUV3e,gJzDyc,gychg,hc6Ubd,inNHtf,iyZMqd,kWgXee,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,y5vRwf,yDVVkb,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGbG-r9dBZftM0U0ZDPTNCqugT4jw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("ZwDk9d");.var bA=function(a){_.X.call(this,a.Fa)};_.J(bA,_.X);bA.Ba=_.X.Ba;bA.prototype.wR=function(a){return _.af(this,{Wa:{HS:_.ol}}).then(function(b){var c=window._wjdd,d=window._wjdc;return!c&&d?new _.oi(function(e){window._wjdc=function(f){d(f);e(PJa(f,b,a))}}):PJa(c,b,a)})};var PJa=function(a,b,c){return(a=a&&a[c])?a:b.Wa.HS.wR(c)};.bA.prototype.aa=function(a,b){var c=_.csa(b).Gj;if(c.startsWith("$")){var d=_.jm.get(a);_.xq[b]&&(d\|\|(d={},_.jm.set(a,d)),d[c]=_.xq[b],delete _.xq[b],_.yq--);if(d)if(a=d[c])b=_.ef(a);else throw Error("Jb`"+b);else b=null}else b=null;return b};_.iu(_.Mfa,bA);._.l();._.k("SNUn3");._.OJa=new _.uf(_.Ag);._.l();._.k("RMhBfe");.var QJa=function(a){var b=_.wq(a);return b?new _.oi(function(c,d){var e=function(){b=_.wq(a);var f=_.Tfa(a,b);f?c(f.getAttribute("jsdata")):window.document.readyState=="complete"?(f=["Unable to find deferred jsdata wit

Chrome Cache Entry: 161

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 52280, version 1.0
Category:	downloaded
Size (bytes):	52280
Entropy (8bit):	7.995413196679271
Encrypted:	true
SSDEEP:	1536:1rvqtK8DZilXxwJ8mMwAZy7phqsFLdG3B4d:xytBZits8bw4wzbFxG3B4d
MD5:	F61F0D4D0F968D5BBA39A84C76277E1A
SHA1:	AA3693EA140ECA418B4B2A30F6A68F6F43B4BEB2
SHA-256:	57147F08949ABABE7DEEF611435AE418475A693E3823769A25C2A39B6EAD9CCC
SHA-512:	6C3BD90F709BCF9151C9ED9FFEA55C4F6883E7FDA2A4E26BF018C83FE1CFBE4F4AA0DB080D6D024070D53B2257472C399C8AC44EEFD38B9445640EFA85D5C487
Malicious:	false
URL:	https://fonts.gstatic.com/s/googlesans/v58/4UaRrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iq2vgCI.woff2
Preview:	wOF2.......8.....................................^...$..4?HVAR..?MVAR9.`?STAT.',..J/.......`..(..Z.0..R.6.$.... .....K..[..q..c..T.....>.P.j.`.w..#...%......N.".....$..3.0.6......... .L.rX/r[j.y.\|(.4.%#.....2.v.m..-..%.....;-.Y.{..&..O=#l@...k..7g..ZI...#.Z./+T..r7...M..3).Z%.x....s..sL..[A!.51w'/.8V..2Z..%.X.h.o.).]..9..Q`.$.....7..kZ.~O........d..g.n.d.Rw+&....Cz..uy#..fz,(.J....v.%..`..9.....h...?O..:...c%.....6s....xl..#...5..._......1.>.)"U.4 W....?%......6//!$...!.n9C@n...........!""^.....W..Z<.7.x.."UT.T....E.."R>.R..t.....H d..e_.K../.+8.Q.P.ZQ....;...U....]......._.e......71.?.7.ORv.?...l...G\|.P...\|:...I.X..2.,.L........d.g.]}W#uW]QnuP-s.;.-Y.....].......C..j_.M0...y.......J..........NY..@A...,....-.F......'..w./j5g.vUS...U..0.&...y7.LP.....%.....Y......Y..D. e.A..G.?.$.......6...eaK.n5.m...N...,...+BCl..L> .E9~.b[.w.x....6<...}.e...%V....O.......*.?...a..#[eE.4..p..$...].....%......o._......N.._~..El....b..A.0.r8.....\|..D.d..

Chrome Cache Entry: 162

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (468)
Category:	downloaded
Size (bytes):	1858
Entropy (8bit):	5.253939888205379
Encrypted:	false
SSDEEP:	48:o7BNJfeFb8L3A6FHqIy5Z+d70OCzSfvi/3fM/r8ZQzRrw:oFuILhFHrVCz0vLZz9w
MD5:	10FF6F99E3228E96AFD6E2C30EF97C0A
SHA1:	4AE3DCB8D1F5A0C302D5BAD9DFF5050A7A5E8130
SHA-256:	95E5546E1C7F311D07BB5050CC456A973E43BCC4777BA6014757376016537679
SHA-512:	116C0B1CAC98A27044100005545AB66BE5F4801D75DC259093A9F145B3A4ACD8DC1C360AF525F6DC8421CD54B675A78023D2ED8B57F5946A3969543758C673C9
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=A1yn5d,A7fCU,AvtSve,CMcBD,E87wgc,EEDORb,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,Ug7Xab,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZfAoz,ZwDk9d,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,ebZ3mb,f8Gu1e,fKUV3e,gJzDyc,gychg,hc6Ubd,inNHtf,iyZMqd,kWgXee,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,y5vRwf,yDVVkb,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGbG-r9dBZftM0U0ZDPTNCqugT4jw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iAskyc,ziXSP"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("iAskyc");._.$Z=function(a){_.X.call(this,a.Fa);this.window=a.Ea.window.get();this.Mc=a.Ea.Mc};_.J(_.$Z,_.X);_.$Z.Ba=function(){return{Ea:{window:_.lu,Mc:_.vE}}};_.$Z.prototype.Mo=function(){};_.$Z.prototype.addEncryptionRecoveryMethod=function(){};_.a_=function(a){return(a==null?void 0:a.Go)\|\|function(){}};_.b_=function(a){return(a==null?void 0:a.N2)\|\|function(){}};_.OOb=function(a){return(a==null?void 0:a.Mp)\|\|function(){}};._.POb=function(a){return new Map(Array.from(a,function(b){var c=_.n(b);b=c.next().value;c=c.next().value;return[b,c.map(function(d){return{epoch:d.epoch,key:new Uint8Array(d.key)}})]}))};_.QOb=function(a){setTimeout(function(){throw a;},0)};_.$Z.prototype.WN=function(){return!0};_.iu(_.Dn,_.$Z);._.l();._.k("ziXSP");.var t_=function(a){_.$Z.call(this,a.Fa)};_.J(t_,_.$Z);t_.Ba=_.$Z.Ba;t_.prototype.Mo=function(a,b,c){var d;if((d=this.window.chrome)==nu

Chrome Cache Entry: 163

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3346)
Category:	downloaded
Size (bytes):	22827
Entropy (8bit):	5.420322672717721
Encrypted:	false
SSDEEP:	384:/jqdWXWfyA20UUjDE8BSUxDJs16KHvSN34kaHaN+587SaXD2mLR0H:/jqdWXAUUjDE84Wi6KPSKjHaN+58+0J2
MD5:	2B29741A316862EE788996DD29116DD5
SHA1:	9D5551916D4452E977C39B8D69CF88DF2AAA462B
SHA-256:	62955C853976B722EFBB4C116A10DB3FF54580EDD7495D280177550B8F4289AB
SHA-512:	6E37C3258F07F29909763728DADE0CD40A3602D55D9099F78B37756926FCF2A50008B82876B518FEAF3E56617F0F7D1D37A73C346A99A58E6AD8BCD6689E9B15
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGbG-r9dBZftM0U0ZDPTNCqugT4jw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.pu.prototype.da=_.ca(38,function(){return _.vj(this,3)});_.Vy=function(a,b){this.key=a;this.defaultValue=!1;this.flagName=b};_.Vy.prototype.ctor=function(a){return typeof a==="boolean"?a:this.defaultValue};_.Wy=function(){this.ka=!0;var a=_.Bj(_.jk(_.Fe("TSDtV",window),_.pya),_.pu,1,_.uj())[0];if(a){var b={};for(var c=_.n(_.Bj(a,_.qya,2,_.uj())),d=c.next();!d.done;d=c.next()){d=d.value;var e=_.Nj(d,1).toString();switch(_.xj(d,_.qu)){case 3:b[e]=_.Lj(d,_.pj(d,_.qu,3));break;case 2:b[e]=_.Nj(d,_.pj(d,_.qu,2));break;case 4:b[e]=_.Oj(d,_.pj(d,_.qu,4));break;case 5:b[e]=_.L(d,_.pj(d,_.qu,5));break;case 6:b[e]=_.Sj(d,_.kf,6,_.qu);break;default:throw Error("id`"+_.xj(d,_.qu));}}}else b={};this.ea=b;this.token=.a?a.da():null};_.Wy.prototype.aa=function(a){if(!this.ka\|\|a.key in this.ea)a=a.ctor(this.ea[a.key]);else if(_.Fe("nQyAE",window)){var b=_.sya(a.flagName);if(b===null)a=a.def

Chrome Cache Entry: 164

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2544)
Category:	downloaded
Size (bytes):	358292
Entropy (8bit):	5.622523467644739
Encrypted:	false
SSDEEP:	3072:sy/lJpABa9hEP2iyjV5ygVLdh3YB4qyhLD6Crjyp3Sm5pnrjtuo0MpLEKusgI8sw:TyTNoygVWyhoDAMpL5gI8seqfhP3p+L
MD5:	14049A4F8FB34A2FA52A0358C72B2F2E
SHA1:	680985BDBE3FA830B31A9F02D40AFE925C12E70E
SHA-256:	56C112F31C6F61735FE5EBD188AD0928406F04454AFEC139297328D3EE6540B4
SHA-512:	5637742A7E2936540D957BA8A09991478EF0D4C28A3DA92D5260C7D5DA7BFD20811AFA26C0B53DD88D4A536B3C40A21ACA3310EFC17508A1C806B76ACB320631
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,EFQ78c,EIOG1e,GwYlN,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,ZakeSe,_b,_tp,aC1iue,aW3pY,bSspM,byfTOb,cYShmd,eVCnO,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,lwddkf,m9oV,mzzZzc,n73qwf,njlZCf,oLggrd,qPfo0c,qmdT9,rCcCxc,siKnQd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,y5vRwf,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGbG-r9dBZftM0U0ZDPTNCqugT4jw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=K1ZKnb,ziZ8Mc,b3kMqb,mvkUhe,CMcBD,Fndnac,t2srLd,EN3i8d,z0u0L,xiZRqc"
Preview:	"use strict";_F_installCss(".r4WGQb{position:relative}.Dl08I>:first-child{margin-top:0}.Dl08I>:last-child{margin-bottom:0}.IzwVE{color:#1f1f1f;color:var(--gm3-sys-color-on-surface,#1f1f1f);font-family:\"Google Sans\",roboto,\"Noto Sans Myanmar UI\",arial,sans-serif;font-size:1.25rem;font-weight:400;letter-spacing:0rem;line-height:1.2}.l5PPKe{color:#1f1f1f;color:var(--gm3-sys-color-on-surface,#1f1f1f);font-size:1rem}.l5PPKe .dMNVAe{margin:0;padding:0}.l5PPKe>:first-child{margin-top:0;padding-top:0}.l5PPKe>:last-child{margin-bottom:0;padding-bottom:0}.Dl08I{margin:0;padding:0;position:relative}.Dl08I>.SmR8:only-child{padding-top:1px}.Dl08I>.SmR8:only-child::before{top:0}.Dl08I>.SmR8:not(first-child){padding-bottom:1px}.Dl08I>.SmR8::after{bottom:0}.Dl08I>.SmR8:only-child::before,.Dl08I>.SmR8::after{border-bottom:1px solid #c4c7c5;border-bottom:1px solid var(--gm3-sys-color-outline-variant,#c4c7c5);content:\"\";height:0;left:0;position:absolute;width:100%}.aZvCDf{margin-top:8px;margin-left

Chrome Cache Entry: 165

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	84
Entropy (8bit):	4.875266466142591
Encrypted:	false
SSDEEP:	3:DZFJu0+WVTBCq2Bjdw2KsJJuYHSKnZ:lFJuuVTBudw29nu4SKZ
MD5:	87B6333E98B7620EA1FF98D1A837A39E
SHA1:	105DE6815B0885357DE1414BFC0D77FCC9E924EF
SHA-256:	DCD3C133C5C40BECD4100BBE6EDAE84C9735E778E4234A5E8395C56FF8A733BA
SHA-512:	867D7943D813685FAA76394E53199750C55817E836FD19C933F74D11E9657CE66719A6D6B2E39EE1DE62358BCE364E38A55F4E138DF92337DE6985DDCD5D0994
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSHgmA6QC9dWevzxIFDRkBE_oSBQ3oIX6GEgUN05ioBw==?alt=proto
Preview:	Cj0KBw0ZARP6GgAKKQ3oIX6GGgQISxgCKhwIClIYCg5AIS4jJF8qLSY/Ky8lLBABGP////8PCgcN05ioBxoA

Chrome Cache Entry: 166

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (569)
Category:	downloaded
Size (bytes):	3471
Entropy (8bit):	5.5174491302699495
Encrypted:	false
SSDEEP:	96:ojAmjTJ/fJgpIcB7Fd2tilGBEMO/A6VxV08w:vUTJpgDJXM0ApJ
MD5:	2D999C87DD54C7FE6400D267C33FBB23
SHA1:	414C3A329C2760325EDBACBD7A221D7F8DBFEEE8
SHA-256:	76D55A1AFC1D39CB04D60EB04E45A538A0E75EE2871561C84CC89B1C13596BCC
SHA-512:	72D923BB71DD147139962FF8E2BD0E336E0F6409C212AC2F25387D0F3B4FC9365F5A6D40E2980BB1065534888362C97D6B7663E362D29166B5915D2A9DA7D238
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=A1yn5d,A7fCU,AvtSve,CMcBD,E87wgc,EEDORb,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,Ug7Xab,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZfAoz,ZwDk9d,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,ebZ3mb,f8Gu1e,fKUV3e,gJzDyc,gychg,hc6Ubd,iAskyc,inNHtf,iyZMqd,kWgXee,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,wg1P6b,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,y5vRwf,yDVVkb,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGbG-r9dBZftM0U0ZDPTNCqugT4jw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("Wt6vjf");.var Txa=function(){var a=_.Ke();return _.L(a,1)},Tt=function(a){this.Da=_.t(a,0,Tt.messageId)};_.J(Tt,_.w);Tt.prototype.Ha=function(){return _.Hj(this,1)};Tt.prototype.Va=function(a){return _.Yj(this,1,a)};Tt.messageId="f.bo";var Ut=function(){_.km.call(this)};_.J(Ut,_.km);Ut.prototype.ud=function(){this.jT=!1;Uxa(this);_.km.prototype.ud.call(this)};Ut.prototype.aa=function(){Vxa(this);if(this.hC)return Wxa(this),!1;if(!this.sV)return Vt(this),!0;this.dispatchEvent("p");if(!this.fP)return Vt(this),!0;this.jM?(this.dispatchEvent("r"),Vt(this)):Wxa(this);return!1};.var Xxa=function(a){var b=new _.gp(a.z4);a.WP!=null&&_.Mn(b,"authuser",a.WP);return b},Wxa=function(a){a.hC=!0;var b=Xxa(a),c="rt=r&f_uid="+_.sk(a.fP);_.fn(b,(0,_.eg)(a.ea,a),"POST",c)};.Ut.prototype.ea=function(a){a=a.target;Vxa(this);if(_.jn(a)){this.RJ=0;if(this.jM)this.hC=!1,this.dispatchEvent("r")

Chrome Cache Entry: 167

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (522)
Category:	downloaded
Size (bytes):	5049
Entropy (8bit):	5.317800104741948
Encrypted:	false
SSDEEP:	96:oHX9gPiPrfnHhsB0TR6kg1oDPJzLmM18Vh1z2fEZ54TZtnqj6w:EtEAr6BmPZtOeEvW/ncP
MD5:	CE53EF566B68CCF2D62FA044CFB0D138
SHA1:	F48EC60289F2B55E8B388601206888F8295B1EB1
SHA-256:	E6CC5114D92811D5DE0663266D4B63F367834AFA0FC3BAFA54F707038C59D010
SHA-512:	20B434881DE971E263669E6096C01665D4D35B0FBFF47D312A4A442645EE962A8CE6AD7E68246D4EE9691BD30D9B1DDCF7059226492E1B58CD3191B63B001E4D
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=A1yn5d,A7fCU,AvtSve,CMcBD,E87wgc,EEDORb,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,Mlhmy,MpJwZc,NOeYWe,NTMZac,NwH0H,O6y8ed,OTA3Ae,OmgaI,P6sQOc,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,Ug7Xab,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZDZcre,ZZ4WUe,ZakeSe,ZfAoz,ZwDk9d,_b,_tp,aC1iue,aW3pY,aurFic,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,ebZ3mb,f8Gu1e,fKUV3e,gJzDyc,gychg,hc6Ubd,iAskyc,inNHtf,iyZMqd,kWgXee,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,ovKuLd,pxq3x,q0xTif,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,w9hDv,ws9Tlc,xBaz7b,xQtZb,xUdipf,xiZRqc,y5vRwf,yDVVkb,yRXbo,ywOR5c,z0u0L,zbML3c,ziXSP,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGbG-r9dBZftM0U0ZDPTNCqugT4jw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=wg1P6b"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.$Ma=_.y("wg1P6b",[_.OA,_.Fn,_.Rn]);._.k("wg1P6b");.var M5a;M5a=_.oh(["aria-"]);._.mJ=function(a){_.Y.call(this,a.Fa);this.Ja=this.ta=this.aa=this.viewportElement=this.La=null;this.Tc=a.Ea.qf;this.ab=a.Ea.focus;this.Lc=a.Ea.Lc;this.ea=this.Ei();a=-1*parseInt(_.Fo(this.Ei().el(),"marginTop")\|\|"0",10);var b=parseInt(_.Fo(this.Ei().el(),"marginBottom")\|\|"0",10);this.Ta={top:a,right:0,bottom:b,left:0};a=_.gf(this.getData("isMenuDynamic"),!1);b=_.gf(this.getData("isMenuHoisted"),!1);this.Ga=a?1:b?2:0;this.ka=!1;this.Ca=1;this.Ga!==1&&(this.aa=this.Sa("U0exHf").children().Sc(0),_.fu(this,.N5a(this,this.aa.el())));_.mF(this.oa())&&(a=this.oa().el(),b=this.De.bind(this),a.__soy_skip_handler=b)};_.J(_.mJ,_.Y);_.mJ.Ba=function(){return{Ea:{qf:_.SE,focus:_.BE,Lc:_.mu}}};_.mJ.prototype.pF=function(a){var b=a.source;this.La=b;var c;((c=a.data)==null?0:c.Jy)?(a=a.data.Jy,this.Ca=a==="MOUS

Chrome Cache Entry: 168

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (553)
Category:	downloaded
Size (bytes):	603951
Entropy (8bit):	5.789949489744101
Encrypted:	false
SSDEEP:	3072:x0pApkygA62bwwdnO2YflNYhFGOizdGj008PpVVM96C5bMEPQUhts6FV8eKqtVAT:xlgNmwwdnOsF98oNGuQRAYqXsI1+
MD5:	036BC6CEC1912EAA63C716C2A7494AFC
SHA1:	C32891F55B0D7A86DCE1BDBB7B84DB21C2A09F4F
SHA-256:	1A6181C3DFAEE5919CE57152DCFFCDC4B151C5FB2969CFD62168C1711FF202CF
SHA-512:	0AAA2285D109114921B5FD8A15F9A3D1F218AF8C61054B3925965E6753F8A49B45798326EA986C4A6B6180B6C36292A4652E2BA730C7505684DAAA4B5C314675
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlGsNipZrCRRMFQh1-tVmHSsIDzQTA/m=_b,_tp"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x286081c4, 0x20469860, 0x1ce13c40, 0x51407a0, 0x1908, 0x0, 0x1b400000, 0x19a00000, 0x0, ]);./.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright Google LLC. SPDX-License-Identifier: Apache-2.0././.. Copyright 2024 Google, Inc. SPDX-License-Identifier: MIT././. SPDX-License-Identifier: Apache-2.0././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var baa,daa,Na,Ua,gaa,iaa,lb,qaa,xaa,Daa,Iaa,Laa,Mb,Maa,Rb,Vb,Wb,Naa,Oaa,Xb,Paa,Qaa,Raa,ac,Waa,Yaa,ic,jc,kc,cba,dba,hba,kba,mba,nba,rba,uba,oba,tba,sba,qba,pba,vba,zba,Dba,Eba,Bba,Kc,Lc,Hba,Jba,Nba,Oba,Pba,Qba,Mba,Rba,Tba,gd,Vba,Wba,Yba,$ba,Zba,bca,cca,dca,eca,gca,fca,ica,jca,kca,lca,oca,r

Chrome Cache Entry: 169

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (533)
Category:	downloaded
Size (bytes):	9210
Entropy (8bit):	5.3872171131917925
Encrypted:	false
SSDEEP:	192:FK/pAzN7GZ068Hqhqu6DQaVapzYjgKItwdiwUsYRTi1j1t9bRl9:FqI7GZ04dRYjghtgisYYbt9ll9
MD5:	AB70454DE18E1CE16E61EAC290FC304D
SHA1:	68532B5E8B262D7E14B8F4507AA69A61146B3C18
SHA-256:	B32D746867CC4FA21FD39437502F401D952D0A3E8DC708DFB7D58B85F256C0F1
SHA-512:	A123C517380BEF0B47F23A5A6E1D16650FE39D9C701F9FA5ADD79294973C118E8EA3A7BA32CB63C3DFC0CE0F843FB86BFFCAA2AAE987629E7DFF84F176DEBB98
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,CMcBD,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,byfTOb,cYShmd,eVCnO,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,qPfo0c,qmdT9,rCcCxc,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGbG-r9dBZftM0U0ZDPTNCqugT4jw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,SD8Jgb,rmumx,E87wgc,qPYxq,Tbb4sb,pxq3x,f8Gu1e,soHxf,YgOFye,yRXbo,bTi8wc,ywOR5c,PHUIyb"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.gNa=_.y("SD8Jgb",[]);._.QX=function(a,b){if(typeof b==="string")a.Nc(b);else if(b instanceof _.Ip&&b.ia&&b.ia===_.B)b=_.$a(b.ww()),a.empty().append(b);else if(b instanceof _.Wa)b=_.$a(b),a.empty().append(b);else if(b instanceof Node)a.empty().append(b);else throw Error("Vf");};_.RX=function(a){var b=_.Lo(a,"[jsslot]");if(b.size()>0)return b;b=new _.Jo([_.Qk("span")]);_.Mo(b,"jsslot","");a.empty().append(b);return b};_.TKb=function(a){return a===null\|\|typeof a==="string"&&_.Ki(a)};._.k("SD8Jgb");._.WX=function(a){_.Y.call(this,a.Fa);this.Ua=a.controller.Ua;this.kd=a.controllers.kd[0]\|\|null;this.header=a.controller.header;this.nav=a.controller.nav;var b;(b=this.oa().find("button:not([type])").el())==null\|\|b.setAttribute("type","button")};_.J(_.WX,_.Y);_.WX.Ba=function(){return{controller:{Ua:{jsname:"n7vHCb",ctor:_.hv},header:{jsname:"tJHJj",ctor:_.hv},nav:{jsname:"DH6Rkf",ct

Chrome Cache Entry: 170

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (395)
Category:	downloaded
Size (bytes):	1652
Entropy (8bit):	5.296387798840289
Encrypted:	false
SSDEEP:	48:o7YNJvl3WlDQENrpB3stYCIgMxILNH/wf7DVTBpdQrw:o5fpB8iDwYlGw
MD5:	F18EA2D35027D6173E2864B5863CB6E3
SHA1:	1979174E786593DAFD2B23084F26332AB929216C
SHA-256:	547E151C2D842255451D651B749239B28DED9F803B524A77BD1E14D878BDAF58
SHA-512:	A031A439A99BCA557951A75234766033145E7D05E8453A4FE9BC0EA091E49BA59AF1479850D1E896B2D114575A80CCE111A787E7EEA9A7F288C78AD325436C18
Malicious:	false
URL:	"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en._s1fC-CLCMs.es5.O/ck=boq-identity.AccountsSignInUi.gkspycgpiCY.L.B1.O/am=xIFgKBimEQjEE86BHlAUCBkAAAAAAAAAALQBAIBm/d=1/exm=AvtSve,CMcBD,E87wgc,EFQ78c,EIOG1e,EN3i8d,Fndnac,GwYlN,I6YDgd,IZT63,K0PMbc,K1ZKnb,KUM7Z,L1AAkb,L9OGUe,LDQI,LEikZe,MY7mZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,RqjULd,SCuOPb,SD8Jgb,STuCOe,SpsfSb,Tbb4sb,UUJqVe,Uas9Hd,WpP9Yc,XVq9Qb,YHI3We,YTxL4,YgOFye,ZakeSe,_b,_tp,aC1iue,aW3pY,b3kMqb,bSspM,bTi8wc,byfTOb,cYShmd,eVCnO,f8Gu1e,gJzDyc,hc6Ubd,inNHtf,iyZMqd,lsjVmc,ltDFwf,lwddkf,m9oV,mvkUhe,mzzZzc,n73qwf,njlZCf,oLggrd,pxq3x,qPYxq,qPfo0c,qmdT9,rCcCxc,rmumx,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,vjKJJ,vvMGie,ws9Tlc,xBaz7b,xQtZb,xiZRqc,y5vRwf,yRXbo,ywOR5c,z0u0L,zbML3c,ziZ8Mc,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlGbG-r9dBZftM0U0ZDPTNCqugT4jw/ee=ASJRFf:DAnQ7e;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:GwYlN;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;UpnZUd:nnwwYc;Uvc8o:VDovNc;XdiAjb:NLiXbe;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:vfuNJf;lOO0Vd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:L9OGUe;qafBPd:yDVVkb;qddgKe:xQtZb;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=xUdipf,OTA3Ae,A1yn5d,fKUV3e,aurFic,Ug7Xab,NwH0H,OmgaI,gychg,w9hDv,EEDORb,Mlhmy,ZfAoz,kWgXee,ovKuLd,yDVVkb,ebZ3mb,ZDZcre,A7fCU"
Preview:	"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi\|\|{};(function(_){var window=this;.try{._.k("w9hDv");._.zg(_.Kla);_.$z=function(a){_.X.call(this,a.Fa);this.aa=a.Wa.cache};_.J(_.$z,_.X);_.$z.Ba=function(){return{Wa:{cache:_.Zs}}};_.$z.prototype.execute=function(a){_.Gb(a,function(b){var c;_.df(b)&&(c=b.eb.jc(b.jb));c&&this.aa.oG(c)},this);return{}};_.iu(_.Qla,_.$z);._.l();._.k("lOO0Vd");._.HZa=new _.uf(_.Km);._.l();._.k("ZDZcre");.var ZG=function(a){_.X.call(this,a.Fa);this.Nl=a.Ea.Nl;this.G3=a.Ea.metadata;this.aa=a.Ea.Ws};_.J(ZG,_.X);ZG.Ba=function(){return{Ea:{Nl:_.DG,metadata:_.HZa,Ws:_.AG}}};ZG.prototype.execute=function(a){var b=this;a=this.aa.create(a);return _.Gb(a,function(c){var d=b.G3.getType(c.Md())===2?b.Nl.Pb(c):b.Nl.fetch(c);return _.Jl(c,_.EG)?d.then(function(e){return _.Jd(e)}):d},this)};_.iu(_.Vla,ZG);._.l();._.k("K5nYTd");._.GZa=new _.uf(_.Rla);._.l();._.k("sP4Vbe");.._.l();._.k("kMFpHd");.._.l();._.k("A7fCU");.var GG=function(a){_.X.call(this,a

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.036730316410912
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'167'360 bytes
MD5:	4d4ce788750f2f654e42e6bfccde419c
SHA1:	33f56a257b9af1d77c085413be668c5d24f9b2e7
SHA256:	d8ee72c297423711a6580c3bbcaa8e335459fd111352cf024e662d363752097a
SHA512:	68869a12fe7203c3a13391c6cdc6ca271477c00a42dce3ba1ae03cfb214099ec627e01c4416dcf3d63cb030345433b138a12770020006c497deb682cb4c5e516
SSDEEP:	24576:vqDEvCTbMWu7rQYlBQcBiT6rprG8ar92+b+HdiJUK:vTvC/MTQYxsWR7ar92+b+HoJU
TLSH:	8945CF027391C062FF9B92734F5AF6115BBC69260123E61F13981DBABE701B1563E7A3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F66AF9 [Fri Sep 27 08:21:13 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007F6B7D385783h
jmp 00007F6B7D38508Fh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F6B7D38526Dh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F6B7D38523Ah
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007F6B7D387E2Dh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007F6B7D387E78h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007F6B7D387E61h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x46464	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x11b000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x46464	0x46600	6b40e5893997c17df36dbbb8c5b1f3b8	False	0.9059759380550622	data	7.844924514305071	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x11b000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xd4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xd4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xd5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xd6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xd69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xd8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xda038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xda4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xda4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xdaa84	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xdb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xdb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xdbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdc7b8	0x3d72c	data			1.0003416874592757
RT_GROUP_ICON	0x119ee4	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x119f5c	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x119f70	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x119f84	0x14	data	English	Great Britain	1.25
RT_VERSION	0x119f98	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x11a074	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 11:29:16.513195992 CEST	49674	443	192.168.2.7	104.98.116.138
Sep 27, 2024 11:29:16.513223886 CEST	49675	443	192.168.2.7	104.98.116.138
Sep 27, 2024 11:29:16.669471979 CEST	49672	443	192.168.2.7	104.98.116.138
Sep 27, 2024 11:29:18.154112101 CEST	49677	443	192.168.2.7	20.50.201.200
Sep 27, 2024 11:29:18.528851986 CEST	49677	443	192.168.2.7	20.50.201.200
Sep 27, 2024 11:29:18.950680017 CEST	49671	443	192.168.2.7	204.79.197.203
Sep 27, 2024 11:29:19.278805971 CEST	49677	443	192.168.2.7	20.50.201.200
Sep 27, 2024 11:29:20.778815031 CEST	49677	443	192.168.2.7	20.50.201.200
Sep 27, 2024 11:29:23.496731997 CEST	49701	443	192.168.2.7	142.250.186.46
Sep 27, 2024 11:29:23.496761084 CEST	443	49701	142.250.186.46	192.168.2.7
Sep 27, 2024 11:29:23.496810913 CEST	49701	443	192.168.2.7	142.250.186.46
Sep 27, 2024 11:29:23.547241926 CEST	49701	443	192.168.2.7	142.250.186.46
Sep 27, 2024 11:29:23.547266960 CEST	443	49701	142.250.186.46	192.168.2.7
Sep 27, 2024 11:29:23.767832994 CEST	49677	443	192.168.2.7	20.50.201.200
Sep 27, 2024 11:29:24.188925028 CEST	443	49701	142.250.186.46	192.168.2.7
Sep 27, 2024 11:29:24.189207077 CEST	49701	443	192.168.2.7	142.250.186.46
Sep 27, 2024 11:29:24.189239025 CEST	443	49701	142.250.186.46	192.168.2.7
Sep 27, 2024 11:29:24.189929962 CEST	443	49701	142.250.186.46	192.168.2.7
Sep 27, 2024 11:29:24.189992905 CEST	49701	443	192.168.2.7	142.250.186.46
Sep 27, 2024 11:29:24.191373110 CEST	443	49701	142.250.186.46	192.168.2.7
Sep 27, 2024 11:29:24.191426992 CEST	49701	443	192.168.2.7	142.250.186.46
Sep 27, 2024 11:29:24.192312956 CEST	49701	443	192.168.2.7	142.250.186.46
Sep 27, 2024 11:29:24.192398071 CEST	443	49701	142.250.186.46	192.168.2.7
Sep 27, 2024 11:29:24.192473888 CEST	49701	443	192.168.2.7	142.250.186.46
Sep 27, 2024 11:29:24.192481995 CEST	443	49701	142.250.186.46	192.168.2.7
Sep 27, 2024 11:29:24.246993065 CEST	49701	443	192.168.2.7	142.250.186.46
Sep 27, 2024 11:29:24.468565941 CEST	443	49701	142.250.186.46	192.168.2.7
Sep 27, 2024 11:29:24.468668938 CEST	443	49701	142.250.186.46	192.168.2.7
Sep 27, 2024 11:29:24.468803883 CEST	49701	443	192.168.2.7	142.250.186.46
Sep 27, 2024 11:29:24.469541073 CEST	49701	443	192.168.2.7	142.250.186.46
Sep 27, 2024 11:29:24.469568968 CEST	443	49701	142.250.186.46	192.168.2.7
Sep 27, 2024 11:29:24.480140924 CEST	49705	443	192.168.2.7	142.250.185.110
Sep 27, 2024 11:29:24.480181932 CEST	443	49705	142.250.185.110	192.168.2.7
Sep 27, 2024 11:29:24.480375051 CEST	49705	443	192.168.2.7	142.250.185.110
Sep 27, 2024 11:29:24.480565071 CEST	49705	443	192.168.2.7	142.250.185.110
Sep 27, 2024 11:29:24.480583906 CEST	443	49705	142.250.185.110	192.168.2.7
Sep 27, 2024 11:29:25.112268925 CEST	443	49705	142.250.185.110	192.168.2.7
Sep 27, 2024 11:29:25.112574100 CEST	49705	443	192.168.2.7	142.250.185.110
Sep 27, 2024 11:29:25.112590075 CEST	443	49705	142.250.185.110	192.168.2.7
Sep 27, 2024 11:29:25.113161087 CEST	443	49705	142.250.185.110	192.168.2.7
Sep 27, 2024 11:29:25.113230944 CEST	49705	443	192.168.2.7	142.250.185.110
Sep 27, 2024 11:29:25.114201069 CEST	443	49705	142.250.185.110	192.168.2.7
Sep 27, 2024 11:29:25.114312887 CEST	49705	443	192.168.2.7	142.250.185.110
Sep 27, 2024 11:29:25.115418911 CEST	49705	443	192.168.2.7	142.250.185.110
Sep 27, 2024 11:29:25.115518093 CEST	443	49705	142.250.185.110	192.168.2.7
Sep 27, 2024 11:29:25.115672112 CEST	49705	443	192.168.2.7	142.250.185.110
Sep 27, 2024 11:29:25.115690947 CEST	443	49705	142.250.185.110	192.168.2.7
Sep 27, 2024 11:29:25.327409029 CEST	443	49705	142.250.185.110	192.168.2.7
Sep 27, 2024 11:29:25.327500105 CEST	49705	443	192.168.2.7	142.250.185.110
Sep 27, 2024 11:29:25.425338030 CEST	443	49705	142.250.185.110	192.168.2.7
Sep 27, 2024 11:29:25.425365925 CEST	443	49705	142.250.185.110	192.168.2.7
Sep 27, 2024 11:29:25.425429106 CEST	49705	443	192.168.2.7	142.250.185.110
Sep 27, 2024 11:29:25.425446033 CEST	443	49705	142.250.185.110	192.168.2.7
Sep 27, 2024 11:29:25.426074982 CEST	443	49705	142.250.185.110	192.168.2.7
Sep 27, 2024 11:29:25.426129103 CEST	49705	443	192.168.2.7	142.250.185.110
Sep 27, 2024 11:29:25.576018095 CEST	49705	443	192.168.2.7	142.250.185.110
Sep 27, 2024 11:29:25.576057911 CEST	443	49705	142.250.185.110	192.168.2.7
Sep 27, 2024 11:29:26.122008085 CEST	49674	443	192.168.2.7	104.98.116.138
Sep 27, 2024 11:29:26.123375893 CEST	49675	443	192.168.2.7	104.98.116.138
Sep 27, 2024 11:29:26.278346062 CEST	49672	443	192.168.2.7	104.98.116.138
Sep 27, 2024 11:29:26.772301912 CEST	49709	443	192.168.2.7	142.250.186.68
Sep 27, 2024 11:29:26.772344112 CEST	443	49709	142.250.186.68	192.168.2.7
Sep 27, 2024 11:29:26.772433043 CEST	49709	443	192.168.2.7	142.250.186.68
Sep 27, 2024 11:29:26.772686005 CEST	49709	443	192.168.2.7	142.250.186.68
Sep 27, 2024 11:29:26.772703886 CEST	443	49709	142.250.186.68	192.168.2.7
Sep 27, 2024 11:29:27.412765980 CEST	443	49709	142.250.186.68	192.168.2.7
Sep 27, 2024 11:29:27.413083076 CEST	49709	443	192.168.2.7	142.250.186.68
Sep 27, 2024 11:29:27.413101912 CEST	443	49709	142.250.186.68	192.168.2.7
Sep 27, 2024 11:29:27.414225101 CEST	443	49709	142.250.186.68	192.168.2.7
Sep 27, 2024 11:29:27.414304018 CEST	49709	443	192.168.2.7	142.250.186.68
Sep 27, 2024 11:29:27.415369987 CEST	49709	443	192.168.2.7	142.250.186.68
Sep 27, 2024 11:29:27.415477991 CEST	443	49709	142.250.186.68	192.168.2.7
Sep 27, 2024 11:29:27.465821028 CEST	49709	443	192.168.2.7	142.250.186.68
Sep 27, 2024 11:29:27.465837002 CEST	443	49709	142.250.186.68	192.168.2.7
Sep 27, 2024 11:29:27.512644053 CEST	49709	443	192.168.2.7	142.250.186.68
Sep 27, 2024 11:29:28.492841959 CEST	49712	443	192.168.2.7	184.28.90.27
Sep 27, 2024 11:29:28.492901087 CEST	443	49712	184.28.90.27	192.168.2.7
Sep 27, 2024 11:29:28.493160963 CEST	49712	443	192.168.2.7	184.28.90.27
Sep 27, 2024 11:29:28.494836092 CEST	49712	443	192.168.2.7	184.28.90.27
Sep 27, 2024 11:29:28.494862080 CEST	443	49712	184.28.90.27	192.168.2.7
Sep 27, 2024 11:29:28.562370062 CEST	49671	443	192.168.2.7	204.79.197.203
Sep 27, 2024 11:29:28.731858969 CEST	443	49698	104.98.116.138	192.168.2.7
Sep 27, 2024 11:29:28.731957912 CEST	49698	443	192.168.2.7	104.98.116.138
Sep 27, 2024 11:29:29.241168022 CEST	443	49712	184.28.90.27	192.168.2.7
Sep 27, 2024 11:29:29.241251945 CEST	49712	443	192.168.2.7	184.28.90.27
Sep 27, 2024 11:29:29.244950056 CEST	49712	443	192.168.2.7	184.28.90.27
Sep 27, 2024 11:29:29.244976044 CEST	443	49712	184.28.90.27	192.168.2.7
Sep 27, 2024 11:29:29.245234966 CEST	443	49712	184.28.90.27	192.168.2.7
Sep 27, 2024 11:29:29.292494059 CEST	49712	443	192.168.2.7	184.28.90.27
Sep 27, 2024 11:29:29.339413881 CEST	443	49712	184.28.90.27	192.168.2.7
Sep 27, 2024 11:29:29.511322021 CEST	443	49712	184.28.90.27	192.168.2.7
Sep 27, 2024 11:29:29.511404037 CEST	443	49712	184.28.90.27	192.168.2.7
Sep 27, 2024 11:29:29.511455059 CEST	49712	443	192.168.2.7	184.28.90.27
Sep 27, 2024 11:29:29.511583090 CEST	49712	443	192.168.2.7	184.28.90.27
Sep 27, 2024 11:29:29.511603117 CEST	443	49712	184.28.90.27	192.168.2.7
Sep 27, 2024 11:29:29.511616945 CEST	49712	443	192.168.2.7	184.28.90.27
Sep 27, 2024 11:29:29.511624098 CEST	443	49712	184.28.90.27	192.168.2.7
Sep 27, 2024 11:29:29.552614927 CEST	49714	443	192.168.2.7	184.28.90.27
Sep 27, 2024 11:29:29.552666903 CEST	443	49714	184.28.90.27	192.168.2.7
Sep 27, 2024 11:29:29.552730083 CEST	49714	443	192.168.2.7	184.28.90.27
Sep 27, 2024 11:29:29.553139925 CEST	49714	443	192.168.2.7	184.28.90.27
Sep 27, 2024 11:29:29.553152084 CEST	443	49714	184.28.90.27	192.168.2.7
Sep 27, 2024 11:29:29.727377892 CEST	49677	443	192.168.2.7	20.50.201.200
Sep 27, 2024 11:29:30.195441961 CEST	443	49714	184.28.90.27	192.168.2.7
Sep 27, 2024 11:29:30.195782900 CEST	49714	443	192.168.2.7	184.28.90.27
Sep 27, 2024 11:29:30.198930979 CEST	49714	443	192.168.2.7	184.28.90.27
Sep 27, 2024 11:29:30.198951006 CEST	443	49714	184.28.90.27	192.168.2.7
Sep 27, 2024 11:29:30.199265003 CEST	443	49714	184.28.90.27	192.168.2.7
Sep 27, 2024 11:29:30.200392962 CEST	49714	443	192.168.2.7	184.28.90.27
Sep 27, 2024 11:29:30.243405104 CEST	443	49714	184.28.90.27	192.168.2.7
Sep 27, 2024 11:29:30.473082066 CEST	443	49714	184.28.90.27	192.168.2.7
Sep 27, 2024 11:29:30.473162889 CEST	443	49714	184.28.90.27	192.168.2.7
Sep 27, 2024 11:29:30.473261118 CEST	49714	443	192.168.2.7	184.28.90.27
Sep 27, 2024 11:29:30.481825113 CEST	49714	443	192.168.2.7	184.28.90.27
Sep 27, 2024 11:29:30.481846094 CEST	443	49714	184.28.90.27	192.168.2.7
Sep 27, 2024 11:29:30.481879950 CEST	49714	443	192.168.2.7	184.28.90.27
Sep 27, 2024 11:29:30.481885910 CEST	443	49714	184.28.90.27	192.168.2.7
Sep 27, 2024 11:29:32.337852955 CEST	49726	443	192.168.2.7	142.250.185.206
Sep 27, 2024 11:29:32.337893009 CEST	443	49726	142.250.185.206	192.168.2.7
Sep 27, 2024 11:29:32.337968111 CEST	49726	443	192.168.2.7	142.250.185.206
Sep 27, 2024 11:29:32.338255882 CEST	49726	443	192.168.2.7	142.250.185.206
Sep 27, 2024 11:29:32.338263988 CEST	443	49726	142.250.185.206	192.168.2.7
Sep 27, 2024 11:29:32.970491886 CEST	443	49726	142.250.185.206	192.168.2.7
Sep 27, 2024 11:29:32.970824957 CEST	49726	443	192.168.2.7	142.250.185.206
Sep 27, 2024 11:29:32.970848083 CEST	443	49726	142.250.185.206	192.168.2.7
Sep 27, 2024 11:29:32.971421957 CEST	443	49726	142.250.185.206	192.168.2.7
Sep 27, 2024 11:29:32.971509933 CEST	49726	443	192.168.2.7	142.250.185.206
Sep 27, 2024 11:29:32.972629070 CEST	443	49726	142.250.185.206	192.168.2.7
Sep 27, 2024 11:29:32.972692966 CEST	49726	443	192.168.2.7	142.250.185.206
Sep 27, 2024 11:29:32.973817110 CEST	49726	443	192.168.2.7	142.250.185.206
Sep 27, 2024 11:29:32.973926067 CEST	443	49726	142.250.185.206	192.168.2.7
Sep 27, 2024 11:29:32.974000931 CEST	49726	443	192.168.2.7	142.250.185.206
Sep 27, 2024 11:29:32.974011898 CEST	443	49726	142.250.185.206	192.168.2.7
Sep 27, 2024 11:29:33.029501915 CEST	49726	443	192.168.2.7	142.250.185.206
Sep 27, 2024 11:29:33.289228916 CEST	443	49726	142.250.185.206	192.168.2.7
Sep 27, 2024 11:29:33.289299965 CEST	443	49726	142.250.185.206	192.168.2.7
Sep 27, 2024 11:29:33.289347887 CEST	443	49726	142.250.185.206	192.168.2.7
Sep 27, 2024 11:29:33.289534092 CEST	49726	443	192.168.2.7	142.250.185.206
Sep 27, 2024 11:29:33.289561987 CEST	443	49726	142.250.185.206	192.168.2.7
Sep 27, 2024 11:29:33.295012951 CEST	443	49726	142.250.185.206	192.168.2.7
Sep 27, 2024 11:29:33.295141935 CEST	49726	443	192.168.2.7	142.250.185.206
Sep 27, 2024 11:29:33.295161009 CEST	443	49726	142.250.185.206	192.168.2.7
Sep 27, 2024 11:29:33.301222086 CEST	443	49726	142.250.185.206	192.168.2.7
Sep 27, 2024 11:29:33.301256895 CEST	443	49726	142.250.185.206	192.168.2.7
Sep 27, 2024 11:29:33.301323891 CEST	49726	443	192.168.2.7	142.250.185.206
Sep 27, 2024 11:29:33.301340103 CEST	443	49726	142.250.185.206	192.168.2.7
Sep 27, 2024 11:29:33.301386118 CEST	49726	443	192.168.2.7	142.250.185.206
Sep 27, 2024 11:29:33.307596922 CEST	443	49726	142.250.185.206	192.168.2.7
Sep 27, 2024 11:29:33.307687998 CEST	49726	443	192.168.2.7	142.250.185.206
Sep 27, 2024 11:29:33.313736916 CEST	443	49726	142.250.185.206	192.168.2.7
Sep 27, 2024 11:29:33.313821077 CEST	49726	443	192.168.2.7	142.250.185.206
Sep 27, 2024 11:29:33.313833952 CEST	443	49726	142.250.185.206	192.168.2.7
Sep 27, 2024 11:29:33.313886881 CEST	49726	443	192.168.2.7	142.250.185.206
Sep 27, 2024 11:29:33.375684977 CEST	443	49726	142.250.185.206	192.168.2.7
Sep 27, 2024 11:29:33.375745058 CEST	443	49726	142.250.185.206	192.168.2.7
Sep 27, 2024 11:29:33.375818968 CEST	49726	443	192.168.2.7	142.250.185.206
Sep 27, 2024 11:29:33.375848055 CEST	443	49726	142.250.185.206	192.168.2.7
Sep 27, 2024 11:29:33.375896931 CEST	49726	443	192.168.2.7	142.250.185.206
Sep 27, 2024 11:29:33.378465891 CEST	443	49726	142.250.185.206	192.168.2.7
Sep 27, 2024 11:29:33.378530979 CEST	49726	443	192.168.2.7	142.250.185.206
Sep 27, 2024 11:29:33.385934114 CEST	443	49726	142.250.185.206	192.168.2.7
Sep 27, 2024 11:29:33.386013031 CEST	49726	443	192.168.2.7	142.250.185.206
Sep 27, 2024 11:29:33.386029005 CEST	443	49726	142.250.185.206	192.168.2.7
Sep 27, 2024 11:29:33.386081934 CEST	49726	443	192.168.2.7	142.250.185.206
Sep 27, 2024 11:29:33.391012907 CEST	443	49726	142.250.185.206	192.168.2.7
Sep 27, 2024 11:29:33.391076088 CEST	49726	443	192.168.2.7	142.250.185.206
Sep 27, 2024 11:29:33.397166014 CEST	443	49726	142.250.185.206	192.168.2.7
Sep 27, 2024 11:29:33.397239923 CEST	49726	443	192.168.2.7	142.250.185.206
Sep 27, 2024 11:29:33.397249937 CEST	443	49726	142.250.185.206	192.168.2.7
Sep 27, 2024 11:29:33.403635025 CEST	443	49726	142.250.185.206	192.168.2.7
Sep 27, 2024 11:29:33.403717041 CEST	49726	443	192.168.2.7	142.250.185.206
Sep 27, 2024 11:29:33.403723955 CEST	443	49726	142.250.185.206	192.168.2.7
Sep 27, 2024 11:29:33.409774065 CEST	443	49726	142.250.185.206	192.168.2.7
Sep 27, 2024 11:29:33.409852028 CEST	49726	443	192.168.2.7	142.250.185.206
Sep 27, 2024 11:29:33.409859896 CEST	443	49726	142.250.185.206	192.168.2.7
Sep 27, 2024 11:29:33.409953117 CEST	443	49726	142.250.185.206	192.168.2.7
Sep 27, 2024 11:29:33.410000086 CEST	49726	443	192.168.2.7	142.250.185.206
Sep 27, 2024 11:29:33.410011053 CEST	443	49726	142.250.185.206	192.168.2.7
Sep 27, 2024 11:29:33.410018921 CEST	49726	443	192.168.2.7	142.250.185.206
Sep 27, 2024 11:29:33.410043001 CEST	49726	443	192.168.2.7	142.250.185.206
Sep 27, 2024 11:29:33.410059929 CEST	49726	443	192.168.2.7	142.250.185.206
Sep 27, 2024 11:29:33.468280077 CEST	49729	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:33.468313932 CEST	443	49729	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:33.468384027 CEST	49729	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:33.468610048 CEST	49729	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:33.468621969 CEST	443	49729	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:33.543870926 CEST	49731	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:33.543914080 CEST	443	49731	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:33.544008017 CEST	49731	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:33.553963900 CEST	49731	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:33.553991079 CEST	443	49731	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:34.099787951 CEST	443	49729	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:34.099999905 CEST	49729	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:34.100016117 CEST	443	49729	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:34.100577116 CEST	443	49729	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:34.100644112 CEST	49729	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:34.101612091 CEST	443	49729	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:34.101675034 CEST	49729	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:34.102638006 CEST	49729	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:34.102716923 CEST	443	49729	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:34.102931023 CEST	49729	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:34.102937937 CEST	443	49729	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:34.155210018 CEST	49729	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:34.213597059 CEST	443	49731	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:34.213984013 CEST	49731	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:34.214005947 CEST	443	49731	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:34.214517117 CEST	443	49731	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:34.214584112 CEST	49731	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:34.215567112 CEST	443	49731	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:34.215624094 CEST	49731	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:34.215862036 CEST	49731	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:34.215939045 CEST	443	49731	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:34.216274023 CEST	49731	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:34.216279984 CEST	443	49731	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:34.264276028 CEST	49731	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:34.376249075 CEST	443	49729	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:34.376449108 CEST	443	49729	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:34.376548052 CEST	49729	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:34.376799107 CEST	49729	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:34.376821041 CEST	443	49729	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:34.376830101 CEST	49729	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:34.376876116 CEST	49729	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:34.377813101 CEST	49734	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:34.377852917 CEST	443	49734	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:34.378051043 CEST	49734	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:34.378335953 CEST	49734	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:34.378350019 CEST	443	49734	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:34.495017052 CEST	443	49731	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:34.495290995 CEST	443	49731	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:34.495373011 CEST	49731	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:34.495644093 CEST	49731	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:34.495660067 CEST	443	49731	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:34.495671988 CEST	49731	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:34.495735884 CEST	49731	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:34.496682882 CEST	49735	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:34.496727943 CEST	443	49735	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:34.496813059 CEST	49735	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:34.497335911 CEST	49735	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:34.497354984 CEST	443	49735	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:35.037688971 CEST	443	49734	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:35.042185068 CEST	49734	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:35.042215109 CEST	443	49734	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:35.042778015 CEST	443	49734	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:35.042839050 CEST	49734	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:35.043832064 CEST	443	49734	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:35.043889999 CEST	49734	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:35.044755936 CEST	49734	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:35.044845104 CEST	443	49734	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:35.045058966 CEST	49734	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:35.045067072 CEST	443	49734	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:35.045084953 CEST	49734	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:35.091408014 CEST	443	49734	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:35.097506046 CEST	49734	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:35.144540071 CEST	443	49735	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:35.144931078 CEST	49735	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:35.144964933 CEST	443	49735	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:35.145348072 CEST	443	49735	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:35.145411015 CEST	49735	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:35.146056890 CEST	443	49735	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:35.146111965 CEST	49735	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:35.146338940 CEST	49735	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:35.146404982 CEST	443	49735	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:35.146639109 CEST	49735	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:35.146648884 CEST	443	49735	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:35.146677017 CEST	49735	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:35.186160088 CEST	49735	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:35.186172962 CEST	443	49735	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:35.329883099 CEST	443	49734	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:35.330058098 CEST	443	49734	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:35.330151081 CEST	49734	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:35.336628914 CEST	49734	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:35.336663961 CEST	443	49734	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:35.341912985 CEST	443	49735	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:35.342015982 CEST	443	49735	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:35.342078924 CEST	49735	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:35.342725039 CEST	49735	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:35.342741966 CEST	443	49735	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:35.840317965 CEST	49709	443	192.168.2.7	142.250.186.68
Sep 27, 2024 11:29:35.887398005 CEST	443	49709	142.250.186.68	192.168.2.7
Sep 27, 2024 11:29:36.106772900 CEST	443	49709	142.250.186.68	192.168.2.7
Sep 27, 2024 11:29:36.106825113 CEST	443	49709	142.250.186.68	192.168.2.7
Sep 27, 2024 11:29:36.106853962 CEST	443	49709	142.250.186.68	192.168.2.7
Sep 27, 2024 11:29:36.106884956 CEST	443	49709	142.250.186.68	192.168.2.7
Sep 27, 2024 11:29:36.106940031 CEST	49709	443	192.168.2.7	142.250.186.68
Sep 27, 2024 11:29:36.106951952 CEST	443	49709	142.250.186.68	192.168.2.7
Sep 27, 2024 11:29:36.106965065 CEST	49709	443	192.168.2.7	142.250.186.68
Sep 27, 2024 11:29:36.107017040 CEST	443	49709	142.250.186.68	192.168.2.7
Sep 27, 2024 11:29:36.107068062 CEST	49709	443	192.168.2.7	142.250.186.68
Sep 27, 2024 11:29:36.108253956 CEST	49709	443	192.168.2.7	142.250.186.68
Sep 27, 2024 11:29:36.108266115 CEST	443	49709	142.250.186.68	192.168.2.7
Sep 27, 2024 11:29:36.528703928 CEST	49739	443	192.168.2.7	52.165.165.26
Sep 27, 2024 11:29:36.528745890 CEST	443	49739	52.165.165.26	192.168.2.7
Sep 27, 2024 11:29:36.528847933 CEST	49739	443	192.168.2.7	52.165.165.26
Sep 27, 2024 11:29:36.530462027 CEST	49739	443	192.168.2.7	52.165.165.26
Sep 27, 2024 11:29:36.530476093 CEST	443	49739	52.165.165.26	192.168.2.7
Sep 27, 2024 11:29:37.140902042 CEST	49698	443	192.168.2.7	104.98.116.138
Sep 27, 2024 11:29:37.146311998 CEST	49742	443	192.168.2.7	104.98.116.138
Sep 27, 2024 11:29:37.146348953 CEST	443	49742	104.98.116.138	192.168.2.7
Sep 27, 2024 11:29:37.146425009 CEST	49742	443	192.168.2.7	104.98.116.138
Sep 27, 2024 11:29:37.146825075 CEST	443	49698	104.98.116.138	192.168.2.7
Sep 27, 2024 11:29:37.148439884 CEST	49742	443	192.168.2.7	104.98.116.138
Sep 27, 2024 11:29:37.148453951 CEST	443	49742	104.98.116.138	192.168.2.7
Sep 27, 2024 11:29:37.223407984 CEST	443	49739	52.165.165.26	192.168.2.7
Sep 27, 2024 11:29:37.223495960 CEST	49739	443	192.168.2.7	52.165.165.26
Sep 27, 2024 11:29:37.226382017 CEST	49739	443	192.168.2.7	52.165.165.26
Sep 27, 2024 11:29:37.226392984 CEST	443	49739	52.165.165.26	192.168.2.7
Sep 27, 2024 11:29:37.226720095 CEST	443	49739	52.165.165.26	192.168.2.7
Sep 27, 2024 11:29:37.278981924 CEST	49739	443	192.168.2.7	52.165.165.26
Sep 27, 2024 11:29:37.977226973 CEST	49739	443	192.168.2.7	52.165.165.26
Sep 27, 2024 11:29:38.023411036 CEST	443	49739	52.165.165.26	192.168.2.7
Sep 27, 2024 11:29:38.203303099 CEST	443	49739	52.165.165.26	192.168.2.7
Sep 27, 2024 11:29:38.203336954 CEST	443	49739	52.165.165.26	192.168.2.7
Sep 27, 2024 11:29:38.203346968 CEST	443	49739	52.165.165.26	192.168.2.7
Sep 27, 2024 11:29:38.203363895 CEST	443	49739	52.165.165.26	192.168.2.7
Sep 27, 2024 11:29:38.203375101 CEST	443	49739	52.165.165.26	192.168.2.7
Sep 27, 2024 11:29:38.203382015 CEST	443	49739	52.165.165.26	192.168.2.7
Sep 27, 2024 11:29:38.203418970 CEST	49739	443	192.168.2.7	52.165.165.26
Sep 27, 2024 11:29:38.203447104 CEST	443	49739	52.165.165.26	192.168.2.7
Sep 27, 2024 11:29:38.203459978 CEST	49739	443	192.168.2.7	52.165.165.26
Sep 27, 2024 11:29:38.203490973 CEST	49739	443	192.168.2.7	52.165.165.26
Sep 27, 2024 11:29:38.203507900 CEST	443	49739	52.165.165.26	192.168.2.7
Sep 27, 2024 11:29:38.203562975 CEST	49739	443	192.168.2.7	52.165.165.26
Sep 27, 2024 11:29:38.203569889 CEST	443	49739	52.165.165.26	192.168.2.7
Sep 27, 2024 11:29:38.204128981 CEST	443	49739	52.165.165.26	192.168.2.7
Sep 27, 2024 11:29:38.204184055 CEST	49739	443	192.168.2.7	52.165.165.26
Sep 27, 2024 11:29:38.899571896 CEST	49739	443	192.168.2.7	52.165.165.26
Sep 27, 2024 11:29:38.899616957 CEST	443	49739	52.165.165.26	192.168.2.7
Sep 27, 2024 11:29:38.899635077 CEST	49739	443	192.168.2.7	52.165.165.26
Sep 27, 2024 11:29:38.899641991 CEST	443	49739	52.165.165.26	192.168.2.7
Sep 27, 2024 11:29:41.327297926 CEST	49749	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:41.327342987 CEST	443	49749	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:41.327596903 CEST	49749	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:41.328612089 CEST	49749	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:41.328627110 CEST	443	49749	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:41.639635086 CEST	49677	443	192.168.2.7	20.50.201.200
Sep 27, 2024 11:29:41.992360115 CEST	443	49749	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:41.992641926 CEST	49749	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:41.992652893 CEST	443	49749	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:41.993036032 CEST	443	49749	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:41.993407011 CEST	49749	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:41.993474007 CEST	443	49749	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:41.993525028 CEST	49749	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:41.993535995 CEST	49749	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:41.993546963 CEST	443	49749	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:42.044351101 CEST	49749	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:42.292973042 CEST	443	49749	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:42.293133020 CEST	443	49749	216.58.206.78	192.168.2.7
Sep 27, 2024 11:29:42.293186903 CEST	49749	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:42.293962955 CEST	49749	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:29:42.293982029 CEST	443	49749	216.58.206.78	192.168.2.7
Sep 27, 2024 11:30:04.080990076 CEST	49750	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:30:04.081056118 CEST	443	49750	216.58.206.78	192.168.2.7
Sep 27, 2024 11:30:04.081132889 CEST	49750	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:30:04.082623959 CEST	49750	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:30:04.082659006 CEST	443	49750	216.58.206.78	192.168.2.7
Sep 27, 2024 11:30:04.267086983 CEST	49751	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:30:04.267143965 CEST	443	49751	216.58.206.78	192.168.2.7
Sep 27, 2024 11:30:04.267245054 CEST	49751	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:30:04.267554045 CEST	49751	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:30:04.267574072 CEST	443	49751	216.58.206.78	192.168.2.7
Sep 27, 2024 11:30:04.609896898 CEST	49752	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:30:04.609944105 CEST	443	49752	216.58.206.78	192.168.2.7
Sep 27, 2024 11:30:04.610013962 CEST	49752	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:30:04.610630035 CEST	49752	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:30:04.610645056 CEST	443	49752	216.58.206.78	192.168.2.7
Sep 27, 2024 11:30:04.747075081 CEST	443	49750	216.58.206.78	192.168.2.7
Sep 27, 2024 11:30:04.747566938 CEST	49750	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:30:04.747598886 CEST	443	49750	216.58.206.78	192.168.2.7
Sep 27, 2024 11:30:04.747987032 CEST	443	49750	216.58.206.78	192.168.2.7
Sep 27, 2024 11:30:04.748301029 CEST	49750	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:30:04.748368979 CEST	443	49750	216.58.206.78	192.168.2.7
Sep 27, 2024 11:30:04.748486996 CEST	49750	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:30:04.748522997 CEST	49750	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:30:04.748559952 CEST	443	49750	216.58.206.78	192.168.2.7
Sep 27, 2024 11:30:04.906548977 CEST	443	49751	216.58.206.78	192.168.2.7
Sep 27, 2024 11:30:04.906883001 CEST	49751	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:30:04.906919956 CEST	443	49751	216.58.206.78	192.168.2.7
Sep 27, 2024 11:30:04.907531977 CEST	443	49751	216.58.206.78	192.168.2.7
Sep 27, 2024 11:30:04.907924891 CEST	49751	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:30:04.908023119 CEST	443	49751	216.58.206.78	192.168.2.7
Sep 27, 2024 11:30:04.908124924 CEST	49751	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:30:04.908153057 CEST	49751	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:30:04.908166885 CEST	443	49751	216.58.206.78	192.168.2.7
Sep 27, 2024 11:30:05.034280062 CEST	443	49750	216.58.206.78	192.168.2.7
Sep 27, 2024 11:30:05.034413099 CEST	443	49750	216.58.206.78	192.168.2.7
Sep 27, 2024 11:30:05.034470081 CEST	49750	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:30:05.034789085 CEST	49750	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:30:05.034833908 CEST	443	49750	216.58.206.78	192.168.2.7
Sep 27, 2024 11:30:05.187783957 CEST	443	49751	216.58.206.78	192.168.2.7
Sep 27, 2024 11:30:05.187922001 CEST	443	49751	216.58.206.78	192.168.2.7
Sep 27, 2024 11:30:05.187987089 CEST	49751	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:30:05.188730955 CEST	49751	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:30:05.188746929 CEST	443	49751	216.58.206.78	192.168.2.7
Sep 27, 2024 11:30:05.247693062 CEST	443	49752	216.58.206.78	192.168.2.7
Sep 27, 2024 11:30:05.249408960 CEST	49752	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:30:05.249481916 CEST	443	49752	216.58.206.78	192.168.2.7
Sep 27, 2024 11:30:05.249789000 CEST	443	49752	216.58.206.78	192.168.2.7
Sep 27, 2024 11:30:05.249851942 CEST	49752	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:30:05.250494957 CEST	443	49752	216.58.206.78	192.168.2.7
Sep 27, 2024 11:30:05.250541925 CEST	49752	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:30:05.250690937 CEST	49752	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:30:05.250755072 CEST	443	49752	216.58.206.78	192.168.2.7
Sep 27, 2024 11:30:05.250955105 CEST	49752	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:30:05.250956059 CEST	49752	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:30:05.250966072 CEST	443	49752	216.58.206.78	192.168.2.7
Sep 27, 2024 11:30:05.295406103 CEST	443	49752	216.58.206.78	192.168.2.7
Sep 27, 2024 11:30:05.295742989 CEST	49752	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:30:05.446516991 CEST	443	49752	216.58.206.78	192.168.2.7
Sep 27, 2024 11:30:05.446692944 CEST	443	49752	216.58.206.78	192.168.2.7
Sep 27, 2024 11:30:05.446755886 CEST	49752	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:30:05.447081089 CEST	49752	443	192.168.2.7	216.58.206.78
Sep 27, 2024 11:30:05.447099924 CEST	443	49752	216.58.206.78	192.168.2.7
Sep 27, 2024 11:30:15.575884104 CEST	49753	443	192.168.2.7	52.165.165.26
Sep 27, 2024 11:30:15.575949907 CEST	443	49753	52.165.165.26	192.168.2.7
Sep 27, 2024 11:30:15.576127052 CEST	49753	443	192.168.2.7	52.165.165.26
Sep 27, 2024 11:30:15.576745033 CEST	49753	443	192.168.2.7	52.165.165.26
Sep 27, 2024 11:30:15.576756001 CEST	443	49753	52.165.165.26	192.168.2.7
Sep 27, 2024 11:30:16.274750948 CEST	443	49753	52.165.165.26	192.168.2.7
Sep 27, 2024 11:30:16.274816990 CEST	49753	443	192.168.2.7	52.165.165.26
Sep 27, 2024 11:30:16.278913021 CEST	49753	443	192.168.2.7	52.165.165.26
Sep 27, 2024 11:30:16.278930902 CEST	443	49753	52.165.165.26	192.168.2.7
Sep 27, 2024 11:30:16.279262066 CEST	443	49753	52.165.165.26	192.168.2.7
Sep 27, 2024 11:30:16.286740065 CEST	49753	443	192.168.2.7	52.165.165.26
Sep 27, 2024 11:30:16.331403017 CEST	443	49753	52.165.165.26	192.168.2.7
Sep 27, 2024 11:30:16.542629957 CEST	443	49753	52.165.165.26	192.168.2.7
Sep 27, 2024 11:30:16.542659998 CEST	443	49753	52.165.165.26	192.168.2.7
Sep 27, 2024 11:30:16.542679071 CEST	443	49753	52.165.165.26	192.168.2.7
Sep 27, 2024 11:30:16.542855978 CEST	49753	443	192.168.2.7	52.165.165.26
Sep 27, 2024 11:30:16.542892933 CEST	443	49753	52.165.165.26	192.168.2.7
Sep 27, 2024 11:30:16.542962074 CEST	49753	443	192.168.2.7	52.165.165.26
Sep 27, 2024 11:30:16.543694973 CEST	443	49753	52.165.165.26	192.168.2.7
Sep 27, 2024 11:30:16.543741941 CEST	443	49753	52.165.165.26	192.168.2.7
Sep 27, 2024 11:30:16.543770075 CEST	49753	443	192.168.2.7	52.165.165.26
Sep 27, 2024 11:30:16.543777943 CEST	443	49753	52.165.165.26	192.168.2.7
Sep 27, 2024 11:30:16.543827057 CEST	443	49753	52.165.165.26	192.168.2.7
Sep 27, 2024 11:30:16.543843031 CEST	49753	443	192.168.2.7	52.165.165.26
Sep 27, 2024 11:30:16.543886900 CEST	49753	443	192.168.2.7	52.165.165.26
Sep 27, 2024 11:30:16.545887947 CEST	49753	443	192.168.2.7	52.165.165.26
Sep 27, 2024 11:30:16.545907021 CEST	443	49753	52.165.165.26	192.168.2.7
Sep 27, 2024 11:30:16.545928001 CEST	49753	443	192.168.2.7	52.165.165.26
Sep 27, 2024 11:30:16.545934916 CEST	443	49753	52.165.165.26	192.168.2.7
Sep 27, 2024 11:30:19.869482040 CEST	443	49742	104.98.116.138	192.168.2.7
Sep 27, 2024 11:30:19.869612932 CEST	49742	443	192.168.2.7	104.98.116.138
Sep 27, 2024 11:30:26.145663023 CEST	56934	53	192.168.2.7	1.1.1.1
Sep 27, 2024 11:30:26.150515079 CEST	53	56934	1.1.1.1	192.168.2.7
Sep 27, 2024 11:30:26.150623083 CEST	56934	53	192.168.2.7	1.1.1.1
Sep 27, 2024 11:30:26.150645971 CEST	56934	53	192.168.2.7	1.1.1.1
Sep 27, 2024 11:30:26.155498028 CEST	53	56934	1.1.1.1	192.168.2.7
Sep 27, 2024 11:30:26.595166922 CEST	53	56934	1.1.1.1	192.168.2.7
Sep 27, 2024 11:30:26.596446991 CEST	56934	53	192.168.2.7	1.1.1.1
Sep 27, 2024 11:30:26.601737976 CEST	53	56934	1.1.1.1	192.168.2.7
Sep 27, 2024 11:30:26.601808071 CEST	56934	53	192.168.2.7	1.1.1.1
Sep 27, 2024 11:30:26.827198029 CEST	56938	443	192.168.2.7	142.250.186.68
Sep 27, 2024 11:30:26.827248096 CEST	443	56938	142.250.186.68	192.168.2.7
Sep 27, 2024 11:30:26.827327013 CEST	56938	443	192.168.2.7	142.250.186.68
Sep 27, 2024 11:30:26.828270912 CEST	56938	443	192.168.2.7	142.250.186.68
Sep 27, 2024 11:30:26.828293085 CEST	443	56938	142.250.186.68	192.168.2.7
Sep 27, 2024 11:30:27.458158970 CEST	443	56938	142.250.186.68	192.168.2.7
Sep 27, 2024 11:30:27.458470106 CEST	56938	443	192.168.2.7	142.250.186.68
Sep 27, 2024 11:30:27.458483934 CEST	443	56938	142.250.186.68	192.168.2.7
Sep 27, 2024 11:30:27.458925962 CEST	443	56938	142.250.186.68	192.168.2.7
Sep 27, 2024 11:30:27.459286928 CEST	56938	443	192.168.2.7	142.250.186.68
Sep 27, 2024 11:30:27.459356070 CEST	443	56938	142.250.186.68	192.168.2.7
Sep 27, 2024 11:30:27.513356924 CEST	56938	443	192.168.2.7	142.250.186.68
Sep 27, 2024 11:30:34.279483080 CEST	56939	443	192.168.2.7	142.250.181.238
Sep 27, 2024 11:30:34.279555082 CEST	443	56939	142.250.181.238	192.168.2.7
Sep 27, 2024 11:30:34.279676914 CEST	56939	443	192.168.2.7	142.250.181.238
Sep 27, 2024 11:30:34.279934883 CEST	56939	443	192.168.2.7	142.250.181.238
Sep 27, 2024 11:30:34.279966116 CEST	443	56939	142.250.181.238	192.168.2.7
Sep 27, 2024 11:30:34.918508053 CEST	443	56939	142.250.181.238	192.168.2.7
Sep 27, 2024 11:30:34.918848038 CEST	56939	443	192.168.2.7	142.250.181.238
Sep 27, 2024 11:30:34.918934107 CEST	443	56939	142.250.181.238	192.168.2.7
Sep 27, 2024 11:30:34.919327021 CEST	443	56939	142.250.181.238	192.168.2.7
Sep 27, 2024 11:30:34.919756889 CEST	56939	443	192.168.2.7	142.250.181.238
Sep 27, 2024 11:30:34.919835091 CEST	443	56939	142.250.181.238	192.168.2.7
Sep 27, 2024 11:30:34.919946909 CEST	56939	443	192.168.2.7	142.250.181.238
Sep 27, 2024 11:30:34.919985056 CEST	56939	443	192.168.2.7	142.250.181.238
Sep 27, 2024 11:30:34.919997931 CEST	443	56939	142.250.181.238	192.168.2.7
Sep 27, 2024 11:30:35.221709013 CEST	443	56939	142.250.181.238	192.168.2.7
Sep 27, 2024 11:30:35.222385883 CEST	443	56939	142.250.181.238	192.168.2.7
Sep 27, 2024 11:30:35.222450972 CEST	56939	443	192.168.2.7	142.250.181.238
Sep 27, 2024 11:30:35.224446058 CEST	56939	443	192.168.2.7	142.250.181.238
Sep 27, 2024 11:30:35.224493980 CEST	443	56939	142.250.181.238	192.168.2.7
Sep 27, 2024 11:30:35.254403114 CEST	56941	443	192.168.2.7	142.250.181.238
Sep 27, 2024 11:30:35.254441977 CEST	443	56941	142.250.181.238	192.168.2.7
Sep 27, 2024 11:30:35.254503012 CEST	56941	443	192.168.2.7	142.250.181.238
Sep 27, 2024 11:30:35.255760908 CEST	56941	443	192.168.2.7	142.250.181.238
Sep 27, 2024 11:30:35.255776882 CEST	443	56941	142.250.181.238	192.168.2.7
Sep 27, 2024 11:30:35.884414911 CEST	443	56941	142.250.181.238	192.168.2.7
Sep 27, 2024 11:30:35.884668112 CEST	56941	443	192.168.2.7	142.250.181.238
Sep 27, 2024 11:30:35.884680033 CEST	443	56941	142.250.181.238	192.168.2.7
Sep 27, 2024 11:30:35.885121107 CEST	443	56941	142.250.181.238	192.168.2.7
Sep 27, 2024 11:30:35.885523081 CEST	56941	443	192.168.2.7	142.250.181.238
Sep 27, 2024 11:30:35.885602951 CEST	443	56941	142.250.181.238	192.168.2.7
Sep 27, 2024 11:30:35.885683060 CEST	56941	443	192.168.2.7	142.250.181.238
Sep 27, 2024 11:30:35.885709047 CEST	56941	443	192.168.2.7	142.250.181.238
Sep 27, 2024 11:30:35.885716915 CEST	443	56941	142.250.181.238	192.168.2.7
Sep 27, 2024 11:30:36.182396889 CEST	443	56941	142.250.181.238	192.168.2.7
Sep 27, 2024 11:30:36.183773041 CEST	443	56941	142.250.181.238	192.168.2.7
Sep 27, 2024 11:30:36.183821917 CEST	56941	443	192.168.2.7	142.250.181.238
Sep 27, 2024 11:30:36.183912992 CEST	56941	443	192.168.2.7	142.250.181.238
Sep 27, 2024 11:30:36.183928967 CEST	443	56941	142.250.181.238	192.168.2.7
Sep 27, 2024 11:30:37.370558977 CEST	443	56938	142.250.186.68	192.168.2.7
Sep 27, 2024 11:30:37.370659113 CEST	443	56938	142.250.186.68	192.168.2.7
Sep 27, 2024 11:30:37.370759010 CEST	56938	443	192.168.2.7	142.250.186.68
Sep 27, 2024 11:31:04.956988096 CEST	56938	443	192.168.2.7	142.250.186.68
Sep 27, 2024 11:31:04.957030058 CEST	443	56938	142.250.186.68	192.168.2.7
Sep 27, 2024 11:31:04.957278013 CEST	56944	443	192.168.2.7	142.250.181.238
Sep 27, 2024 11:31:04.957314968 CEST	443	56944	142.250.181.238	192.168.2.7
Sep 27, 2024 11:31:04.957381964 CEST	56944	443	192.168.2.7	142.250.181.238
Sep 27, 2024 11:31:04.959572077 CEST	56944	443	192.168.2.7	142.250.181.238
Sep 27, 2024 11:31:04.959580898 CEST	443	56944	142.250.181.238	192.168.2.7
Sep 27, 2024 11:31:05.391429901 CEST	56945	443	192.168.2.7	142.250.181.238
Sep 27, 2024 11:31:05.391489029 CEST	443	56945	142.250.181.238	192.168.2.7
Sep 27, 2024 11:31:05.391570091 CEST	56945	443	192.168.2.7	142.250.181.238
Sep 27, 2024 11:31:05.391918898 CEST	56945	443	192.168.2.7	142.250.181.238
Sep 27, 2024 11:31:05.391936064 CEST	443	56945	142.250.181.238	192.168.2.7
Sep 27, 2024 11:31:05.695844889 CEST	443	56944	142.250.181.238	192.168.2.7
Sep 27, 2024 11:31:05.696371078 CEST	56944	443	192.168.2.7	142.250.181.238
Sep 27, 2024 11:31:05.696393013 CEST	443	56944	142.250.181.238	192.168.2.7
Sep 27, 2024 11:31:05.696743011 CEST	443	56944	142.250.181.238	192.168.2.7
Sep 27, 2024 11:31:05.697141886 CEST	56944	443	192.168.2.7	142.250.181.238
Sep 27, 2024 11:31:05.697197914 CEST	443	56944	142.250.181.238	192.168.2.7
Sep 27, 2024 11:31:05.697328091 CEST	56944	443	192.168.2.7	142.250.181.238
Sep 27, 2024 11:31:05.697374105 CEST	56944	443	192.168.2.7	142.250.181.238
Sep 27, 2024 11:31:05.697377920 CEST	443	56944	142.250.181.238	192.168.2.7
Sep 27, 2024 11:31:05.995253086 CEST	443	56944	142.250.181.238	192.168.2.7
Sep 27, 2024 11:31:05.995414972 CEST	443	56944	142.250.181.238	192.168.2.7
Sep 27, 2024 11:31:05.995510101 CEST	56944	443	192.168.2.7	142.250.181.238
Sep 27, 2024 11:31:05.996043921 CEST	56944	443	192.168.2.7	142.250.181.238
Sep 27, 2024 11:31:05.996062994 CEST	443	56944	142.250.181.238	192.168.2.7
Sep 27, 2024 11:31:06.043107986 CEST	443	56945	142.250.181.238	192.168.2.7
Sep 27, 2024 11:31:06.043380022 CEST	56945	443	192.168.2.7	142.250.181.238
Sep 27, 2024 11:31:06.043406963 CEST	443	56945	142.250.181.238	192.168.2.7
Sep 27, 2024 11:31:06.043781996 CEST	443	56945	142.250.181.238	192.168.2.7
Sep 27, 2024 11:31:06.044074059 CEST	56945	443	192.168.2.7	142.250.181.238
Sep 27, 2024 11:31:06.044125080 CEST	443	56945	142.250.181.238	192.168.2.7
Sep 27, 2024 11:31:06.044230938 CEST	56945	443	192.168.2.7	142.250.181.238
Sep 27, 2024 11:31:06.044256926 CEST	56945	443	192.168.2.7	142.250.181.238
Sep 27, 2024 11:31:06.044306993 CEST	443	56945	142.250.181.238	192.168.2.7
Sep 27, 2024 11:31:06.269068956 CEST	443	56945	142.250.181.238	192.168.2.7
Sep 27, 2024 11:31:06.269486904 CEST	443	56945	142.250.181.238	192.168.2.7
Sep 27, 2024 11:31:06.269589901 CEST	56945	443	192.168.2.7	142.250.181.238
Sep 27, 2024 11:31:06.269730091 CEST	56945	443	192.168.2.7	142.250.181.238
Sep 27, 2024 11:31:06.269743919 CEST	443	56945	142.250.181.238	192.168.2.7
Sep 27, 2024 11:31:26.889271975 CEST	56947	443	192.168.2.7	142.250.186.68
Sep 27, 2024 11:31:26.889328957 CEST	443	56947	142.250.186.68	192.168.2.7
Sep 27, 2024 11:31:26.889405966 CEST	56947	443	192.168.2.7	142.250.186.68
Sep 27, 2024 11:31:26.889774084 CEST	56947	443	192.168.2.7	142.250.186.68
Sep 27, 2024 11:31:26.889786959 CEST	443	56947	142.250.186.68	192.168.2.7
Sep 27, 2024 11:31:27.518445969 CEST	443	56947	142.250.186.68	192.168.2.7
Sep 27, 2024 11:31:27.519299030 CEST	56947	443	192.168.2.7	142.250.186.68
Sep 27, 2024 11:31:27.519314051 CEST	443	56947	142.250.186.68	192.168.2.7
Sep 27, 2024 11:31:27.519654989 CEST	443	56947	142.250.186.68	192.168.2.7
Sep 27, 2024 11:31:27.520021915 CEST	56947	443	192.168.2.7	142.250.186.68
Sep 27, 2024 11:31:27.520072937 CEST	443	56947	142.250.186.68	192.168.2.7
Sep 27, 2024 11:31:27.560575008 CEST	56947	443	192.168.2.7	142.250.186.68

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 11:29:23.467381954 CEST	53330	53	192.168.2.7	1.1.1.1
Sep 27, 2024 11:29:23.467823982 CEST	57811	53	192.168.2.7	1.1.1.1
Sep 27, 2024 11:29:23.472470999 CEST	53	53457	1.1.1.1	192.168.2.7
Sep 27, 2024 11:29:23.473942995 CEST	53	53330	1.1.1.1	192.168.2.7
Sep 27, 2024 11:29:23.474682093 CEST	53	57811	1.1.1.1	192.168.2.7
Sep 27, 2024 11:29:23.477499008 CEST	53	52244	1.1.1.1	192.168.2.7
Sep 27, 2024 11:29:24.472583055 CEST	54068	53	192.168.2.7	1.1.1.1
Sep 27, 2024 11:29:24.472718000 CEST	52456	53	192.168.2.7	1.1.1.1
Sep 27, 2024 11:29:24.479433060 CEST	53	54068	1.1.1.1	192.168.2.7
Sep 27, 2024 11:29:24.479587078 CEST	53	52456	1.1.1.1	192.168.2.7
Sep 27, 2024 11:29:24.541202068 CEST	53	64242	1.1.1.1	192.168.2.7
Sep 27, 2024 11:29:25.481415033 CEST	123	123	192.168.2.7	20.101.57.9
Sep 27, 2024 11:29:25.652328014 CEST	123	123	20.101.57.9	192.168.2.7
Sep 27, 2024 11:29:26.763823032 CEST	64607	53	192.168.2.7	1.1.1.1
Sep 27, 2024 11:29:26.763951063 CEST	52359	53	192.168.2.7	1.1.1.1
Sep 27, 2024 11:29:26.771125078 CEST	53	64607	1.1.1.1	192.168.2.7
Sep 27, 2024 11:29:26.771173954 CEST	53	52359	1.1.1.1	192.168.2.7
Sep 27, 2024 11:29:29.976090908 CEST	53	65182	1.1.1.1	192.168.2.7
Sep 27, 2024 11:29:32.327641964 CEST	64736	53	192.168.2.7	1.1.1.1
Sep 27, 2024 11:29:32.327891111 CEST	54576	53	192.168.2.7	1.1.1.1
Sep 27, 2024 11:29:32.336451054 CEST	53	64736	1.1.1.1	192.168.2.7
Sep 27, 2024 11:29:32.337033987 CEST	53	54576	1.1.1.1	192.168.2.7
Sep 27, 2024 11:29:33.458976984 CEST	61196	53	192.168.2.7	1.1.1.1
Sep 27, 2024 11:29:33.459131956 CEST	60178	53	192.168.2.7	1.1.1.1
Sep 27, 2024 11:29:33.465883017 CEST	53	60178	1.1.1.1	192.168.2.7
Sep 27, 2024 11:29:33.465951920 CEST	53	61196	1.1.1.1	192.168.2.7
Sep 27, 2024 11:29:35.975275040 CEST	53	54169	1.1.1.1	192.168.2.7
Sep 27, 2024 11:29:41.502053022 CEST	53	59009	1.1.1.1	192.168.2.7
Sep 27, 2024 11:30:00.521898985 CEST	53	50563	1.1.1.1	192.168.2.7
Sep 27, 2024 11:30:18.644773006 CEST	138	138	192.168.2.7	192.168.2.255
Sep 27, 2024 11:30:22.992031097 CEST	53	49847	1.1.1.1	192.168.2.7
Sep 27, 2024 11:30:23.086911917 CEST	53	63171	1.1.1.1	192.168.2.7
Sep 27, 2024 11:30:26.145163059 CEST	53	50342	1.1.1.1	192.168.2.7
Sep 27, 2024 11:30:34.270658970 CEST	54790	53	192.168.2.7	1.1.1.1
Sep 27, 2024 11:30:34.270792961 CEST	53967	53	192.168.2.7	1.1.1.1
Sep 27, 2024 11:30:34.278887987 CEST	53	53967	1.1.1.1	192.168.2.7
Sep 27, 2024 11:30:34.278925896 CEST	53	54790	1.1.1.1	192.168.2.7
Sep 27, 2024 11:30:34.354022980 CEST	53	59334	1.1.1.1	192.168.2.7
Sep 27, 2024 11:31:28.111466885 CEST	53	64404	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 27, 2024 11:29:23.467381954 CEST	192.168.2.7	1.1.1.1	0xc10a	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:29:23.467823982 CEST	192.168.2.7	1.1.1.1	0x249e	Standard query (0)	youtube.com	65	IN (0x0001)	false
Sep 27, 2024 11:29:24.472583055 CEST	192.168.2.7	1.1.1.1	0x16a9	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:29:24.472718000 CEST	192.168.2.7	1.1.1.1	0x1787	Standard query (0)	www.youtube.com	65	IN (0x0001)	false
Sep 27, 2024 11:29:26.763823032 CEST	192.168.2.7	1.1.1.1	0x120a	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:29:26.763951063 CEST	192.168.2.7	1.1.1.1	0x7d82	Standard query (0)	www.google.com	65	IN (0x0001)	false
Sep 27, 2024 11:29:32.327641964 CEST	192.168.2.7	1.1.1.1	0x6763	Standard query (0)	accounts.youtube.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:29:32.327891111 CEST	192.168.2.7	1.1.1.1	0x14d1	Standard query (0)	accounts.youtube.com	65	IN (0x0001)	false
Sep 27, 2024 11:29:33.458976984 CEST	192.168.2.7	1.1.1.1	0x25ba	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:29:33.459131956 CEST	192.168.2.7	1.1.1.1	0xea4d	Standard query (0)	play.google.com	65	IN (0x0001)	false
Sep 27, 2024 11:30:34.270658970 CEST	192.168.2.7	1.1.1.1	0xc4c	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:30:34.270792961 CEST	192.168.2.7	1.1.1.1	0xb97	Standard query (0)	play.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 27, 2024 11:29:23.473942995 CEST	1.1.1.1	192.168.2.7	0xc10a	No error (0)	youtube.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:29:23.474682093 CEST	1.1.1.1	192.168.2.7	0x249e	No error (0)	youtube.com			65	IN (0x0001)	false
Sep 27, 2024 11:29:24.479433060 CEST	1.1.1.1	192.168.2.7	0x16a9	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 11:29:24.479433060 CEST	1.1.1.1	192.168.2.7	0x16a9	No error (0)	youtube-ui.l.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:29:24.479433060 CEST	1.1.1.1	192.168.2.7	0x16a9	No error (0)	youtube-ui.l.google.com		172.217.23.110	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:29:24.479433060 CEST	1.1.1.1	192.168.2.7	0x16a9	No error (0)	youtube-ui.l.google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:29:24.479433060 CEST	1.1.1.1	192.168.2.7	0x16a9	No error (0)	youtube-ui.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:29:24.479433060 CEST	1.1.1.1	192.168.2.7	0x16a9	No error (0)	youtube-ui.l.google.com		216.58.212.142	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:29:24.479433060 CEST	1.1.1.1	192.168.2.7	0x16a9	No error (0)	youtube-ui.l.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:29:24.479433060 CEST	1.1.1.1	192.168.2.7	0x16a9	No error (0)	youtube-ui.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:29:24.479433060 CEST	1.1.1.1	192.168.2.7	0x16a9	No error (0)	youtube-ui.l.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:29:24.479433060 CEST	1.1.1.1	192.168.2.7	0x16a9	No error (0)	youtube-ui.l.google.com		172.217.18.110	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:29:24.479433060 CEST	1.1.1.1	192.168.2.7	0x16a9	No error (0)	youtube-ui.l.google.com		142.250.74.206	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:29:24.479433060 CEST	1.1.1.1	192.168.2.7	0x16a9	No error (0)	youtube-ui.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:29:24.479433060 CEST	1.1.1.1	192.168.2.7	0x16a9	No error (0)	youtube-ui.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:29:24.479433060 CEST	1.1.1.1	192.168.2.7	0x16a9	No error (0)	youtube-ui.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:29:24.479433060 CEST	1.1.1.1	192.168.2.7	0x16a9	No error (0)	youtube-ui.l.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:29:24.479433060 CEST	1.1.1.1	192.168.2.7	0x16a9	No error (0)	youtube-ui.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:29:24.479433060 CEST	1.1.1.1	192.168.2.7	0x16a9	No error (0)	youtube-ui.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:29:24.479587078 CEST	1.1.1.1	192.168.2.7	0x1787	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 11:29:24.479587078 CEST	1.1.1.1	192.168.2.7	0x1787	No error (0)	youtube-ui.l.google.com			65	IN (0x0001)	false
Sep 27, 2024 11:29:26.771125078 CEST	1.1.1.1	192.168.2.7	0x120a	No error (0)	www.google.com		142.250.186.68	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:29:26.771173954 CEST	1.1.1.1	192.168.2.7	0x7d82	No error (0)	www.google.com			65	IN (0x0001)	false
Sep 27, 2024 11:29:32.336451054 CEST	1.1.1.1	192.168.2.7	0x6763	No error (0)	accounts.youtube.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 11:29:32.336451054 CEST	1.1.1.1	192.168.2.7	0x6763	No error (0)	www3.l.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:29:32.337033987 CEST	1.1.1.1	192.168.2.7	0x14d1	No error (0)	accounts.youtube.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 11:29:33.465951920 CEST	1.1.1.1	192.168.2.7	0x25ba	No error (0)	play.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:30:34.278925896 CEST	1.1.1.1	192.168.2.7	0xc4c	No error (0)	play.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

youtube.com

www.youtube.com

fs.microsoft.com

https:

accounts.youtube.com

play.google.com

www.google.com

slscr.update.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49701	142.250.186.46	443	7688	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 09:29:24 UTC	839	OUT	GET /account?=https://accounts.google.com/v3/signin/challenge/pwd HTTP/1.1 Host: youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 09:29:24 UTC	1704	IN	HTTP/1.1 301 Moved Permanently Content-Type: application/binary X-Content-Type-Options: nosniff Expires: Fri, 27 Sep 2024 09:29:24 GMT Date: Fri, 27 Sep 2024 09:29:24 GMT Cache-Control: private, max-age=31536000 Location: https://www.youtube.com/account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9 Content-Security-Policy: require-trusted-types-for 'script' Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main" Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49705	142.250.185.110	443	7688	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 09:29:25 UTC	857	OUT	GET /account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd HTTP/1.1 Host: www.youtube.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 09:29:25 UTC	2634	IN	HTTP/1.1 303 See Other Content-Type: application/binary X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 27 Sep 2024 09:29:25 GMT Location: https://accounts.google.com/ServiceLogin?service=youtube&uilel=3&passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Fsignin%3Faction_handle_signin%3Dtrue%26app%3Ddesktop%26hl%3Den%26next%3Dhttps%253A%252F%252Fwww.youtube.com%252Faccount%253F%253Dhttps%25253A%25252F%25252Faccounts.google.com%25252Fv3%25252Fsignin%25252Fchallenge%25252Fpwd%26feature%3Dredirect_login&hl=en Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="youtube_main" Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9 Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} Content-Security-Policy: require-trusted-types-for 'script' P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info." Server: ESF Content-Length: 0 X-XSS-Protection: 0 Set-Cookie: GPS=1; Domain=.youtube.com; Expires=Fri, 27-Sep-2024 09:59:25 GMT; Path=/; Secure; HttpOnly Set-Cookie: YSC=bWGR5W2moQY; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none; Partitioned Set-Cookie: VISITOR_INFO1_LIVE=mR9SvBdXZ7c; Domain=.youtube.com; Expires=Wed, 26-Mar-2025 09:29:25 GMT; Path=/; Secure; HttpOnly; SameSite=none; Partitioned Set-Cookie: VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgXA%3D%3D; Domain=.youtube.com; Expires=Wed, 26-Mar-2025 09:29:25 GMT; Path=/; Secure; HttpOnly; SameSite=none; Partitioned Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49712	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-09-27 09:29:29 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-27 09:29:29 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF67) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=26205 Date: Fri, 27 Sep 2024 09:29:29 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49714	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-09-27 09:29:30 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-27 09:29:30 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=26150 Date: Fri, 27 Sep 2024 09:29:30 GMT Content-Length: 55 Connection: close X-CID: 2
2024-09-27 09:29:30 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49726	142.250.185.206	443	7688	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 09:29:32 UTC	1224	OUT	GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-449021059&timestamp=1727429371112 HTTP/1.1 Host: accounts.youtube.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-arch: "x86" sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-model: "" sec-ch-ua-bitness: "64" sec-ch-ua-wow64: ?0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: iframe Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 09:29:33 UTC	1978	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 X-Frame-Options: ALLOW-FROM https://accounts.google.com Content-Security-Policy: frame-ancestors https://accounts.google.com Content-Security-Policy: script-src 'report-sample' 'nonce-rcjfM74bJhv-AxBziLncYA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsDomainCookiesCheckConnectionHttp/cspreport Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 27 Sep 2024 09:29:33 GMT Cross-Origin-Resource-Policy: cross-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin reporting-endpoints: default="/_/AccountsDomainCookiesCheckConnectionHttp/web-reports?context=eJzjctDikmJw15BikPj6kkkNiJ3SZ7AGAHHSv_OsBUC8JOIi64HEi6yXuy-xXgdi1Z5LrMZAXCRxhbUBiIW4Of5-vbmdTeDHn--BSnpJ-YXxmSmpeSWZJZUp-bmJmXnJ-fnZmanFxalFZalF8UYGRiYGlkZGegYW8QUGAKsZMjI" Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-09-27 09:29:33 UTC	1978	IN	Data Raw: 37 36 32 30 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 72 63 6a 66 4d 37 34 62 4a 68 76 2d 41 78 42 7a 69 4c 6e 63 59 41 22 3e 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 3d 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 41 63 63 6f 75 6e 74 73 44 6f 6d 61 69 6e 63 6f 6f 6b 69 65 73 43 68 65 63 6b 63 6f 6e 6e 65 63 74 69 6f 6e 4a 73 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 74 72 79 7b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f Data Ascii: 7620<html><head><script nonce="rcjfM74bJhv-AxBziLncYA">"use strict";this.default_AccountsDomaincookiesCheckconnectionJs=this.default_AccountsDomaincookiesCheckconnectionJs\|\|{};(function(_){var window=this;try{_._F_toggles_initialize=function(a){(typeo
2024-09-27 09:29:33 UTC	1978	IN	Data Raw: 28 5c 64 2e 5c 64 29 2f 2e 65 78 65 63 28 62 29 2c 0a 63 5b 31 5d 3d 3d 22 37 2e 30 22 29 69 66 28 62 26 26 62 5b 31 5d 29 73 77 69 74 63 68 28 62 5b 31 5d 29 7b 63 61 73 65 20 22 34 2e 30 22 3a 61 3d 22 38 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 35 2e 30 22 3a 61 3d 22 39 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 36 2e 30 22 3a 61 3d 22 31 30 2e 30 22 3b 62 72 65 61 6b 3b 63 61 73 65 20 22 37 2e 30 22 3a 61 3d 22 31 31 2e 30 22 7d 65 6c 73 65 20 61 3d 22 37 2e 30 22 3b 65 6c 73 65 20 61 3d 63 5b 31 5d 3b 62 3d 61 7d 65 6c 73 65 20 62 3d 22 22 3b 72 65 74 75 72 6e 20 62 7d 76 61 72 20 64 3d 52 65 67 45 78 70 28 22 28 5b 41 2d 5a 5d 5b 5c 5c 77 20 5d 2b 29 2f 28 5b 5e 5c 5c 73 5d 2b 29 5c 5c 73 2a 28 3f 3a 5c 5c 28 28 2e 2a 3f 29 5c 5c 29 29 Data Ascii: (\d.\d)/.exec(b),c[1]=="7.0")if(b&&b[1])switch(b[1]){case "4.0":a="8.0";break;case "5.0":a="9.0";break;case "6.0":a="10.0";break;case "7.0":a="11.0"}else a="7.0";else a=c[1];b=a}else b="";return b}var d=RegExp("([A-Z][\\w ]+)/([^\\s]+)\\s(?:\$(.?)\$)
2024-09-27 09:29:33 UTC	1978	IN	Data Raw: 20 22 6e 75 6d 62 65 72 22 3a 72 65 74 75 72 6e 20 69 73 46 69 6e 69 74 65 28 61 29 3f 61 3a 53 74 72 69 6e 67 28 61 29 3b 63 61 73 65 20 22 62 69 67 69 6e 74 22 3a 72 65 74 75 72 6e 28 41 61 3f 0a 61 3e 3d 42 61 26 26 61 3c 3d 43 61 3a 61 5b 30 5d 3d 3d 3d 22 2d 22 3f 75 61 28 61 2c 44 61 29 3a 75 61 28 61 2c 45 61 29 29 3f 4e 75 6d 62 65 72 28 61 29 3a 53 74 72 69 6e 67 28 61 29 3b 63 61 73 65 20 22 62 6f 6f 6c 65 61 6e 22 3a 72 65 74 75 72 6e 20 61 3f 31 3a 30 3b 63 61 73 65 20 22 6f 62 6a 65 63 74 22 3a 69 66 28 61 29 69 66 28 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 61 29 29 7b 69 66 28 43 28 61 29 29 72 65 74 75 72 6e 7d 65 6c 73 65 20 69 66 28 46 61 26 26 61 21 3d 6e 75 6c 6c 26 26 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 55 69 6e 74 38 41 72 72 61 Data Ascii: "number":return isFinite(a)?a:String(a);case "bigint":return(Aa?a>=Ba&&a<=Ca:a[0]==="-"?ua(a,Da):ua(a,Ea))?Number(a):String(a);case "boolean":return a?1:0;case "object":if(a)if(Array.isArray(a)){if(C(a))return}else if(Fa&&a!=null&&a instanceof Uint8Arra
2024-09-27 09:29:33 UTC	1978	IN	Data Raw: 62 2e 68 61 73 28 61 29 26 26 28 62 3d 61 2e 43 29 29 66 6f 72 28 76 61 72 20 63 3d 30 3b 63 3c 62 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 7b 76 61 72 20 64 3d 62 5b 63 5d 3b 69 66 28 63 3d 3d 3d 62 2e 6c 65 6e 67 74 68 2d 31 26 26 41 28 64 29 29 66 6f 72 28 76 61 72 20 65 20 69 6e 20 64 29 7b 76 61 72 20 66 3d 64 5b 65 5d 3b 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 66 29 26 26 0a 52 61 28 66 2c 61 29 7d 65 6c 73 65 20 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 64 29 26 26 52 61 28 64 2c 61 29 7d 61 3d 45 3f 61 2e 43 3a 4d 61 28 61 2e 43 2c 50 61 2c 76 6f 69 64 20 30 2c 76 6f 69 64 20 30 2c 21 31 29 3b 65 3d 21 45 3b 69 66 28 62 3d 61 2e 6c 65 6e 67 74 68 29 7b 64 3d 61 5b 62 2d 31 5d 3b 28 66 3d 41 28 64 29 29 3f 62 2d 2d 3a 64 3d 76 6f 69 64 20 30 3b 63 3d Data Ascii: b.has(a)&&(b=a.C))for(var c=0;c<b.length;c++){var d=b[c];if(c===b.length-1&&A(d))for(var e in d){var f=d[e];Array.isArray(f)&&Ra(f,a)}else Array.isArray(d)&&Ra(d,a)}a=E?a.C:Ma(a.C,Pa,void 0,void 0,!1);e=!E;if(b=a.length){d=a[b-1];(f=A(d))?b--:d=void 0;c=
2024-09-27 09:29:33 UTC	1978	IN	Data Raw: 20 61 3b 61 3d 53 79 6d 62 6f 6c 28 22 63 22 29 3b 66 6f 72 28 76 61 72 20 62 3d 22 41 72 72 61 79 20 49 6e 74 38 41 72 72 61 79 20 55 69 6e 74 38 41 72 72 61 79 20 55 69 6e 74 38 43 6c 61 6d 70 65 64 41 72 72 61 79 20 49 6e 74 31 36 41 72 72 61 79 20 55 69 6e 74 31 36 41 72 72 61 79 20 49 6e 74 33 32 41 72 72 61 79 20 55 69 6e 74 33 32 41 72 72 61 79 20 46 6c 6f 61 74 33 32 41 72 72 61 79 20 46 6c 6f 61 74 36 34 41 72 72 61 79 22 2e 73 70 6c 69 74 28 22 20 22 29 2c 63 3d 30 3b 63 3c 62 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 7b 76 61 72 20 64 3d 57 61 5b 62 5b 63 5d 5d 3b 74 79 70 65 6f 66 20 64 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 74 79 70 65 6f 66 20 64 2e 70 72 6f 74 6f 74 79 70 65 5b 61 5d 21 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 46 28 64 2e 70 Data Ascii: a;a=Symbol("c");for(var b="Array Int8Array Uint8Array Uint8ClampedArray Int16Array Uint16Array Int32Array Uint32Array Float32Array Float64Array".split(" "),c=0;c<b.length;c++){var d=Wa[b[c]];typeof d==="function"&&typeof d.prototype[a]!="function"&&F(d.p
2024-09-27 09:29:33 UTC	1978	IN	Data Raw: 29 3b 76 61 72 20 68 3d 30 2c 67 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 74 68 69 73 2e 67 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6b 29 7b 6b 3d 48 28 6b 29 3b 66 6f 72 28 76 61 72 20 6c 3b 21 28 6c 3d 6b 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6c 3d 6c 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6c 5b 30 5d 2c 6c 5b 31 5d 29 7d 7d 3b 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 69 66 28 21 63 28 6b 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 69 22 29 3b 64 28 6b 29 3b 69 66 28 21 49 28 6b 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 6a 60 22 2b 6b 29 3b 6b 5b 66 5d 5b 74 68 69 73 2e 67 5d 3d 6c 3b 72 65 74 75 72 6e 20 74 68 69 Data Ascii: );var h=0,g=function(k){this.g=(h+=Math.random()+1).toString();if(k){k=H(k);for(var l;!(l=k.next()).done;)l=l.value,this.set(l[0],l[1])}};g.prototype.set=function(k,l){if(!c(k))throw Error("i");d(k);if(!I(k,f))throw Error("j`"+k);k[f][this.g]=l;return thi
2024-09-27 09:29:33 UTC	1978	IN	Data Raw: 61 72 20 6c 3d 74 68 69 73 2e 65 6e 74 72 69 65 73 28 29 2c 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 0a 6d 2e 76 61 6c 75 65 2c 67 2e 63 61 6c 6c 28 6b 2c 6d 5b 31 5d 2c 6d 5b 30 5d 2c 74 68 69 73 29 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 63 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 3b 76 61 72 20 64 3d 66 75 6e 63 74 69 6f 6e 28 67 2c 6b 29 7b 76 61 72 20 6c 3d 6b 26 26 74 79 70 65 6f 66 20 6b 3b 6c 3d 3d 22 6f 62 6a 65 63 74 22 7c 7c 6c 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 62 2e 68 61 73 28 6b 29 3f 6c 3d 62 2e 67 65 74 28 6b 29 3a 28 6c 3d 22 22 2b 20 2b 2b 68 2c 62 2e 73 65 74 28 6b 2c 6c 29 29 3a 6c 3d 22 70 5f 22 2b 6b 3b 76 61 72 20 6d 3d 67 5b 30 5d Data Ascii: ar l=this.entries(),m;!(m=l.next()).done;)m=m.value,g.call(k,m[1],m[0],this)};c.prototype[Symbol.iterator]=c.prototype.entries;var d=function(g,k){var l=k&&typeof k;l=="object"\|\|l=="function"?b.has(k)?l=b.get(k):(l=""+ ++h,b.set(k,l)):l="p_"+k;var m=g[0]
2024-09-27 09:29:33 UTC	1978	IN	Data Raw: 62 29 7d 7d 29 3b 76 61 72 20 66 62 3d 66 62 7c 7c 7b 7d 2c 71 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 67 62 3d 71 2e 5f 46 5f 74 6f 67 67 6c 65 73 7c 7c 5b 5d 2c 68 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 61 2e 73 70 6c 69 74 28 22 2e 22 29 3b 66 6f 72 28 76 61 72 20 62 3d 71 2c 63 3d 30 3b 63 3c 61 2e 6c 65 6e 67 74 68 3b 63 2b 2b 29 69 66 28 62 3d 62 5b 61 5b 63 5d 5d 2c 62 3d 3d 6e 75 6c 6c 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 72 65 74 75 72 6e 20 62 7d 2c 69 62 3d 22 63 6c 6f 73 75 72 65 5f 75 69 64 5f 22 2b 28 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2a 31 45 39 3e 3e 3e 30 29 2c 6a 62 3d 30 2c 6b 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 61 2e 63 61 6c 6c 2e 61 70 70 6c 79 28 61 2e 62 69 6e 64 2c 61 72 67 75 6d Data Ascii: b)}});var fb=fb\|\|{},q=this\|\|self,gb=q._F_toggles\|\|[],hb=function(a){a=a.split(".");for(var b=q,c=0;c<a.length;c++)if(b=b[a[c]],b==null)return null;return b},ib="closure_uid_"+(Math.random()*1E9>>>0),jb=0,kb=function(a,b,c){return a.call.apply(a.bind,argum
2024-09-27 09:29:33 UTC	1978	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 63 3d 63 7c 7c 71 3b 76 61 72 20 64 3d 63 2e 6f 6e 65 72 72 6f 72 2c 65 3d 21 21 62 3b 63 2e 6f 6e 65 72 72 6f 72 3d 66 75 6e 63 74 69 6f 6e 28 66 2c 68 2c 67 2c 6b 2c 6c 29 7b 64 26 26 64 28 66 2c 68 2c 67 2c 6b 2c 6c 29 3b 61 28 7b 6d 65 73 73 61 67 65 3a 66 2c 66 69 6c 65 4e 61 6d 65 3a 68 2c 6c 69 6e 65 3a 67 2c 6c 69 6e 65 4e 75 6d 62 65 72 3a 67 2c 63 61 3a 6b 2c 65 72 72 6f 72 3a 6c 7d 29 3b 72 65 74 75 72 6e 20 65 7d 7d 2c 74 62 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 68 62 28 22 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 22 29 3b 61 3d 3d 6e 75 6c 6c 26 26 28 61 3d 27 55 6e 6b 6e 6f 77 6e 20 45 72 72 6f 72 20 6f 66 20 74 79 70 65 20 22 6e 75 6c 6c 2f 75 6e 64 65 66 Data Ascii: function(a,b,c){c=c\|\|q;var d=c.onerror,e=!!b;c.onerror=function(f,h,g,k,l){d&&d(f,h,g,k,l);a({message:f,fileName:h,line:g,lineNumber:g,ca:k,error:l});return e}},tb=function(a){var b=hb("window.location.href");a==null&&(a='Unknown Error of type "null/undef
2024-09-27 09:29:33 UTC	1978	IN	Data Raw: 22 3a 66 3d 28 66 3d 73 62 28 66 29 29 3f 66 3a 22 5b 66 6e 5d 22 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 66 3d 0a 74 79 70 65 6f 66 20 66 7d 66 2e 6c 65 6e 67 74 68 3e 34 30 26 26 28 66 3d 66 2e 73 6c 69 63 65 28 30 2c 34 30 29 2b 22 2e 2e 2e 22 29 3b 63 2e 70 75 73 68 28 66 29 7d 62 2e 70 75 73 68 28 61 29 3b 63 2e 70 75 73 68 28 22 29 5c 6e 22 29 3b 74 72 79 7b 63 2e 70 75 73 68 28 77 62 28 61 2e 63 61 6c 6c 65 72 2c 62 29 29 7d 63 61 74 63 68 28 68 29 7b 63 2e 70 75 73 68 28 22 5b 65 78 63 65 70 74 69 6f 6e 20 74 72 79 69 6e 67 20 74 6f 20 67 65 74 20 63 61 6c 6c 65 72 5d 5c 6e 22 29 7d 7d 65 6c 73 65 20 61 3f 63 2e 70 75 73 68 28 22 5b 2e 2e 2e 6c 6f 6e 67 20 73 74 61 63 6b 2e 2e 2e 5d 22 29 3a 63 2e 70 75 73 68 28 22 5b 65 6e 64 5d 22 29 3b 72 Data Ascii: ":f=(f=sb(f))?f:"[fn]";break;default:f=typeof f}f.length>40&&(f=f.slice(0,40)+"...");c.push(f)}b.push(a);c.push(")\n");try{c.push(wb(a.caller,b))}catch(h){c.push("[exception trying to get caller]\n")}}else a?c.push("[...long stack...]"):c.push("[end]");r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49729	216.58.206.78	443	7688	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 09:29:34 UTC	549	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 09:29:34 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Fri, 27 Sep 2024 09:29:34 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49731	216.58.206.78	443	7688	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 09:29:34 UTC	549	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 09:29:34 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Fri, 27 Sep 2024 09:29:34 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49734	216.58.206.78	443	7688	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 09:29:35 UTC	1112	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 519 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 09:29:35 UTC	519	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 37 34 32 39 33 37 32 32 36 33 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"30",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],1828,[["1727429372263",null,null,null
2024-09-27 09:29:35 UTC	933	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=517=URDIM-eRR6B6z03yj61Tqvk8Xji6IxaPxqlaqfi9qShybNmTsEfEe8PliV2WX0ALHRkRSIzmRtLqesErkQS0qP5x63sXNF_xo5rUD_-X15L8SPmsiB3WTd_3eay-bn6bNWNrooJI3VIMr0IZwI0rP27pkppUHJJ2Ud6DIPbxqhPXlkaUUXg; expires=Sat, 29-Mar-2025 09:29:35 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Fri, 27 Sep 2024 09:29:35 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Fri, 27 Sep 2024 09:29:35 GMT Connection: close Transfer-Encoding: chunked
2024-09-27 09:29:35 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-09-27 09:29:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49735	216.58.206.78	443	7688	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 09:29:35 UTC	1112	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 519 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 09:29:35 UTC	519	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 37 34 32 39 33 37 32 33 34 32 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"30",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],1828,[["1727429372342",null,null,null
2024-09-27 09:29:35 UTC	933	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=517=egIl5sEksGOZ4wW0Jc7B7W9HwkNpsYMHzKi6Fds3t8xsb4EZOyTzqVm3N9LRH5q5ynxZsi65W12J4bRnSFyQBs-6mfN9xX7BjLSWeZUrPRt2GUKgx2qyb-aL-b-tZpPm-pERDcXZl_9hTZAYfFL_rInxOOMGCZTRsQYBftPwWDu0oV23kIw; expires=Sat, 29-Mar-2025 09:29:35 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Fri, 27 Sep 2024 09:29:35 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Fri, 27 Sep 2024 09:29:35 GMT Connection: close Transfer-Encoding: chunked
2024-09-27 09:29:35 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-09-27 09:29:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49709	142.250.186.68	443	7688	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 09:29:35 UTC	1202	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=517=egIl5sEksGOZ4wW0Jc7B7W9HwkNpsYMHzKi6Fds3t8xsb4EZOyTzqVm3N9LRH5q5ynxZsi65W12J4bRnSFyQBs-6mfN9xX7BjLSWeZUrPRt2GUKgx2qyb-aL-b-tZpPm-pERDcXZl_9hTZAYfFL_rInxOOMGCZTRsQYBftPwWDu0oV23kIw
2024-09-27 09:29:36 UTC	705	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri, 27 Sep 2024 07:57:27 GMT Expires: Sat, 05 Oct 2024 07:57:27 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 5529 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-09-27 09:29:36 UTC	685	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-09-27 09:29:36 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2024-09-27 09:29:36 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2024-09-27 09:29:36 UTC	1390	IN	Data Raw: ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2024-09-27 09:29:36 UTC	575	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49739	52.165.165.26	443

Timestamp	Bytes transferred	Direction	Data
2024-09-27 09:29:37 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ba7VRpcetUECb1w&MD=PAn2dUHx HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-09-27 09:29:38 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: a554ca57-adf2-43ff-8016-6347d1334a49 MS-RequestId: fd4bcde7-fdf3-4df6-9dad-4f611315d277 MS-CV: AynxXtlcwk+IOcbg.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 27 Sep 2024 09:29:37 GMT Connection: close Content-Length: 24490
2024-09-27 09:29:38 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-09-27 09:29:38 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49749	216.58.206.78	443	7688	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 09:29:41 UTC	1287	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1218 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=517=egIl5sEksGOZ4wW0Jc7B7W9HwkNpsYMHzKi6Fds3t8xsb4EZOyTzqVm3N9LRH5q5ynxZsi65W12J4bRnSFyQBs-6mfN9xX7BjLSWeZUrPRt2GUKgx2qyb-aL-b-tZpPm-pERDcXZl_9hTZAYfFL_rInxOOMGCZTRsQYBftPwWDu0oV23kIw
2024-09-27 09:29:41 UTC	1218	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 34 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 35 35 38 2c 5b 5b 22 31 37 32 37 34 32 39 33 37 30 30 30 30 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[4,0,0,0,0]]],558,[["1727429370000",null,null,null,
2024-09-27 09:29:42 UTC	941	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=517=bimMFcoSW1A5nLYynjWQ2ASl9qei38WlBCIq5AZJdaMNAhkmBMmrYlpecJs2tqa0oacxyJL1B4LZNV1uD7kZtFF7CuzhPf-6fZewKKEOfo46K7udfKaVN6qoFWgxXS0V6TOcukEzhu7iWo16btEZ2qQk1XV-B557sKs3dAer_g-yswM-njozGASxUa8; expires=Sat, 29-Mar-2025 09:29:42 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Fri, 27 Sep 2024 09:29:42 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Fri, 27 Sep 2024 09:29:42 GMT Connection: close Transfer-Encoding: chunked
2024-09-27 09:29:42 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-09-27 09:29:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49750	216.58.206.78	443	7688	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 09:30:04 UTC	1318	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1525 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=517=bimMFcoSW1A5nLYynjWQ2ASl9qei38WlBCIq5AZJdaMNAhkmBMmrYlpecJs2tqa0oacxyJL1B4LZNV1uD7kZtFF7CuzhPf-6fZewKKEOfo46K7udfKaVN6qoFWgxXS0V6TOcukEzhu7iWo16btEZ2qQk1XV-B557sKs3dAer_g-yswM-njozGASxUa8
2024-09-27 09:30:04 UTC	1525	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 37 34 32 39 34 30 32 38 38 35 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"30",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],1828,[["1727429402885",null,null,null
2024-09-27 09:30:05 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Fri, 27 Sep 2024 09:30:04 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-09-27 09:30:05 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-09-27 09:30:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49751	216.58.206.78	443	7688	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 09:30:04 UTC	1318	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1336 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=517=bimMFcoSW1A5nLYynjWQ2ASl9qei38WlBCIq5AZJdaMNAhkmBMmrYlpecJs2tqa0oacxyJL1B4LZNV1uD7kZtFF7CuzhPf-6fZewKKEOfo46K7udfKaVN6qoFWgxXS0V6TOcukEzhu7iWo16btEZ2qQk1XV-B557sKs3dAer_g-yswM-njozGASxUa8
2024-09-27 09:30:04 UTC	1336	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 37 34 32 39 34 30 33 30 37 32 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"30",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],1828,[["1727429403072",null,null,null
2024-09-27 09:30:05 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Fri, 27 Sep 2024 09:30:05 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-09-27 09:30:05 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-09-27 09:30:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49752	216.58.206.78	443	7688	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 09:30:05 UTC	1278	OUT	POST /log?hasfast=true&authuser=0&format=json HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1037 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.5938.134" Content-Type: text/plain;charset=UTF-8 sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=517=bimMFcoSW1A5nLYynjWQ2ASl9qei38WlBCIq5AZJdaMNAhkmBMmrYlpecJs2tqa0oacxyJL1B4LZNV1uD7kZtFF7CuzhPf-6fZewKKEOfo46K7udfKaVN6qoFWgxXS0V6TOcukEzhu7iWo16btEZ2qQk1XV-B557sKs3dAer_g-yswM-njozGASxUa8
2024-09-27 09:30:05 UTC	1037	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 62 6f 71 5f 69 64 65 6e 74 69 74 79 66 72 6f 6e 74 65 6e 64 61 75 74 68 75 69 73 65 72 76 65 72 5f 32 30 32 34 30 39 32 34 2e 30 32 5f 70 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 33 2c 30 2c 30 Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"boq_identityfrontendauthuiserver_20240924.02_p0",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[3,0,0
2024-09-27 09:30:05 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Fri, 27 Sep 2024 09:30:05 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-09-27 09:30:05 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-09-27 09:30:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	49753	52.165.165.26	443

Timestamp	Bytes transferred	Direction	Data
2024-09-27 09:30:16 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ba7VRpcetUECb1w&MD=PAn2dUHx HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-09-27 09:30:16 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 966cb790-bb79-47b7-aa11-f43ab598b2ab MS-RequestId: 8470662f-0cc9-4aa5-a510-554c5a5ed1ff MS-CV: 00YMBFRnJkiDCrOy.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 27 Sep 2024 09:30:16 GMT Connection: close Content-Length: 30005
2024-09-27 09:30:16 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-09-27 09:30:16 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	56939	142.250.181.238	443	7688	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 09:30:34 UTC	1318	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1436 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=517=bimMFcoSW1A5nLYynjWQ2ASl9qei38WlBCIq5AZJdaMNAhkmBMmrYlpecJs2tqa0oacxyJL1B4LZNV1uD7kZtFF7CuzhPf-6fZewKKEOfo46K7udfKaVN6qoFWgxXS0V6TOcukEzhu7iWo16btEZ2qQk1XV-B557sKs3dAer_g-yswM-njozGASxUa8
2024-09-27 09:30:34 UTC	1436	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 37 34 33 33 35 34 33 31 36 31 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"30",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],1828,[["1727433543161",null,null,null
2024-09-27 09:30:35 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Fri, 27 Sep 2024 09:30:35 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-09-27 09:30:35 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-09-27 09:30:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	56941	142.250.181.238	443	7688	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 09:30:35 UTC	1318	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1236 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=517=bimMFcoSW1A5nLYynjWQ2ASl9qei38WlBCIq5AZJdaMNAhkmBMmrYlpecJs2tqa0oacxyJL1B4LZNV1uD7kZtFF7CuzhPf-6fZewKKEOfo46K7udfKaVN6qoFWgxXS0V6TOcukEzhu7iWo16btEZ2qQk1XV-B557sKs3dAer_g-yswM-njozGASxUa8
2024-09-27 09:30:35 UTC	1236	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 37 34 33 33 35 34 34 31 34 33 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"30",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],1828,[["1727433544143",null,null,null
2024-09-27 09:30:36 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Fri, 27 Sep 2024 09:30:36 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-09-27 09:30:36 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-09-27 09:30:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	56944	142.250.181.238	443	7688	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 09:31:05 UTC	1318	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1495 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=517=bimMFcoSW1A5nLYynjWQ2ASl9qei38WlBCIq5AZJdaMNAhkmBMmrYlpecJs2tqa0oacxyJL1B4LZNV1uD7kZtFF7CuzhPf-6fZewKKEOfo46K7udfKaVN6qoFWgxXS0V6TOcukEzhu7iWo16btEZ2qQk1XV-B557sKs3dAer_g-yswM-njozGASxUa8
2024-09-27 09:31:05 UTC	1495	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 37 34 33 33 35 37 33 38 34 37 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"30",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],1828,[["1727433573847",null,null,null
2024-09-27 09:31:05 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Fri, 27 Sep 2024 09:31:05 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-09-27 09:31:05 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-09-27 09:31:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.7	56945	142.250.181.238	443	7688	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 09:31:06 UTC	1318	OUT	POST /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 1560 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-arch: "x86" Content-Type: application/x-www-form-urlencoded;charset=UTF-8 sec-ch-ua-full-version: "117.0.5938.134" sec-ch-ua-platform-version: "10.0.0" X-Goog-AuthUser: 0 sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.google.com X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=517=bimMFcoSW1A5nLYynjWQ2ASl9qei38WlBCIq5AZJdaMNAhkmBMmrYlpecJs2tqa0oacxyJL1B4LZNV1uD7kZtFF7CuzhPf-6fZewKKEOfo46K7udfKaVN6qoFWgxXS0V6TOcukEzhu7iWo16btEZ2qQk1XV-B557sKs3dAer_g-yswM-njozGASxUa8
2024-09-27 09:31:06 UTC	1560	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 22 65 6e 22 2c 6e 75 6c 6c 2c 22 33 30 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 31 38 32 38 2c 5b 5b 22 31 37 32 37 34 33 33 35 37 34 32 38 32 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,"en",null,"30",null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],1828,[["1727433574282",null,null,null
2024-09-27 09:31:06 UTC	523	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Content-Type: text/plain; charset=UTF-8 Date: Fri, 27 Sep 2024 09:31:06 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-09-27 09:31:06 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-09-27 09:31:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	05:29:19
Start date:	27/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x1a0000
File size:	1'167'360 bytes
MD5 hash:	4D4CE788750F2F654E42E6BFCCDE419C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	05:29:19
Start date:	27/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	05:29:20
Start date:	27/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1992,i,16318564871758861565,14889931342432350397,262144 /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	05:29:32
Start date:	27/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5312 --field-trial-handle=1992,i,16318564871758861565,14889931342432350397,262144 /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	05:29:32
Start date:	27/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 --field-trial-handle=1992,i,16318564871758861565,14889931342432350397,262144 /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.2%
Total number of Nodes:	1537
Total number of Limit Nodes:	59

Executed Functions

Function 001A42DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 001A430D

Part of subcall function 001A6B57: _wcslen.LIBCMT ref: 001A6B6A

GetCurrentProcess.KERNEL32(?,0023CB64,00000000,?,?), ref: 001A4422
IsWow64Process.KERNEL32(00000000,?,?), ref: 001A4429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 001A4454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 001A4466
GetNativeSystemInfo.KERNEL32(?,?,?), ref: 001A4474
FreeLibrary.KERNEL32(00000000,?,?), ref: 001A447B
GetSystemInfo.KERNEL32(?,?,?), ref: 001A44A0

Strings

kernel32.dll, xrefs: 001A444F
GetNativeSystemInfo, xrefs: 001A4460
|O, xrefs: 001E36F8

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: 2ca3e9263f9b37219b2f0e4a10cce81a32b87ff381dde3caef25a03d21320b43
Instruction ID: 35573644a333e475a2fa4a68bec4851c81c08478e238265dd66cf1ed68120a6b
Opcode Fuzzy Hash: 2ca3e9263f9b37219b2f0e4a10cce81a32b87ff381dde3caef25a03d21320b43
Instruction Fuzzy Hash: F7A1C27691A7C0CFC715CB7E7C4D1A97FA46F6A300B1848D9E08D97AA2D36046E8CB61

Function 001A42A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,001A50AA,?,?,00000000,00000000), ref: 001A42B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,001A50AA,?,?,00000000,00000000), ref: 001A42C9
LoadResource.KERNEL32(?,00000000,?,?,001A50AA,?,?,00000000,00000000,?,?,?,?,?,?,001A4F20), ref: 001E35BE
SizeofResource.KERNEL32(?,00000000,?,?,001A50AA,?,?,00000000,00000000,?,?,?,?,?,?,001A4F20), ref: 001E35D3
LockResource.KERNEL32(001A50AA,?,?,001A50AA,?,?,00000000,00000000,?,?,?,?,?,?,001A4F20,?), ref: 001E35E6

Strings

SCRIPT, xrefs: 001A42BF

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: fe5ac1ef0caedac3f3f086fa1b33767d9eb80708c357a42ebb6c43879c77af4a
Instruction ID: ec97aca21926e40699942922ac832c9e00d7d43caa12b79947b3085879b2e118
Opcode Fuzzy Hash: fe5ac1ef0caedac3f3f086fa1b33767d9eb80708c357a42ebb6c43879c77af4a
Instruction Fuzzy Hash: 39117C75240700BFD7218B65EC4CF677BB9EBC6B51F20416AB842A6250DBB1D8048B20

Function 001E2BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 001A2B6B

Part of subcall function 001A3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00271418,?,001A2E7F,?,?,?,00000000), ref: 001A3A78

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00262224), ref: 001E2C10
ShellExecuteW.SHELL32(00000000,?,?,00262224), ref: 001E2C17

Strings

runas, xrefs: 001E2C0B

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: 94a2b36039f931390cf18e9215f2c88551f9e0bb6cd224bdce99a73f06e413d8
Instruction ID: 1c70f067b5aa0d27454a0060867bac931d1a4ea2eb33b804b02529b4a6658b9c
Opcode Fuzzy Hash: 94a2b36039f931390cf18e9215f2c88551f9e0bb6cd224bdce99a73f06e413d8
Instruction Fuzzy Hash: 4511D6392083459BC714FF78E865ABEB7A4AFB3350F44542DF156520A2CF3185998712

Function 0020DBBE Relevance: 6.0, APIs: 4, Instructions: 29
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,001E5222), ref: 0020DBCE
GetFileAttributesW.KERNEL32(?), ref: 0020DBDD
FindFirstFileW.KERNEL32(?,?), ref: 0020DBEE
FindClose.KERNEL32(00000000), ref: 0020DBFA

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 78993ab6ed5795340b0cfbe2a3c53d554ebbbee2227e5dadaea882da1368c453
Instruction ID: 90d199480f11931bc5733840138f8ddc3fb2cdc15c8206a731aa771f39ecd48f
Opcode Fuzzy Hash: 78993ab6ed5795340b0cfbe2a3c53d554ebbbee2227e5dadaea882da1368c453
Instruction Fuzzy Hash: 74F0A031821A2057D3206FBCAC0D8AB3B6C9E01334BA04703F876D20E1EBB059648A95

Function 001ABF40 Relevance: 2.4, Strings: 1, Instructions: 1178COMMON

Download Yara Rule

Strings

p#', xrefs: 001F07CE

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: BuffCharUpper
String ID: p#'
API String ID: 3964851224-2954064712
Opcode ID: 638fe2668dda81fcce2acdf2e77982aac8f944e9d880032d3f31857edb8b0b4f
Instruction ID: fc0c0d47572dcb29b3de3d714d966bbe1018cfe6d5efd2dd205080830d0bd796
Opcode Fuzzy Hash: 638fe2668dda81fcce2acdf2e77982aac8f944e9d880032d3f31857edb8b0b4f
Instruction Fuzzy Hash: 27A26A78A08301CFD715DF28C480B6AB7E1BF9A304F15896DE99A8B352D771EC45CB92

Function 001AD730 Relevance: 21.6, APIs: 14, Instructions: 625windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 001AD807
timeGetTime.WINMM ref: 001ADA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 001ADB28
TranslateMessage.USER32(?), ref: 001ADB7B
DispatchMessageW.USER32(?), ref: 001ADB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 001ADB9F
Sleep.KERNEL32(0000000A), ref: 001ADBB1

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: 6caa021883c119b4a3962deaf4f60da14703da41a9b14825d521732065d79175
Instruction ID: 96aa9e238c524f42ab1e60b35128148ca1e5cdf7064ec77a24192b520cd94245
Opcode Fuzzy Hash: 6caa021883c119b4a3962deaf4f60da14703da41a9b14825d521732065d79175
Instruction Fuzzy Hash: A0422134608B45EFD728CF24E888BBAB7E0BF46304F54451DE59A876A1C770E884CB92

Function 001A2CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 001A2D07
RegisterClassExW.USER32(00000030), ref: 001A2D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 001A2D42
InitCommonControlsEx.COMCTL32(?), ref: 001A2D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 001A2D6F
LoadIconW.USER32(000000A9), ref: 001A2D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 001A2D94

Strings

0, xrefs: 001A2CE9
+, xrefs: 001A2CF0
AutoIt v3 GUI, xrefs: 001A2D23
TaskbarCreated, xrefs: 001A2D37

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 0b75ee07abe551b98f91136518c2a568806cb2e4b849c45fe7384a9447eb4bd2
Instruction ID: 5ddc7996b691b91bd73c3f166321e978eceb12f644e849326431e0dd57ea3c77
Opcode Fuzzy Hash: 0b75ee07abe551b98f91136518c2a568806cb2e4b849c45fe7384a9447eb4bd2
Instruction Fuzzy Hash: 1D21E2B5951218EFDB00DFA8E88DBDDBBB8FB08700F10411AEA15B62A0D7B145908FA0

Function 001E065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001E039A: CreateFileW.KERNEL32(00000000,00000000,?,001E0704,?,?,00000000,?,001E0704,00000000,0000000C), ref: 001E03B7

GetLastError.KERNEL32 ref: 001E076F
__dosmaperr.LIBCMT ref: 001E0776
GetFileType.KERNEL32(00000000), ref: 001E0782
GetLastError.KERNEL32 ref: 001E078C
__dosmaperr.LIBCMT ref: 001E0795
CloseHandle.KERNEL32(00000000), ref: 001E07B5
CloseHandle.KERNEL32(?), ref: 001E08FF
GetLastError.KERNEL32 ref: 001E0931
__dosmaperr.LIBCMT ref: 001E0938

Strings

H, xrefs: 001E08BD

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: eaaa36550e883c90b86d1a12243af4f9bea24822383fa638259b706714998c35
Instruction ID: a1a58447023f8060250aaed8431c343ba44ed9457105e4fc5f6c0914295c707c
Opcode Fuzzy Hash: eaaa36550e883c90b86d1a12243af4f9bea24822383fa638259b706714998c35
Instruction Fuzzy Hash: 4AA14932A005848FDF1AAF68DC95BAD7BA1AB1A320F14015DF815AB3D1CB71DC57CB91

Function 001A344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001A3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00271418,?,001A2E7F,?,?,?,00000000), ref: 001A3A78

Part of subcall function 001A3357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 001A3379

RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 001A356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 001E318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 001E31CE
RegCloseKey.ADVAPI32(?), ref: 001E3210
_wcslen.LIBCMT ref: 001E3277
_wcslen.LIBCMT ref: 001E3286

Strings

\, xrefs: 001E328C
Software\AutoIt v3\AutoIt, xrefs: 001A3560
Include, xrefs: 001E3184, 001E31C5
\Include\, xrefs: 001A3527

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 285a867ac16ee1aa4d0c6e08ebd198a9c52e3de08dd29d74a33a4c6b0a7671d9
Instruction ID: d058459676024c9696df3025b3b0809dca44213934d6022116a6759e5bff02af
Opcode Fuzzy Hash: 285a867ac16ee1aa4d0c6e08ebd198a9c52e3de08dd29d74a33a4c6b0a7671d9
Instruction Fuzzy Hash: 7D71A171404301DEC304EF65EC899AFBBE8FFA6740F50486EF599971A0DB749A88CB51

Function 001A2B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 001A2B8E
LoadCursorW.USER32(00000000,00007F00), ref: 001A2B9D
LoadIconW.USER32(00000063), ref: 001A2BB3
LoadIconW.USER32(000000A4), ref: 001A2BC5
LoadIconW.USER32(000000A2), ref: 001A2BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 001A2BEF
RegisterClassExW.USER32(?), ref: 001A2C40

Part of subcall function 001A2CD4: GetSysColorBrush.USER32(0000000F), ref: 001A2D07
Part of subcall function 001A2CD4: RegisterClassExW.USER32(00000030), ref: 001A2D31
Part of subcall function 001A2CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 001A2D42
Part of subcall function 001A2CD4: InitCommonControlsEx.COMCTL32(?), ref: 001A2D5F
Part of subcall function 001A2CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 001A2D6F
Part of subcall function 001A2CD4: LoadIconW.USER32(000000A9), ref: 001A2D85
Part of subcall function 001A2CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 001A2D94

Strings

#, xrefs: 001A2C16
0, xrefs: 001A2C0F
AutoIt v3, xrefs: 001A2C2F

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: f7a68227ef3c7c5a8c16e17b2fe05bc79b8a3a15490b702c3ad8dd814a841607
Instruction ID: 4203b8a323bf20e8a392c6396b2ca7c356d585c9b0e7a3ed9120463a3307af17
Opcode Fuzzy Hash: f7a68227ef3c7c5a8c16e17b2fe05bc79b8a3a15490b702c3ad8dd814a841607
Instruction Fuzzy Hash: 84213A75E00314ABDB109FA9FC4DBA9BFB4FF08B50F10009AE508B66A0D3B145A4CF90

Function 001AB710 Relevance: 16.3, APIs: 1, Strings: 8, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 001ABB4E

Strings

p%', xrefs: 001ABB32
x#', xrefs: 001F0207
p#', xrefs: 001F024F
p#', xrefs: 001F0263
p#', xrefs: 001ABB6B
p#', xrefs: 001ABA72
x#', xrefs: 001F0168
p%', xrefs: 001AB8DC

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: p#'$p#'$p#'$p#'$p%'$p%'$x#'$x#'
API String ID: 1385522511-3771165580
Opcode ID: 9e44ef02fc94853259546e02245cd66f91573ee69393ed7c502fe03352be5367
Instruction ID: 0b80a5cd9f36fce2e8b6255f5ac1567d48bf69d6262f9ed63d67b977944ec238
Opcode Fuzzy Hash: 9e44ef02fc94853259546e02245cd66f91573ee69393ed7c502fe03352be5367
Instruction Fuzzy Hash: 5332FF78A08249DFCB25CF58C8D4ABEB7B5FF4A304F158059EA05AB252C774ED81CB91

Function 001A3170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,001A316A,?,?), ref: 001A31D8
KillTimer.USER32(?,00000001,?,?,?,?,?,001A316A,?,?), ref: 001A3204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 001A3227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,001A316A,?,?), ref: 001A3232
CreatePopupMenu.USER32 ref: 001A3246
PostQuitMessage.USER32(00000000), ref: 001A3267

Strings

TaskbarCreated, xrefs: 001A322D

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 95858da1923f3b4ed5efe417a8671341b8086ed4b0bcbefba5b2fc1f2602b0ba
Instruction ID: 972b0cf61dad9f52c9f2a280ce226cbbb164eef2b894cbeb0f65785cc9fb68f7
Opcode Fuzzy Hash: 95858da1923f3b4ed5efe417a8671341b8086ed4b0bcbefba5b2fc1f2602b0ba
Instruction Fuzzy Hash: FA414C3D250304ABDB182B7CAD1EB7D365DEF47340F144116FA2A962E1CB718E5197A1

Function 001A2C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 001A2C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 001A2CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,001A1CAD,?), ref: 001A2CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,001A1CAD,?), ref: 001A2CCF

Strings

edit, xrefs: 001A2CAC
AutoIt v3, xrefs: 001A2C89, 001A2C8E, 001A2C8F

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 723e43a872b089f756c43ba46336e6eb68159bb8379e2ed9a8a185e095a5d3ff
Instruction ID: e07f7fc1eb136ab2221195e5acc834428e39f70941fb46084176cd1ccd281f17
Opcode Fuzzy Hash: 723e43a872b089f756c43ba46336e6eb68159bb8379e2ed9a8a185e095a5d3ff
Instruction Fuzzy Hash: 92F0DA755503907AEB31172BBC0EE777EBDDBC6F50F11409AF908A25A0C66118A0DAB0

Function 0022AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 0022AEA3

Part of subcall function 001A7620: _wcslen.LIBCMT ref: 001A7625

GetProcessId.KERNEL32(00000000), ref: 0022AF38
CloseHandle.KERNEL32(00000000), ref: 0022AF67

Strings

@, xrefs: 0022AE72
<, xrefs: 0022AE6B

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: dd046f5e105194e14136a798db23c4a8b6b32c298b2da87032390c7b68ccea4b
Instruction ID: b01eeed7aedbd12f89e509c61e81fd7c4d9544cb96a52e4bebfda7b708510eb8
Opcode Fuzzy Hash: dd046f5e105194e14136a798db23c4a8b6b32c298b2da87032390c7b68ccea4b
Instruction Fuzzy Hash: B571B075A00625DFCB14EF94E484A9EBBF0FF09300F058499E816AB792CB75EE45CB91

Function 0020E97B Relevance: 7.5, APIs: 5, Instructions: 47
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 0020E997
QueryPerformanceFrequency.KERNEL32(?), ref: 0020E9A5
Sleep.KERNEL32(00000000), ref: 0020E9AD
QueryPerformanceCounter.KERNEL32(?), ref: 0020E9B7
Sleep.KERNEL32 ref: 0020E9F3

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 37f297163ebee8cec90230809ac3e2b06c215c6de1bced5a0c2b427133f7ccfb
Instruction ID: f6dee02ad45025786ac07dbc96fb49a13d02e21fad0503c4aee347a76f0b1ddc
Opcode Fuzzy Hash: 37f297163ebee8cec90230809ac3e2b06c215c6de1bced5a0c2b427133f7ccfb
Instruction Fuzzy Hash: 0F015B31C1162DDBCF009FE5E85D6DDBB78BB08301F110956E942B2192CB3095A087A2

Function 001A3B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,001A3B0F,SwapMouseButtons,00000004,?), ref: 001A3B40
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,001A3B0F,SwapMouseButtons,00000004,?), ref: 001A3B61
RegCloseKey.KERNEL32(00000000,?,?,?,80000001,80000001,?,001A3B0F,SwapMouseButtons,00000004,?), ref: 001A3B83

Strings

Control Panel\Mouse, xrefs: 001A3B3E

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 62a9a14ef312cb720003ec6a0dc8acd16df0798931ef4041330c8ea140ba6c68
Instruction ID: e45965fdf73e5bcc0b124695c98e98e1887d9cb29539bc840eddb82597dfbb34
Opcode Fuzzy Hash: 62a9a14ef312cb720003ec6a0dc8acd16df0798931ef4041330c8ea140ba6c68
Instruction Fuzzy Hash: 97112AB9511208FFDB258FA5DC89AAEB7B9EF05744B104459B815E7210D3319E409760

Function 001A3923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 001E33A2

Part of subcall function 001A6B57: _wcslen.LIBCMT ref: 001A6B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 001A3A04

Strings

Line: , xrefs: 001E33EB

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: 21b8dcafb4d7f17f6ee2ab437183bb00791614ecfd50155d8f0426b605f54b62
Instruction ID: 3081397c31a23409b0f50948b9a58e222c51f50d6abff136603d4ac99a090814
Opcode Fuzzy Hash: 21b8dcafb4d7f17f6ee2ab437183bb00791614ecfd50155d8f0426b605f54b62
Instruction Fuzzy Hash: DB31E171408300AEC725EB24EC4AFEFB7E8AF52314F00452AF5A993091DB709A99C7C2

Function 001A2DE3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 001E2C8C

Part of subcall function 001A3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,001A3A97,?,?,001A2E7F,?,?,?,00000000), ref: 001A3AC2

Part of subcall function 001A2DA5: GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 001A2DC4

Strings

X, xrefs: 001E2C5A
`e&, xrefs: 001E2C85

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X$`e&
API String ID: 779396738-1665243713
Opcode ID: 736f8d79ddb98dbe0fbfcafaf78f0f488c96d94bb0799a6483cda2ad940a7554
Instruction ID: 79cace3ec6a2a4e28e19df0850c3dafe022f6f2cc929ca5a78aa1d55e7b99a82
Opcode Fuzzy Hash: 736f8d79ddb98dbe0fbfcafaf78f0f488c96d94bb0799a6483cda2ad940a7554
Instruction Fuzzy Hash: 3621D575A10298AFCB05DF98C809BEE7BFCAF59304F104059E405F7241DBB89A898FA1

Function 001BFDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 001C0668

Part of subcall function 001C32A4: RaiseException.KERNEL32(?,?,?,001C068A,?,00271444,?,?,?,?,?,?,001C068A,001A1129,00268738,001A1129), ref: 001C3304

__CxxThrowException@8.LIBVCRUNTIME ref: 001C0685

Strings

Unknown exception, xrefs: 001C0692

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 5d1657d6bab194d4b028d1a80f7a1551c9a20df1f7f22188646a393ebe4e9d6f
Instruction ID: 7fb7e138b25ea8fe2db64a8645f76ba7d81e5099fe59e9e52f5c046d3be721a4
Opcode Fuzzy Hash: 5d1657d6bab194d4b028d1a80f7a1551c9a20df1f7f22188646a393ebe4e9d6f
Instruction Fuzzy Hash: B2F0C23490020DB7CF05BAA4EC4AE9E7B6C5E34310B60453DF824D6591EF71DA66C6C0

Function 001A10F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 001A1BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 001A1BF4
Part of subcall function 001A1BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 001A1BFC
Part of subcall function 001A1BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 001A1C07
Part of subcall function 001A1BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 001A1C12
Part of subcall function 001A1BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 001A1C1A
Part of subcall function 001A1BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 001A1C22

Part of subcall function 001A1B4A: RegisterWindowMessageW.USER32(00000004,?,001A12C4), ref: 001A1BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 001A136A
OleInitialize.OLE32 ref: 001A1388
CloseHandle.KERNEL32(00000000,00000000), ref: 001E24AB

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 59b85fc0b55e338478bad81bd4a5ec34d5c9ee7100f9336ecd58e29dcd597198
Instruction ID: d711203ace6a80a1c6cfd4a3f131c1d325d691fca329834e6e6722a52d316763
Opcode Fuzzy Hash: 59b85fc0b55e338478bad81bd4a5ec34d5c9ee7100f9336ecd58e29dcd597198
Instruction Fuzzy Hash: 4871CCB89212018FD388EF7EBC5E6653AE5FF99344794822AD00ED7261EB3044B4CF55

Function 0020C161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 001A3923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 001A3A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0020C259
KillTimer.USER32(?,00000001,?,?), ref: 0020C261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0020C270

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: af7c36c59bc952222467dd1af58700f261bef05dbd56ff33463920639a3dd53a
Instruction ID: 8194e75ad151561e0c565b8b1d915c1f8fec6090691483c66c1f78eaa19c5183
Opcode Fuzzy Hash: af7c36c59bc952222467dd1af58700f261bef05dbd56ff33463920639a3dd53a
Instruction Fuzzy Hash: 9331D9B0914344AFEB328F649859BD7BBEC9F16304F10049DD5DDA3282C7745A84CB51

Function 001D86AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,00000000,?,?,001D85CC,?,00268CC8,0000000C), ref: 001D8704
GetLastError.KERNEL32(?,001D85CC,?,00268CC8,0000000C), ref: 001D870E
__dosmaperr.LIBCMT ref: 001D8739

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID:
API String ID: 2583163307-0
Opcode ID: 2f36a014587dd34d6100ff2c7e8319a980cdc58b49ba2f8085ed684e11d71fbc
Instruction ID: 04f7f5e00d5647ff91714c0a12b348a0c3daa3d75e53f77f7f1731258e24ebeb
Opcode Fuzzy Hash: 2f36a014587dd34d6100ff2c7e8319a980cdc58b49ba2f8085ed684e11d71fbc
Instruction Fuzzy Hash: DA014E33A0566036D72467386849B7E6B4A9B91774F39015FF8189B3D2DFA0CC818250

Function 001ADB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 001ADB7B
DispatchMessageW.USER32(?), ref: 001ADB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 001ADB9F
Sleep.KERNEL32(0000000A), ref: 001ADBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 001F1CC9

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: 513de4b16549eecc8557b7d7946347fabd60622221ffe072338cf324488a084f
Instruction ID: b795b40c38f684cb789e9290e4af1d635b4daffc9c2ba4d4f8bac2f70d2cc7dd
Opcode Fuzzy Hash: 513de4b16549eecc8557b7d7946347fabd60622221ffe072338cf324488a084f
Instruction Fuzzy Hash: CFF05E316043449BE730CBA0AC49FEA73ACEF46310F104518E65A930C0DB309488CB26

Function 001B1310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 001B17F6

Strings

CALL, xrefs: 001B17C6

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 7a75ea837c88906fcac7f5ccb732c9c3cc0c16d6c4732b9118962db68432a777
Instruction ID: 440fbbfd9a656943feab8887c2cd12c2f84c9ffd07bca9ff1266fee9ec07014d
Opcode Fuzzy Hash: 7a75ea837c88906fcac7f5ccb732c9c3cc0c16d6c4732b9118962db68432a777
Instruction Fuzzy Hash: 3222AD70608201EFC714DF14C8A4BAABBF1BF99314F66891DF58A8B361D771E845CB92

Function 001A3837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 001A3908

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 0f609ed707ebed8a6f7ffd786310db1bfec388c953bfacb7ef24e9416ccb337e
Instruction ID: 162a76c01ce763e79baa4f5c78bf026008cd416fc67bd748030b24527b8fcbf4
Opcode Fuzzy Hash: 0f609ed707ebed8a6f7ffd786310db1bfec388c953bfacb7ef24e9416ccb337e
Instruction Fuzzy Hash: 7231D5B4504700DFD320DF24E889797BBE8FF49708F00096EF5A983240E775AA54CB52

Function 001BF645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 001BF661

Part of subcall function 001AD730: GetInputState.USER32 ref: 001AD807

Sleep.KERNEL32(00000000), ref: 001FF2DE

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: bc5f29bab2c548d27c26ca7492b5a4e4980ae1e8dd98666499c6f7c78ef57c01
Instruction ID: fe206e60d7e21a1bdc5845150dd733b26fe194862882f644c95c25910ea2295c
Opcode Fuzzy Hash: bc5f29bab2c548d27c26ca7492b5a4e4980ae1e8dd98666499c6f7c78ef57c01
Instruction Fuzzy Hash: DFF0A0352446059FD314EF79E859BAAB7E9FF5A760F004029E85ED73A2DB70A800CB90

Function 002258A2 Relevance: 1.7, APIs: 1, Instructions: 205COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00225930

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: 20bde745c857820217675daa2cee4763eacec7e469305878762628984abdd05a
Instruction ID: 33f43e93b303b793e52354905674f3ef6dc60f44a7d1c61efcb78ae5806023c6
Opcode Fuzzy Hash: 20bde745c857820217675daa2cee4763eacec7e469305878762628984abdd05a
Instruction Fuzzy Hash: 6B718B30610625BFCB24DF94D882EBAB7F5FF68310F108169F9499B281D771ADA1CB90

Function 00232598 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,000000FE,00000000,00000000,00000000,00000000,00000013,00000001,?), ref: 00232649

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: e586e8bac8809d38bd5049389eb11b6ad97e7e88e3cba800ef518943369cca31
Instruction ID: 3f72bfff72f6a1a8c10a468e03240bf3c107fe6c41646fe4da57965b1b57ca45
Opcode Fuzzy Hash: e586e8bac8809d38bd5049389eb11b6ad97e7e88e3cba800ef518943369cca31
Instruction Fuzzy Hash: F4212FB4200216EFE310DF28C8D0936B79DEF45368F60806CE8968B392CB71ED59CB90

Function 002313B7 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000001,?), ref: 00231420

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: f66b0498971845038dc83b6bc92106d48a351658545914b921bc088ad7139a72
Instruction ID: eddbeb20c6ad06c1c043a3579c5e582093de249c5f0a00972095c0aed0d12bd4
Opcode Fuzzy Hash: f66b0498971845038dc83b6bc92106d48a351658545914b921bc088ad7139a72
Instruction Fuzzy Hash: B131BF70614203AFD714EF29C491B69F7A2FF45328F048568E85A4B292DB71EC61CFD0

Function 001A4ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 001A4E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,001A4EDD,?,00271418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 001A4E9C
Part of subcall function 001A4E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 001A4EAE
Part of subcall function 001A4E90: FreeLibrary.KERNEL32(00000000,?,?,001A4EDD,?,00271418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 001A4EC0

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00271418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 001A4EFD

Part of subcall function 001A4E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,001E3CDE,?,00271418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 001A4E62
Part of subcall function 001A4E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 001A4E74
Part of subcall function 001A4E59: FreeLibrary.KERNEL32(00000000,?,?,001E3CDE,?,00271418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 001A4E87

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 708a8a74720e81128487f10d2a6fbd45c7429ebbbfbc927aff22a2d80e8e80c2
Instruction ID: 593570849f2e5cbc09b2ad10918853453e04f15140d1bd7065c1a61eaf9521c7
Opcode Fuzzy Hash: 708a8a74720e81128487f10d2a6fbd45c7429ebbbfbc927aff22a2d80e8e80c2
Instruction Fuzzy Hash: BA11043A610205ABCB14AB64D806FAD77A59FA1710F20842DF452A71C1EFB4AA049750

Function 001D8402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 001D8440

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 94e66632e157ce3c9e0ff920b25a119db89f4d3769846f676e00edbb29cf0d18
Instruction ID: b731050b0e8f0580d10ac0d4bd448aa01e4b09366b20558c0d6bdaf21670470e
Opcode Fuzzy Hash: 94e66632e157ce3c9e0ff920b25a119db89f4d3769846f676e00edbb29cf0d18
Instruction Fuzzy Hash: 9C11187590410AAFCB05DF58E941A9E7BF5EF48314F11405AF808AB312DB31EA15CBA5

Function 001D5000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001D4C7D: RtlAllocateHeap.NTDLL(00000008,001A1129,00000000,?,001D2E29,00000001,00000364,?,?,?,001CF2DE,001D3863,00271444,?,001BFDF5,?), ref: 001D4CBE

_free.LIBCMT ref: 001D506C

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction ID: 0841f1322374887edab72907c38f8fb7a4bf618268009866cecdcdefdc0bd66f
Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction Fuzzy Hash: 960126722047046BE3218E659881A5AFBEDFB99370F25051EF19483380EB30A805C6B4

Function 002329BF Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?,?,?,002314B5,?), ref: 00232A01

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 510c706efbadffa016e470fcc4cd27aca020589386af39f10f9e13e0f7c548cc
Instruction ID: b321cdfd6f810057930b92bc318587498835077103db7b3e08a08f18f3a088df
Opcode Fuzzy Hash: 510c706efbadffa016e470fcc4cd27aca020589386af39f10f9e13e0f7c548cc
Instruction Fuzzy Hash: AD01B1B6720A42EFD325CE2CC454B227792EB89314F398468C1478B251DB32FC56C7A0

Function 001CE602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: 810b6e74dae7b9822729633cdaf36e56258f5781598787d21f27f4f9dc198099
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: 74F0C832521A2497D7313A799C05F5A33DD9F72335F11072EF425933D2DB74E8028AA5

Function 0023149E Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?), ref: 002314EB

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: c8e4bede90eff28b519b4721cac5c5fea079303674164559813ea7b977736203
Instruction ID: b115c775d8b354f2f5e239d676d0e1f8fd4f66ac22fd21b91c76ee2db86d24d3
Opcode Fuzzy Hash: c8e4bede90eff28b519b4721cac5c5fea079303674164559813ea7b977736203
Instruction Fuzzy Hash: 2E012B753047419FD320CF69D440826BB95FF85324B54805EE94ACB712D772DDA2CBD0

Function 001A9CB3 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 001A9CBD

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: e8927a259a13a384b7f8d17d197a21d4458e0330a19322b0a8ddd77362a479d3
Instruction ID: c6f12e0c441e29e3a5333d704c9765a5b7685c21b1b4a1ecc6c3e36adf7994db
Opcode Fuzzy Hash: e8927a259a13a384b7f8d17d197a21d4458e0330a19322b0a8ddd77362a479d3
Instruction Fuzzy Hash: 58F0C8B36007006ED7159F68DC06FA7BB94EB58760F10852EF619CB1D1DB31E554C7A0

Function 001D4C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,001A1129,00000000,?,001D2E29,00000001,00000364,?,?,?,001CF2DE,001D3863,00271444,?,001BFDF5,?), ref: 001D4CBE

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 924c36d50dc71402c8d330c70576d08fdbc42a4b4ddc7af25e4f919b61478919
Instruction ID: 09850db450a3f934e734deac76c3bcbb45d5c67a706a808dc5089a8816146422
Opcode Fuzzy Hash: 924c36d50dc71402c8d330c70576d08fdbc42a4b4ddc7af25e4f919b61478919
Instruction Fuzzy Hash: 71F0E23162622467DB215F66AC0AF5B3789BF617A1B19412BF819AA380CB70D80196E0

Function 001D3820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00271444,?,001BFDF5,?,?,001AA976,00000010,00271440,001A13FC,?,001A13C6,?,001A1129), ref: 001D3852

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 80e1de8623a64bdf1971b5bac521dac4db6477f1bc1fcb973503da5bb668582c
Instruction ID: 65e232ff6a6aa6ecac9cc938b21fd87edf42c8f29b09f29d42c1e7b7e6c14413
Opcode Fuzzy Hash: 80e1de8623a64bdf1971b5bac521dac4db6477f1bc1fcb973503da5bb668582c
Instruction Fuzzy Hash: 44E0E53110022457D62126669C05F9A374AAF527B0F1A022ABC24966D0CB50ED01B2E3

Function 001A4F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00271418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 001A4F6D

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: d99dc98c641b30178141905d9dc5c53c3d905949d60f645e0c2a90c857672207
Instruction ID: 4cbb2b07764946db11e5b3c08f293681e07850fdc03d799543fd108765ca708f
Opcode Fuzzy Hash: d99dc98c641b30178141905d9dc5c53c3d905949d60f645e0c2a90c857672207
Instruction Fuzzy Hash: C5F0A075005351CFCB388F38D490812B7F0AF51319320997EE1DA82611C7B19844DF40

Function 00232A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00232A66

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: ab2f0d379b07f30cd38d8f6fc8044afb745ca2e4d01e8c28c0e5c3836e9b13c2
Instruction ID: 683e59276caabb2fd07b4db69c45bca0eba2d480c84bb727ce00bfdfa7fb13f6
Opcode Fuzzy Hash: ab2f0d379b07f30cd38d8f6fc8044afb745ca2e4d01e8c28c0e5c3836e9b13c2
Instruction Fuzzy Hash: CDE04FB637021AEBC714EA30EC908FAB39CEF50795B104536ED1AD2141DF3099B98AA0

Function 001A2DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 001A2DC4

Part of subcall function 001A6B57: _wcslen.LIBCMT ref: 001A6B6A

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 38078d8f2aeee84476adbc150acd082077c3770009101f71df0eed7562f2c28d
Instruction ID: 4833d4cf9faffa81ad9aca75093603b2e85aaa5b752b2f3836db7d14f7c2f5a4
Opcode Fuzzy Hash: 38078d8f2aeee84476adbc150acd082077c3770009101f71df0eed7562f2c28d
Instruction Fuzzy Hash: 34E0CD766001245BC71192589C05FDE77DDDFC8790F040071FD09E7248DA70AD848690

Function 001A2B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 001A3837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 001A3908

Part of subcall function 001AD730: GetInputState.USER32 ref: 001AD807

SetCurrentDirectoryW.KERNEL32(?), ref: 001A2B6B

Part of subcall function 001A30F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 001A314E

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: 1fd6d5dc949eb4e65f2c0218ff906c22768d2be4f6a720e9ceba3c8c7b2469a2
Instruction ID: d2b72b6a6684cf0d2ab727a9c9db2934460354204041deb765c1c4879632a569
Opcode Fuzzy Hash: 1fd6d5dc949eb4e65f2c0218ff906c22768d2be4f6a720e9ceba3c8c7b2469a2
Instruction Fuzzy Hash: 0AE0262A30020407C608BB78B82667DB3498FF3351F40053EF05743162CF2445954311

Function 00203D03 Relevance: 1.5, APIs: 1, Instructions: 18windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00203D18

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: 6209db1dbe20990c0a470cf650136a890b4028d12f8168d364972618efaa2e17
Instruction ID: 05d419dc7036c971d5e3fa2e950c776ecb01ae39cf5ce1b5fb8c9a1259a18aee
Opcode Fuzzy Hash: 6209db1dbe20990c0a470cf650136a890b4028d12f8168d364972618efaa2e17
Instruction Fuzzy Hash: 6DD08CF06A03087EFB0087719C0BEBB339CC356E81F104BA47E02E64C1D9A0DE080630

Function 001E039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,001E0704,?,?,00000000,?,001E0704,00000000,0000000C), ref: 001E03B7

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 6079ccc06b75d68aba04b9b4a144eaf42c3498d591c4d31f8fc5776ad9e70905
Instruction ID: f136de914de95d677c83f2dea2064a93602f73d92cc7b73d873672b0c28a06c7
Opcode Fuzzy Hash: 6079ccc06b75d68aba04b9b4a144eaf42c3498d591c4d31f8fc5776ad9e70905
Instruction Fuzzy Hash: 13D06C3204010DBBDF028F84ED0AEDA3BAAFB48714F114000BE5866020C732E821AB90

Function 001A1CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 001A1CBC

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: a593b6aa037e1f8e45053129bb3d9c36fb922878e1f133f289a604e1976a58b0
Instruction ID: d5c60ba40dd504318b5775d7c9232c310e85b045e6eaf8861b1f6b9fbd9b9626
Opcode Fuzzy Hash: a593b6aa037e1f8e45053129bb3d9c36fb922878e1f133f289a604e1976a58b0
Instruction Fuzzy Hash: F0C09236280304EFF2188B94BC4EF107764E748B00F948001F64DB95E3C3A228A0EB60

Non-executed Functions

Function 00239576 Relevance: 74.1, APIs: 39, Strings: 3, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 001B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 001B9BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0023961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0023965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0023969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 002396C9
SendMessageW.USER32 ref: 002396F2
GetKeyState.USER32(00000011), ref: 0023978B
GetKeyState.USER32(00000009), ref: 00239798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 002397AE
GetKeyState.USER32(00000010), ref: 002397B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 002397E9
SendMessageW.USER32 ref: 00239810
SendMessageW.USER32(?,00001030,?,00237E95), ref: 00239918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0023992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00239941
SetCapture.USER32(?), ref: 0023994A
ClientToScreen.USER32(?,?), ref: 002399AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 002399BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 002399D6
ReleaseCapture.USER32 ref: 002399E1
GetCursorPos.USER32(?), ref: 00239A19
ScreenToClient.USER32(?,?), ref: 00239A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00239A80
SendMessageW.USER32 ref: 00239AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00239AEB
SendMessageW.USER32 ref: 00239B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00239B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00239B4A
GetCursorPos.USER32(?), ref: 00239B68
ScreenToClient.USER32(?,?), ref: 00239B75
GetParent.USER32(?), ref: 00239B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00239BFA
SendMessageW.USER32 ref: 00239C2B
ClientToScreen.USER32(?,?), ref: 00239C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00239CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00239CDE
SendMessageW.USER32 ref: 00239D01
ClientToScreen.USER32(?,?), ref: 00239D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00239D82

Part of subcall function 001B9944: GetWindowLongW.USER32(?,000000EB), ref: 001B9952

GetWindowLongW.USER32(?,000000F0), ref: 00239E05

Strings

@GUI_DRAGID, xrefs: 0023997D
F, xrefs: 00239D07
p#', xrefs: 00239990

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F$p#'
API String ID: 3429851547-1308831974
Opcode ID: 018099659a3017462ca7f705aa1fb6b14960128d85a100e5a7a0de95c5c6efdb
Instruction ID: 1f9075e557558f0a0bb11dc10e38274c8a4ecba04f0397a91dbcf5494703ad4b
Opcode Fuzzy Hash: 018099659a3017462ca7f705aa1fb6b14960128d85a100e5a7a0de95c5c6efdb
Instruction Fuzzy Hash: 8042D1B4615201AFD724CF28DC49EAABBF9FF4A310F100619F699972A1D7B1D8A1CF41

Function 00234873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 002348F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00234908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00234927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 0023494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 0023495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 0023497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 002349AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 002349D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00234A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00234A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00234A7E
IsMenu.USER32(?), ref: 00234A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00234AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00234B20
GetWindowLongW.USER32(?,000000F0), ref: 00234B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00234BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00234C82
wsprintfW.USER32 ref: 00234CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00234CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 00234CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00234D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00234D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 00234D5A

Strings

%d/%02d/%02d, xrefs: 00234CA8

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: de8596d11261991039d0b016a8718f540cecfc338da16f659f8191f54bad7d37
Instruction ID: b24c49adbd4dd68df6a7c7596dc692fb6c0806941010c18dce4b5d1fa9afa2ad
Opcode Fuzzy Hash: de8596d11261991039d0b016a8718f540cecfc338da16f659f8191f54bad7d37
Instruction Fuzzy Hash: 1F1223B1620205ABEB24AF24DC49FAE7BF8EF85300F1441A9F515EB2E1DB74A951CF50

Function 001BF98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 001BF998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 001FF474
IsIconic.USER32(00000000), ref: 001FF47D
ShowWindow.USER32(00000000,00000009), ref: 001FF48A
SetForegroundWindow.USER32(00000000), ref: 001FF494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 001FF4AA
GetCurrentThreadId.KERNEL32 ref: 001FF4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 001FF4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 001FF4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 001FF4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 001FF4DE
SetForegroundWindow.USER32(00000000), ref: 001FF4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 001FF4F6
keybd_event.USER32(00000012,00000000), ref: 001FF501
MapVirtualKeyW.USER32(00000012,00000000), ref: 001FF50B
keybd_event.USER32(00000012,00000000), ref: 001FF510
MapVirtualKeyW.USER32(00000012,00000000), ref: 001FF519
keybd_event.USER32(00000012,00000000), ref: 001FF51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 001FF528
keybd_event.USER32(00000012,00000000), ref: 001FF52D
SetForegroundWindow.USER32(00000000), ref: 001FF530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 001FF557

Strings

Shell_TrayWnd, xrefs: 001FF46F

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: e0e87644c418b28d39c43cfc5f494887616c948bd7c360bdb702fd11cd6e62d9
Instruction ID: 903a1c8971733685c0402ede9cfe4a0ec1fa47e0f8c8230f3f92e7f78d8d9bdc
Opcode Fuzzy Hash: e0e87644c418b28d39c43cfc5f494887616c948bd7c360bdb702fd11cd6e62d9
Instruction Fuzzy Hash: 2F311071A40218BAEB216BB56C4AFBF7E6CEB44B50F210069FA05F61D1C7B19911AB60

Function 00201201 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 002016C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0020170D
Part of subcall function 002016C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0020173A
Part of subcall function 002016C3: GetLastError.KERNEL32 ref: 0020174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00201286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 002012A8
CloseHandle.KERNEL32(?), ref: 002012B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 002012D1
GetProcessWindowStation.USER32 ref: 002012EA
SetProcessWindowStation.USER32(00000000), ref: 002012F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00201310

Part of subcall function 002010BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,002011FC), ref: 002010D4
Part of subcall function 002010BF: CloseHandle.KERNEL32(?,?,002011FC), ref: 002010E9

Strings

default, xrefs: 0020130B
, xrefs: 0020125A
winsta0, xrefs: 002012CC
Z&, xrefs: 00201392

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0$Z&
API String ID: 22674027-566727265
Opcode ID: 2ffb03b18c41623732d8915feb0259ba819620e0549eb1722f63c10f95db2807
Instruction ID: 5afbb2af3650f63fec46d24eb8fbf788d289115834f33cab1463b87168b199bb
Opcode Fuzzy Hash: 2ffb03b18c41623732d8915feb0259ba819620e0549eb1722f63c10f95db2807
Instruction Fuzzy Hash: 8F819A7191034AAFDF219FA4DC4AFEE7BB9EF08704F144129F910B61A2D7718A64CB20

Function 00200B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 002010F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00201114
Part of subcall function 002010F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00200B9B,?,?,?), ref: 00201120
Part of subcall function 002010F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00200B9B,?,?,?), ref: 0020112F
Part of subcall function 002010F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00200B9B,?,?,?), ref: 00201136
Part of subcall function 002010F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0020114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00200BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00200C00
GetLengthSid.ADVAPI32(?), ref: 00200C17
GetAce.ADVAPI32(?,00000000,?), ref: 00200C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00200C6D
GetLengthSid.ADVAPI32(?), ref: 00200C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00200C8C
HeapAlloc.KERNEL32(00000000), ref: 00200C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00200CB4
CopySid.ADVAPI32(00000000), ref: 00200CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00200CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00200D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00200D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00200D45
HeapFree.KERNEL32(00000000), ref: 00200D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00200D55
HeapFree.KERNEL32(00000000), ref: 00200D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00200D65
HeapFree.KERNEL32(00000000), ref: 00200D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00200D78
HeapFree.KERNEL32(00000000), ref: 00200D7F

Part of subcall function 00201193: GetProcessHeap.KERNEL32(00000008,00200BB1,?,00000000,?,00200BB1,?), ref: 002011A1
Part of subcall function 00201193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00200BB1,?), ref: 002011A8
Part of subcall function 00201193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00200BB1,?), ref: 002011B7

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: c96197ae0973bcfdd798a6a2b260e6eda35917ed85d1fc99cdebdf70fda45015
Instruction ID: 31007e7d8c00b0935f44ad4fa32221585e985e2de2b05f3d32609d47e5ad9a22
Opcode Fuzzy Hash: c96197ae0973bcfdd798a6a2b260e6eda35917ed85d1fc99cdebdf70fda45015
Instruction Fuzzy Hash: 63716A7691020AABEF10DFA4EC88FAEBBB8FF04310F144525E914B7192D771AA15CB70

Function 0021EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(0023CC08), ref: 0021EB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 0021EB37
GetClipboardData.USER32(0000000D), ref: 0021EB43
CloseClipboard.USER32 ref: 0021EB4F
GlobalLock.KERNEL32(00000000), ref: 0021EB87
CloseClipboard.USER32 ref: 0021EB91
GlobalUnlock.KERNEL32(00000000), ref: 0021EBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 0021EBC9
GetClipboardData.USER32(00000001), ref: 0021EBD1
GlobalLock.KERNEL32(00000000), ref: 0021EBE2
GlobalUnlock.KERNEL32(00000000), ref: 0021EC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 0021EC38
GetClipboardData.USER32(0000000F), ref: 0021EC44
GlobalLock.KERNEL32(00000000), ref: 0021EC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 0021EC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0021EC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 0021ECD2
GlobalUnlock.KERNEL32(00000000), ref: 0021ECF3
CountClipboardFormats.USER32 ref: 0021ED14
CloseClipboard.USER32 ref: 0021ED59

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: 644b447b6dcd8fced4f0098bc2424924ec26d6fa59a76d3d2b03c0573d4cc652
Instruction ID: eb48798bc86edb102aec9992e6aa7b0122c56b41cdd29a842c6730e252a18080
Opcode Fuzzy Hash: 644b447b6dcd8fced4f0098bc2424924ec26d6fa59a76d3d2b03c0573d4cc652
Instruction Fuzzy Hash: FB61E2752042029FD700EF20EC89FAA77E8BFA5714F19451DF856972A1CB70DD85CBA2

Function 0021698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 002169BE
FindClose.KERNEL32(00000000), ref: 00216A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00216A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00216A75

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00216AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00216ADF

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00216B6A
%03d, xrefs: 00216DA2
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00216B32
%02d, xrefs: 00216C00, 00216C0A, 00216C5A, 00216CAA, 00216CFA, 00216D4A
%4d, xrefs: 00216BB1

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: 1ee0219ca2546aa30bfe36f18655a5a38e139ee98b3114f2278b26fa581f7586
Instruction ID: 48ce0f1084791d474fe12e25f0479c731c9cf9ce840b5fceaf06a3e7df952b8a
Opcode Fuzzy Hash: 1ee0219ca2546aa30bfe36f18655a5a38e139ee98b3114f2278b26fa581f7586
Instruction Fuzzy Hash: 45D17DB6508300AEC310EFA4CD95EAFB7ECAFA9704F04491DF585D6191EB74DA44CBA2

Function 00219642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,771A8FB0,?,00000000), ref: 00219663
GetFileAttributesW.KERNEL32(?), ref: 002196A1
SetFileAttributesW.KERNEL32(?,?), ref: 002196BB
FindNextFileW.KERNEL32(00000000,?), ref: 002196D3
FindClose.KERNEL32(00000000), ref: 002196DE
FindFirstFileW.KERNEL32(*.*,?), ref: 002196FA
SetCurrentDirectoryW.KERNEL32(?), ref: 0021974A
SetCurrentDirectoryW.KERNEL32(00266B7C), ref: 00219768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00219772
FindClose.KERNEL32(00000000), ref: 0021977F
FindClose.KERNEL32(00000000), ref: 0021978F

Strings

*.*, xrefs: 002196F5

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 571583c7eb56509ed8c7d75dc5236f18c3483552ab4cd94b8de97f5eda9e2a22
Instruction ID: 7eb4fa3bb4eaeac318fec79bfa87fdb18502f8292ea8ba44f5b6e4a4549a6e2f
Opcode Fuzzy Hash: 571583c7eb56509ed8c7d75dc5236f18c3483552ab4cd94b8de97f5eda9e2a22
Instruction Fuzzy Hash: 2331A27255021AAADB14AFB4EC5DADE77EC9F19320F204166F815E20D0DB30D9D58B64

Function 0021979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,771A8FB0,?,00000000), ref: 002197BE
FindNextFileW.KERNEL32(00000000,?), ref: 00219819
FindClose.KERNEL32(00000000), ref: 00219824
FindFirstFileW.KERNEL32(*.*,?), ref: 00219840
SetCurrentDirectoryW.KERNEL32(?), ref: 00219890
SetCurrentDirectoryW.KERNEL32(00266B7C), ref: 002198AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 002198B8
FindClose.KERNEL32(00000000), ref: 002198C5
FindClose.KERNEL32(00000000), ref: 002198D5

Part of subcall function 0020DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 0020DB00

Strings

*.*, xrefs: 0021983B

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: 878741df419c1727c74e7e0cedbf891a71052a8258543ff7ee552bce01ce76f5
Instruction ID: b43f44e26597519ab78bb207a328c1cb129778ec22742145f0b0c43d7027809c
Opcode Fuzzy Hash: 878741df419c1727c74e7e0cedbf891a71052a8258543ff7ee552bce01ce76f5
Instruction Fuzzy Hash: CC31D23251121AAEDB20EFB4EC58ADE77ECAF16324F214165E814B20D1DB31DEE5CB20

Function 0022BE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0022C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0022B6AE,?,?), ref: 0022C9B5
Part of subcall function 0022C998: _wcslen.LIBCMT ref: 0022C9F1
Part of subcall function 0022C998: _wcslen.LIBCMT ref: 0022CA68
Part of subcall function 0022C998: _wcslen.LIBCMT ref: 0022CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0022BF3E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 0022BFA9
RegCloseKey.ADVAPI32(00000000), ref: 0022BFCD
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0022C02C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 0022C0E7
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0022C154
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0022C1E9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 0022C23A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 0022C2E3
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0022C382
RegCloseKey.ADVAPI32(00000000), ref: 0022C38F

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: 928fb0474ad8ca8eb0a05155f553a176da2ee3c01ca892d4c87ddff475a73f9b
Instruction ID: a37468231a9047d7b027cc9c67d7aef3fdd8f155b2df7475888ac183e88925ff
Opcode Fuzzy Hash: 928fb0474ad8ca8eb0a05155f553a176da2ee3c01ca892d4c87ddff475a73f9b
Instruction Fuzzy Hash: 01029F70614211AFC714CF68D895E2ABBE4EF49318F18C89CF84ACB2A2DB31ED55CB51

Function 00218195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00218257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00218267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00218273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00218310
SetCurrentDirectoryW.KERNEL32(?), ref: 00218324
SetCurrentDirectoryW.KERNEL32(?), ref: 00218356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0021838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00218395

Strings

*.*, xrefs: 0021839B

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 40c1ccc08d410c72b6d4b0a8f3122f45a2ee88bff21027ce6748e0f6d4053942
Instruction ID: 36865435f1d1a340592952fdb0c6187d55fffa0b852eca5885527f34a9a3113a
Opcode Fuzzy Hash: 40c1ccc08d410c72b6d4b0a8f3122f45a2ee88bff21027ce6748e0f6d4053942
Instruction Fuzzy Hash: CC61BB725183459FCB10EF20D8849AFB3E8FFA9310F04486DF89983251DB31E995CB92

Function 0020D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001A3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,001A3A97,?,?,001A2E7F,?,?,?,00000000), ref: 001A3AC2

Part of subcall function 0020E199: GetFileAttributesW.KERNEL32(?,0020CF95), ref: 0020E19A

FindFirstFileW.KERNEL32(?,?), ref: 0020D122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 0020D1DD
MoveFileW.KERNEL32(?,?), ref: 0020D1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 0020D20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 0020D237

Part of subcall function 0020D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,0020D21C,?,?), ref: 0020D2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 0020D253
FindClose.KERNEL32(00000000), ref: 0020D264

Strings

\*.*, xrefs: 0020D0CD, 0020D0D6, 0020D0EB

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: d31a011198434806761d2f4090f7f157959169f80b2afd711e19f57f80730f04
Instruction ID: 1e6561e0b9a33306864f723b66b38beb4a973c1b3335d195c601d235710218dc
Opcode Fuzzy Hash: d31a011198434806761d2f4090f7f157959169f80b2afd711e19f57f80730f04
Instruction Fuzzy Hash: 55617D3580221DAFCF05EFE0DA929EEB775AF25300F208165E80677192EB306F59CB60

Function 0021ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0021ED91
EmptyClipboard.USER32 ref: 0021ED97
GlobalAlloc.KERNEL32(00000002,?), ref: 0021EDAC
CloseClipboard.USER32 ref: 0021EEA3

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: c2c74f7d6eaeae1d04cca2923b4d3c591225285c4e88ffdb0c93bbb210e25546
Instruction ID: e2bdeccfe5b5f14ae0a5f99bd71454da9f20b98801ef0ddde6e27406a025430f
Opcode Fuzzy Hash: c2c74f7d6eaeae1d04cca2923b4d3c591225285c4e88ffdb0c93bbb210e25546
Instruction Fuzzy Hash: 0641EF35214612AFE710CF25E88DF5ABBE4FF54328F15C099E8198B662C771EC81CB90

Function 0020E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 002016C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0020170D
Part of subcall function 002016C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0020173A
Part of subcall function 002016C3: GetLastError.KERNEL32 ref: 0020174A

ExitWindowsEx.USER32(?,00000000), ref: 0020E932

Strings

, xrefs: 0020E95C
@, xrefs: 0020E925
, xrefs: 0020E920
SeShutdownPrivilege, xrefs: 0020E902

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: d501260110d556afc3daa0639d779df3949beed2befd27f19bea7f93a4827391
Instruction ID: 229053e9b9d6a9bed471dfe98b003fdd6f8b7f0890b856fdeb46011f7e902b82
Opcode Fuzzy Hash: d501260110d556afc3daa0639d779df3949beed2befd27f19bea7f93a4827391
Instruction Fuzzy Hash: E001D67363031AABEF5426B4AC8ABBB726CA714750F264D21FC02F21D3D5A15CA08690

Function 00221204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00221276
WSAGetLastError.WSOCK32 ref: 00221283
bind.WSOCK32(00000000,?,00000010), ref: 002212BA
WSAGetLastError.WSOCK32 ref: 002212C5
closesocket.WSOCK32(00000000), ref: 002212F4
listen.WSOCK32(00000000,00000005), ref: 00221303
WSAGetLastError.WSOCK32 ref: 0022130D
closesocket.WSOCK32(00000000), ref: 0022133C

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: 1af0669879d2fb4e8f5906e833a2a5a4c418eebd9ce6c3dbc1ec8e605a1908a3
Instruction ID: 2d1ffa3d36cf9a585045275e5d61e3c2b34423045477bddf9ec4eef868a47dfc
Opcode Fuzzy Hash: 1af0669879d2fb4e8f5906e833a2a5a4c418eebd9ce6c3dbc1ec8e605a1908a3
Instruction Fuzzy Hash: 1741B435A10121EFD710DF64E488F29BBE6AF56314F288188E8569F2D6C771ED91CBE0

Function 001DB952 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 001DB9D4
_free.LIBCMT ref: 001DB9F8
_free.LIBCMT ref: 001DBB7F
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00243700), ref: 001DBB91
WideCharToMultiByte.KERNEL32(00000000,00000000,0027121C,000000FF,00000000,0000003F,00000000,?,?), ref: 001DBC09
WideCharToMultiByte.KERNEL32(00000000,00000000,00271270,000000FF,?,0000003F,00000000,?), ref: 001DBC36
_free.LIBCMT ref: 001DBD4B

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: 7be5a0f154f069d2abcbc41b055acb149bc1b19c4b92d73177fc2d64a9f38c7f
Instruction ID: 79a5ac3b21b9c316003b7af4e62cdf68aef298d47ea4f2fd46e9e7f3f53a0c5b
Opcode Fuzzy Hash: 7be5a0f154f069d2abcbc41b055acb149bc1b19c4b92d73177fc2d64a9f38c7f
Instruction Fuzzy Hash: A7C13571A08244EFCB249F789C91BAA7BB8EF51310F16419BE896D7352EB309E41D750

Function 0020D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001A3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,001A3A97,?,?,001A2E7F,?,?,?,00000000), ref: 001A3AC2

Part of subcall function 0020E199: GetFileAttributesW.KERNEL32(?,0020CF95), ref: 0020E19A

FindFirstFileW.KERNEL32(?,?), ref: 0020D420
DeleteFileW.KERNEL32(?,?,?,?), ref: 0020D470
FindNextFileW.KERNEL32(00000000,00000010), ref: 0020D481
FindClose.KERNEL32(00000000), ref: 0020D498
FindClose.KERNEL32(00000000), ref: 0020D4A1

Strings

\*.*, xrefs: 0020D3F2

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 98cb95761f2b0b74d86282a5489622a997db3d9c0335b29b486d3a094614f8af
Instruction ID: 5e752a81ae7ee52c83f027d53c1c1eb3d90240b2a939d059a41eaa379dfa3924
Opcode Fuzzy Hash: 98cb95761f2b0b74d86282a5489622a997db3d9c0335b29b486d3a094614f8af
Instruction Fuzzy Hash: 9131A0350193459FC301EF64D8959AFB7A8BEA2314F844A1DF4D193192EB30AA19CB63

Function 001DE4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 001DE645

Strings

1#SNAN, xrefs: 001DF844
1#INF, xrefs: 001DF852
1#QNAN, xrefs: 001DF84B
1#IND, xrefs: 001DF83D

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: eb016193f85f1b72ff8aea2487a4cb721fb916f833cc8509648c1c3a4ddde0d3
Instruction ID: 83fe8b77cad68d8bb3de4ddd40fb0687622b005d21e49b22b5275b49c7cafe12
Opcode Fuzzy Hash: eb016193f85f1b72ff8aea2487a4cb721fb916f833cc8509648c1c3a4ddde0d3
Instruction Fuzzy Hash: A9C22971E046288FDB29DF289D407EAB7B5EB59305F1541EBD84EE7240E774AE828F40

Function 0021648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 002164DC
CoInitialize.OLE32(00000000), ref: 00216639
CoCreateInstance.OLE32(0023FCF8,00000000,00000001,0023FB68,?), ref: 00216650
CoUninitialize.OLE32 ref: 002168D4

Strings

.lnk, xrefs: 002164BA, 00216524, 002165E0

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: dc4a455a1dc35f29c3d980050c78a14db521372e04274d70dd42bc5d17bc5a51
Instruction ID: 5674208093ce6bda179978d144670ceef188c664290687257484c55db606bab3
Opcode Fuzzy Hash: dc4a455a1dc35f29c3d980050c78a14db521372e04274d70dd42bc5d17bc5a51
Instruction Fuzzy Hash: EFD16A71518301AFC304EF24C881EABB7E9FFA9304F50492DF5958B291DB31E949CB92

Function 002222DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 002222E8

Part of subcall function 0021E4EC: GetWindowRect.USER32(?,?), ref: 0021E504

GetDesktopWindow.USER32 ref: 00222312
GetWindowRect.USER32(00000000), ref: 00222319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00222355
GetCursorPos.USER32(?), ref: 00222381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 002223DF

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: b63625340914dba303f0b960c2a45601d7e5f0b8ac7b8e3edfda79fb228e3da5
Instruction ID: f21cc0f911d9d9cbbb7ecb8cb622873a0eb98eb2e678bbec65ba0a0732a68179
Opcode Fuzzy Hash: b63625340914dba303f0b960c2a45601d7e5f0b8ac7b8e3edfda79fb228e3da5
Instruction Fuzzy Hash: 27310272504315AFDB20DF54E809B9BB7A9FF84310F100A19F984A7191DB75E918CB92

Function 00219B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00219B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00219C8B

Part of subcall function 00213874: GetInputState.USER32 ref: 002138CB
Part of subcall function 00213874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00213966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00219BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00219C75

Strings

*.*, xrefs: 00219B5D

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: c677b7fc152e35b40bfe2944b7b4f627e82bf0e18183a003c8972382ed5b6b90
Instruction ID: c2fc6614c887521ddc24e4a910d96e4ed61fb7fa2ef6a4462cc9da60b719d171
Opcode Fuzzy Hash: c677b7fc152e35b40bfe2944b7b4f627e82bf0e18183a003c8972382ed5b6b90
Instruction Fuzzy Hash: 9141717191420A9FCF14DF64D859AEEBBF8EF29310F244056E845A2191EB309ED4CFA0

Function 001B997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 001B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 001B9BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 001B9A4E
GetSysColor.USER32(0000000F), ref: 001B9B23
SetBkColor.GDI32(?,00000000), ref: 001B9B36

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: f0b8125449c541c592fe579eee7d0cc52b3b186d229cab89dd2b34faab2eec73
Instruction ID: 5c66a17c230980777dba49047c836316f7c1c07ef6eef288394d0a172e998712
Opcode Fuzzy Hash: f0b8125449c541c592fe579eee7d0cc52b3b186d229cab89dd2b34faab2eec73
Instruction Fuzzy Hash: 30A1F4B0118448AEE728AA3C9C9DEFB369DDF42350F264209F702D76D1CB259D53C672

Function 00221806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0022304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0022307A
Part of subcall function 0022304E: _wcslen.LIBCMT ref: 0022309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 0022185D
WSAGetLastError.WSOCK32 ref: 00221884
bind.WSOCK32(00000000,?,00000010), ref: 002218DB
WSAGetLastError.WSOCK32 ref: 002218E6
closesocket.WSOCK32(00000000), ref: 00221915

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: 1274ed1e2b7e2bb4e92d9c03fa6943d323b5f3a6ef42e239c00267e353acbd6e
Instruction ID: 1ea798785d1009919932709666415928f1f17f8fd182fa86fb8703dc0d377d5c
Opcode Fuzzy Hash: 1274ed1e2b7e2bb4e92d9c03fa6943d323b5f3a6ef42e239c00267e353acbd6e
Instruction Fuzzy Hash: D151E475A00210AFEB10AF64D88AF6A77E5AB55718F18805CF9096F3C3C771ED418BA1

Function 00231C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00231CC0
IsWindowEnabled.USER32 ref: 00231CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00231CDB
IsIconic.USER32 ref: 00231CE9
IsZoomed.USER32 ref: 00231CF7

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 438ed37bff20953360f256c11c73f6128dd9cc42028f5b252b924fcd5825e433
Instruction ID: 4ade058c146b73e24960ea60121be29caea7ada774b85d2b01dc777d512a2d9e
Opcode Fuzzy Hash: 438ed37bff20953360f256c11c73f6128dd9cc42028f5b252b924fcd5825e433
Instruction Fuzzy Hash: 572127B17502019FD3208F2AD884B2A7BE4FF85310F189469E846DB351CB71DC62CBD1

Function 001A8060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

VUUU, xrefs: 001A83E8
VUUU, xrefs: 001A83FA
VUUU, xrefs: 001E5DF0
ERCP, xrefs: 001A813C
VUUU, xrefs: 001A843C

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: d9a32929095a4b862dc71f3faa702a94f1434bfc511516c703bb04ba6a3e4cc2
Instruction ID: afa5b8f2c5bd56b1a7a3fdddd8a3731c346334126634ef6afd94b5e41e9e69df
Opcode Fuzzy Hash: d9a32929095a4b862dc71f3faa702a94f1434bfc511516c703bb04ba6a3e4cc2
Instruction Fuzzy Hash: F7A2A274E00A5ACBDF28CF59C8507BEB7B2BF55314F2581AAE819A7285DB309D81CF50

Function 00208298 Relevance: 6.6, APIs: 1, Strings: 3, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 002082AA

Strings

(, xrefs: 002082F0
tb&, xrefs: 002084F4
|, xrefs: 002082DA

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: lstrlen
String ID: ($tb&$|
API String ID: 1659193697-4108677313
Opcode ID: 2b996fd5a2ba9d5f49ec8ceab3c2400b2f4473f02064e0f54ba24836b43d78f9
Instruction ID: 6de78303108b6fc5baba1d46524c6992c1c633b24a95418806bd36fabc98f7f4
Opcode Fuzzy Hash: 2b996fd5a2ba9d5f49ec8ceab3c2400b2f4473f02064e0f54ba24836b43d78f9
Instruction Fuzzy Hash: F6323674A107069FCB28CF59C481A6AB7F0FF48710B15C56EE59ADB3A2EB70E951CB40

Function 0022A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0022A6AC
Process32FirstW.KERNEL32(00000000,?), ref: 0022A6BA

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

Process32NextW.KERNEL32(00000000,?), ref: 0022A79C
CloseHandle.KERNEL32(00000000), ref: 0022A7AB

Part of subcall function 001BCE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,001E3303,?), ref: 001BCE8A

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: bfc152b3c24eee83b8d19e5ab9517e1fad78bdee0f654fe23c85318349e75312
Instruction ID: 570b20ca3b39add3c4092f3d33319d972799524ee258515ad3239e056cdf8d92
Opcode Fuzzy Hash: bfc152b3c24eee83b8d19e5ab9517e1fad78bdee0f654fe23c85318349e75312
Instruction Fuzzy Hash: C2516DB5508310AFD710EF24D886A6BBBE8FF99754F40892DF58997291EB30D904CB92

Function 0020AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 0020AAAC
SetKeyboardState.USER32(00000080), ref: 0020AAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 0020AB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 0020AB88

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 9b8dced380253d8ecbe8109f9e3d56bd427cd73fa59dcff0f772f8e9e75aeffa
Instruction ID: 9f138887619e788a9cb2371d272a24ed898676d32cf2f1c1bd13b09c9752ce61
Opcode Fuzzy Hash: 9b8dced380253d8ecbe8109f9e3d56bd427cd73fa59dcff0f772f8e9e75aeffa
Instruction Fuzzy Hash: FB313B31A60309AEFF35CF64CC05BFA7BAAAB64314F94421AF481561D3D374C9A1C762

Function 0021CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 0021CE89
GetLastError.KERNEL32(?,00000000), ref: 0021CEEA
SetEvent.KERNEL32(?,?,00000000), ref: 0021CEFE

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: 21f07c5930184d4d79d2738c08cd349e29dc85ccf3ac85ef1437d783dac49f6a
Instruction ID: d93c27a5d738076be3d89cbe0218b77e89b68b834978f2c6b04257323a110b30
Opcode Fuzzy Hash: 21f07c5930184d4d79d2738c08cd349e29dc85ccf3ac85ef1437d783dac49f6a
Instruction Fuzzy Hash: 5521EDB9550306ABDB30CFA5D948BA7B7FCEB20314F30442EE642A2151E770EE958B90

Function 00215C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00215CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00215D17
FindClose.KERNEL32(?), ref: 00215D5F

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 9c97785bdfbb729c885d1b0c4d37b6f907f084a37b6474104ca9e83d26f3e789
Instruction ID: 9c4650a7a2e6946eb382a4bc40d568791c7f48cc1215d7159338863de9dd8d0d
Opcode Fuzzy Hash: 9c97785bdfbb729c885d1b0c4d37b6f907f084a37b6474104ca9e83d26f3e789
Instruction Fuzzy Hash: 9D51AA74614602DFC714CF28D484E96B7E4FF5A324F14859EE95A8B3A2CB30ED94CB91

Function 001D2622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 001D271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 001D2724
UnhandledExceptionFilter.KERNEL32(?), ref: 001D2731

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 2d4a8eba42ee3b09dcad8b08c50ab28a9c4abe441f968da1fb7cfb7164d7fb15
Instruction ID: edd8bf87717ccd807371e6eeb41c7a66a4d3348010a70bba93d076d86ea1b94d
Opcode Fuzzy Hash: 2d4a8eba42ee3b09dcad8b08c50ab28a9c4abe441f968da1fb7cfb7164d7fb15
Instruction Fuzzy Hash: 7931D57590122CABCB21DF64DC88B9DBBB8BF18310F5041EAE81CA7260E7349F818F44

Function 002151CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 002151DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00215238
SetErrorMode.KERNEL32(00000000), ref: 002152A1

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 248456faf97f30066e1fd914f8e8fd3a039fb0335699981893ac5e5026c5b924
Instruction ID: 617a9c293577397ee96f11dd2c5ac7d5c0ebc24e1b78228fdd4002afb0c85dc1
Opcode Fuzzy Hash: 248456faf97f30066e1fd914f8e8fd3a039fb0335699981893ac5e5026c5b924
Instruction Fuzzy Hash: FF315E75A10618DFDB00DF54D888EADBBF4FF59314F148099E809AB3A2DB31E855CBA0

Function 002016C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 001BFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 001C0668
Part of subcall function 001BFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 001C0685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0020170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0020173A
GetLastError.KERNEL32 ref: 0020174A

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 157c58cb9ec976f01dc838fc891827ece651edb51af928f56a4f99aa2c30fc86
Instruction ID: bb8c09450defa472e8cc5c9ea9cdfae90cd28d74d1116be22cb9db825874a1d0
Opcode Fuzzy Hash: 157c58cb9ec976f01dc838fc891827ece651edb51af928f56a4f99aa2c30fc86
Instruction Fuzzy Hash: BE11A3B2514305AFD7189F54ECC6EABB7BDEB44714B20852EF05657291EB70FC518B20

Function 0020D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0020D608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 0020D645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0020D650

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 853e2c15d9b468a9efea9e9ead3f711683a809825a78c20ad6613b609686fb3e
Instruction ID: dad32ec43a31b319fddf313acd8cff8df35b9e42cf3fe7dea6ab5c41e6895a6c
Opcode Fuzzy Hash: 853e2c15d9b468a9efea9e9ead3f711683a809825a78c20ad6613b609686fb3e
Instruction Fuzzy Hash: 9D113C75E05228BBDB108F95AC49FAFBBBCEB45B50F108156F904E7290D6704A058BA1

Function 00201663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0020168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 002016A1
FreeSid.ADVAPI32(?), ref: 002016B1

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 88595cd414c060f594c4efa0dadfe05d0038f800dcb2edcbc2d2948dd53d8d7e
Instruction ID: d32da7ab5b180f30755bdde0ca4c5e8356aa1eb5ec197fafddd0d4468b94ba03
Opcode Fuzzy Hash: 88595cd414c060f594c4efa0dadfe05d0038f800dcb2edcbc2d2948dd53d8d7e
Instruction Fuzzy Hash: 27F0F47195030DFBDB00DFE49D89AAEBBBCEB08704F504565E501E2181E774AA548B50

Function 001C4CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(001D28E9,?,001C4CBE,001D28E9,002688B8,0000000C,001C4E15,001D28E9,00000002,00000000,?,001D28E9), ref: 001C4D09
TerminateProcess.KERNEL32(00000000,?,001C4CBE,001D28E9,002688B8,0000000C,001C4E15,001D28E9,00000002,00000000,?,001D28E9), ref: 001C4D10
ExitProcess.KERNEL32 ref: 001C4D22

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 49cb3d25cf6470a3d90b4c40f87801baa2f342c2c01cb9897efd847411b79a77
Instruction ID: 5d581dc1e8db5f4484ea48b1ae4c77adb69967b07bf9ec95234ce717565846ee
Opcode Fuzzy Hash: 49cb3d25cf6470a3d90b4c40f87801baa2f342c2c01cb9897efd847411b79a77
Instruction Fuzzy Hash: 1BE0B631004148ABCF11BFA4ED1EFA83B69EB61791B204458FC1A9A222CB35DE52DB80

Function 001DC2A2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 001DC36C

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: e7655e66fd4736492f64b3e3ec9c3a78e46042317909c145fcd4df746894f157
Instruction ID: 09230843512a0798b1b74bcb075261470e159451199bf1f538435911b7c8e35a
Opcode Fuzzy Hash: e7655e66fd4736492f64b3e3ec9c3a78e46042317909c145fcd4df746894f157
Instruction Fuzzy Hash: 9241287650021A7BCB249FB9DC49EBB7778EB84314F10466AF915D7280E7709D41CB90

Function 001FD27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 001FD28C

Strings

X64, xrefs: 001FD2A8

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: ce6caba0c6e19cc08e2af4a3845ba62af2450b035590facaed04b53aaa5cd0f4
Instruction ID: 8c14c3ed465bc62afc526d4b3b8873187e64da8f83db63c8a16dbb481f8011ad
Opcode Fuzzy Hash: ce6caba0c6e19cc08e2af4a3845ba62af2450b035590facaed04b53aaa5cd0f4
Instruction Fuzzy Hash: 96D0C9B480111DEACB98DB90ECC8DEAB37CBB04305F100151F106A2000DB3095488F10

Function 001CCAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: 8ab01c4104e374e8732abe44f148626be861888778461f35c9fece5887b7a97b
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: 28020B71E002199BDF14CFA9C990BADBBF1EF58314F25816ED819E7384D731AE418B94

Function 001ACAF0 Relevance: 3.2, Strings: 2, Instructions: 659COMMON

Download Yara Rule

Strings

Variable is not of type 'Object'., xrefs: 001F0C40
p#', xrefs: 001ACF7F

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.$p#'
API String ID: 0-4107862598
Opcode ID: 60330cebad72a42ae720cf474a575aa500b00df0607087473045518e55746f7a
Instruction ID: 5d0423c620758dc5f7f04d2d5ad405551fe041061ff9fbc6c6e862e93c58ba9c
Opcode Fuzzy Hash: 60330cebad72a42ae720cf474a575aa500b00df0607087473045518e55746f7a
Instruction Fuzzy Hash: E432AE78900218DFCF19DF94C985AFDB7B5FF1A304F148059E906AB292DB35AE45CBA0

Function 002168EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00216918
FindClose.KERNEL32(00000000), ref: 00216961

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c865e4cf9101416c94860981b128995e5a04ce8915bcd8b1920f9097a14beaff
Instruction ID: 29e32965a12b6e78be840ffbc4dde07da4fff68eb31308961b9d39e617fcdbe7
Opcode Fuzzy Hash: c865e4cf9101416c94860981b128995e5a04ce8915bcd8b1920f9097a14beaff
Instruction Fuzzy Hash: CC1190356142119FC710DF29D888A1ABBE5FF95328F14C6A9E8698F6A2C730EC45CBD1

Function 002137B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00224891,?,?,00000035,?), ref: 002137E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00224891,?,?,00000035,?), ref: 002137F4

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: d3e4d41bd742b737a6905d8cbd73c47e54409393667d0e4a31cf525b05af10d3
Instruction ID: fe8f5b77c62a95b1afb6f6212dad4d3252ef2565a1828f7eb0c0163313319579
Opcode Fuzzy Hash: d3e4d41bd742b737a6905d8cbd73c47e54409393667d0e4a31cf525b05af10d3
Instruction Fuzzy Hash: 38F0E5B16043292AE72057669C4DFEB7AEEEFC5761F100175F509E22C1DA609D44C7B0

Function 0020B226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 0020B25D
keybd_event.USER32(?,75A4C0D0,?,00000000), ref: 0020B270

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: e8dabc794b07f400d95b9b72b0ffd4df503dd8dcf165747d008a6118b9137d7f
Instruction ID: f1ca4ca929e68971d904c5c3c73b5ffcf00be3b9ebb0d47979a27b9bf0d7aee4
Opcode Fuzzy Hash: e8dabc794b07f400d95b9b72b0ffd4df503dd8dcf165747d008a6118b9137d7f
Instruction Fuzzy Hash: A2F01D7181434EAFDB159FA0D805BAE7BB4FF04305F108009F955A5192C3798611DF94

Function 002010BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,002011FC), ref: 002010D4
CloseHandle.KERNEL32(?,?,002011FC), ref: 002010E9

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 1f31e4de4293c9841df01186fe333d013d7cdb68721405059b8d43d96b1fd9a2
Instruction ID: 96f45a5e9f3059a69712f281130f6bff536a53a2fd2b79ea1967b26067de9a85
Opcode Fuzzy Hash: 1f31e4de4293c9841df01186fe333d013d7cdb68721405059b8d43d96b1fd9a2
Instruction Fuzzy Hash: FEE0BF72018611AEE7252B51FC09EB777E9EB04310B24882DF5A5904B1DB62ACA1DB50

Function 001D676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,001D6766,?,?,00000008,?,?,001DFEFE,00000000), ref: 001D6998

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: d780402fa03b9db5b4bff84bf46aefb4f111b376be138f7fe0cfe9541c89c63d
Instruction ID: 17dfaa8ee89cc736d2cb6518c6200ee80428fd247b447a75cc05b1a686371156
Opcode Fuzzy Hash: d780402fa03b9db5b4bff84bf46aefb4f111b376be138f7fe0cfe9541c89c63d
Instruction Fuzzy Hash: 7EB12931610609DFD719CF28C48AB657BA0FF45368F25865AE8D9CF3A2C335E991CB40

Function 001BB119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 001F851F

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: bc096c4ff300b7d280b341aa890f34ff4d6203cc6158b90da929ca3cbb343c13
Instruction ID: 07c2c1a2b2d024d35c2158c3fbccca0b85ae0178148a3f56a9fc14dbc89ec8d0
Opcode Fuzzy Hash: bc096c4ff300b7d280b341aa890f34ff4d6203cc6158b90da929ca3cbb343c13
Instruction Fuzzy Hash: FF126E759042299BCB24CF58C8806FEB7F5FF48710F1581AAE949EB255DB709E81CF90

Function 0021EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 0021EABD

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: a69ee3af3347d0d357ee611bea1a8f192f072e695fdb37208e96cc1259299066
Instruction ID: 5688199cc2c4b53f9a12655738fddc612fda5e0c19db524d22f4695e31491a54
Opcode Fuzzy Hash: a69ee3af3347d0d357ee611bea1a8f192f072e695fdb37208e96cc1259299066
Instruction Fuzzy Hash: 6DE04F362102049FC720EF69E845E9AF7EDAFA9760F018416FC4AD7351DBB0E8808BD1

Function 001C09D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,001C03EE), ref: 001C09DA

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 231a6301ffc9a097b592d175daba5b9513705fea8af5de6fb81efa8a38c5b0d0
Instruction ID: cff4e9b430a996a62b54c1661a9a5e13093a01701f4dd965141fd223ce89d0f5
Opcode Fuzzy Hash: 231a6301ffc9a097b592d175daba5b9513705fea8af5de6fb81efa8a38c5b0d0
Instruction Fuzzy Hash:

Function 001C781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 001C798B

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: ef6d64894bc2e68ca303afb765978a239bb359232d67b0c6ad0270ac6664d0a6
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: 2C51887160C7469BDF388568889EFBE63999B32354F18050DEA82D72C2C7E1DE01DF52

Function 00212046 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

0&', xrefs: 00212053

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID: 0&'
API String ID: 0-3187542733
Opcode ID: e520170a088ee08428628f2262ce84f68fae27c04b5400c70983556d47eb7c4d
Instruction ID: 55cd26889d247b606513b2f74948503e7861f460844899b986c83c313ef477a0
Opcode Fuzzy Hash: e520170a088ee08428628f2262ce84f68fae27c04b5400c70983556d47eb7c4d
Instruction Fuzzy Hash: 3321A832620511CBD728CF79C8226BA73E5A764310F15862EE4A7C37D1DE35A948CB80

Function 001D6DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd0742b293e993c2f5f566309a13f24aee2cffb100980a77d20e8639443dfe27
Instruction ID: 43265d7dd9c314506295b720e7df95a94cc320638f65fbf10c016ac888defac0
Opcode Fuzzy Hash: cd0742b293e993c2f5f566309a13f24aee2cffb100980a77d20e8639443dfe27
Instruction Fuzzy Hash: 15326726D29F018DD7239635EC26336A249AFB73C5F55C737F81AB5AA6EB28D4C34100

Function 001BCC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a48e7c58985221c2fb29e14fe8414674a99bf37538ead51f1beb9167cf6114a
Instruction ID: fb7cdd07ad3e76c96ecba25d71ef3ee9bfa25ad92a7022bb1e5c6a88eeb43c69
Opcode Fuzzy Hash: 8a48e7c58985221c2fb29e14fe8414674a99bf37538ead51f1beb9167cf6114a
Instruction Fuzzy Hash: 91324931A0411D8BCF28CF69C6946BE7BA1EF45354F29856AD65ACB291E330DD81FBC0

Function 001A7920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cda6eaacaa44ba9cd243ad5ad92902d622848371ed550205a362fc83d1fb737d
Instruction ID: 5e4d272acc933e195ce8b7bc6686c5e259a76d3b1a4a74c809bd60aa4e8f2172
Opcode Fuzzy Hash: cda6eaacaa44ba9cd243ad5ad92902d622848371ed550205a362fc83d1fb737d
Instruction Fuzzy Hash: 6E22D1B4A00A0ADFDF14CF65C841AAEB3F2FF59304F144529E816A7291EB35DE51CB50

Function 001A91C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1e440cba8521a5cdc124aa90466d65a836b9302388ea8f74aa8bd8ba9380f12
Instruction ID: fb78dcb13bfeef894712a706b7ca6f8d9951c06c1729bd4b660f603ccdb57853
Opcode Fuzzy Hash: f1e440cba8521a5cdc124aa90466d65a836b9302388ea8f74aa8bd8ba9380f12
Instruction Fuzzy Hash: 7C02B5B0A00605EBDF04DF65D881AAEB7F1FF54300F218169E816DB291EB71EA61CB91

Function 001C1C77 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: 253c9070496d09d604e6dd9b9bf1cdd781039aebd69195dfe741222bf210e8a7
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: 169177731480A35ADB2E46798575A7DFFE15A633A131A079DE4F3CA1C2FF20C964D620

Function 001C19B0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: 63950f38320d94c1f47708b3e31c7606d7eba0d1ff6de5c4eaac62648d325873
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: BC9133722490E359DB2D427A8574A3DFEF15AA33A131A079DD4F2CB1C2FF24C965DA20

Function 001C7A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0ac624e15013c3b3d0f9260cfa293ec11b91f3cd7d56532e038ff3a177e1e27
Instruction ID: 98f7a75950de008167235ba253dbe6253710505edb227f3333476a1f8eecbf42
Opcode Fuzzy Hash: a0ac624e15013c3b3d0f9260cfa293ec11b91f3cd7d56532e038ff3a177e1e27
Instruction Fuzzy Hash: 74615B71208746A7DB38A9688996FBE2394DF71710F18091EE842DB2C1D7D1DE42CF56

Function 001C7CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6404f061e592b13724d7f9a8839f09cdbeb4a614d76f2410370f904b395e0832
Instruction ID: aeae8f6996d3035661b91101a9b129cc793b82599e4fdb93aeb7b4fd6c204f4c
Opcode Fuzzy Hash: 6404f061e592b13724d7f9a8839f09cdbeb4a614d76f2410370f904b395e0832
Instruction Fuzzy Hash: 1461793220870967DA395AE85892FBF2394AF72784F10095EF843CB2C1DBD2ED42CE55

Function 001C1706 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: bbfaf363eae6fda44ebfa0d87799d1287c94154ecf47271d502180fae9271761
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: D881747364C0A359EB2D427A8534A3EFFE15AA33A531A079DD4F2CA1C3EF24C554E620

Function 00222ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00222B30
DeleteObject.GDI32(00000000), ref: 00222B43
DestroyWindow.USER32 ref: 00222B52
GetDesktopWindow.USER32 ref: 00222B6D
GetWindowRect.USER32(00000000), ref: 00222B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00222CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00222CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00222CF8
GetClientRect.USER32(00000000,?), ref: 00222D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00222D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00222D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00222D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00222D80
GlobalLock.KERNEL32(00000000), ref: 00222D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00222D98
GlobalUnlock.KERNEL32(00000000), ref: 00222DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00222DA8
GlobalFree.KERNEL32(00000000), ref: 00222DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00222DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,0023FC38,00000000), ref: 00222DDB
GlobalFree.KERNEL32(00000000), ref: 00222DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00222E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00222E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00222E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0022303F

Strings

DISPLAY, xrefs: 00222EA2
AutoIt v3, xrefs: 00222CF2
static, xrefs: 00222D3A, 00222E91
, xrefs: 00222FC5

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 4cd75c905d07cc2f72685115ee6df76e1804fafda7444eb91b329df5cbb478ce
Instruction ID: 686869a10f0ba19a1114f1d4c570afb4097dce23422451615a12f5c2d337f72a
Opcode Fuzzy Hash: 4cd75c905d07cc2f72685115ee6df76e1804fafda7444eb91b329df5cbb478ce
Instruction Fuzzy Hash: DB028975910215EFDB14DFA4EC89EAE7BB9EF49310F148158F919AB2A1CB70AD10CB60

Function 002370D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0023712F
GetSysColorBrush.USER32(0000000F), ref: 00237160
GetSysColor.USER32(0000000F), ref: 0023716C
SetBkColor.GDI32(?,000000FF), ref: 00237186
SelectObject.GDI32(?,?), ref: 00237195
InflateRect.USER32(?,000000FF,000000FF), ref: 002371C0
GetSysColor.USER32(00000010), ref: 002371C8
CreateSolidBrush.GDI32(00000000), ref: 002371CF
FrameRect.USER32(?,?,00000000), ref: 002371DE
DeleteObject.GDI32(00000000), ref: 002371E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00237230
FillRect.USER32(?,?,?), ref: 00237262
GetWindowLongW.USER32(?,000000F0), ref: 00237284

Part of subcall function 002373E8: GetSysColor.USER32(00000012), ref: 00237421
Part of subcall function 002373E8: SetTextColor.GDI32(?,?), ref: 00237425
Part of subcall function 002373E8: GetSysColorBrush.USER32(0000000F), ref: 0023743B
Part of subcall function 002373E8: GetSysColor.USER32(0000000F), ref: 00237446
Part of subcall function 002373E8: GetSysColor.USER32(00000011), ref: 00237463
Part of subcall function 002373E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00237471
Part of subcall function 002373E8: SelectObject.GDI32(?,00000000), ref: 00237482
Part of subcall function 002373E8: SetBkColor.GDI32(?,00000000), ref: 0023748B
Part of subcall function 002373E8: SelectObject.GDI32(?,?), ref: 00237498
Part of subcall function 002373E8: InflateRect.USER32(?,000000FF,000000FF), ref: 002374B7
Part of subcall function 002373E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 002374CE
Part of subcall function 002373E8: GetWindowLongW.USER32(00000000,000000F0), ref: 002374DB

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 28b0537002a0703a5c57c7c246dc2ac0d9bd0cdf74ddf225ab4849d305210b8c
Instruction ID: b511dbd960be1cde4e054c8bc4e9c9dc3c4f2488ac748e6d2eb9bb501c64701f
Opcode Fuzzy Hash: 28b0537002a0703a5c57c7c246dc2ac0d9bd0cdf74ddf225ab4849d305210b8c
Instruction Fuzzy Hash: 3CA1A2B2018302AFDB109F60EC4CE5B7BA9FF49320F200A19F9A6A61E1D771E955DF51

Function 001B8D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 001B8E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 001F6AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 001F6AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 001F6F43

Part of subcall function 001B8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,001B8BE8,?,00000000,?,?,?,?,001B8BBA,00000000,?), ref: 001B8FC5

SendMessageW.USER32(?,00001053), ref: 001F6F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 001F6F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 001F6FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 001F6FB7

Strings

0, xrefs: 001F6DCF

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: 3291e4fa32f410c64a84e626aa5957f3c70c30b892fda41254f43cb1452a4f1a
Instruction ID: c056b377093a0e3f118064736cfb8ce261ac66dd70aa6a8cd61655cb34217e97
Opcode Fuzzy Hash: 3291e4fa32f410c64a84e626aa5957f3c70c30b892fda41254f43cb1452a4f1a
Instruction Fuzzy Hash: 64128B35200205DFDB29DF28D898BBAB7B5FF45700F144469F6899B261CB31ECA2DB91

Function 00222711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 0022273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0022286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 002228A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 002228B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00222900
GetClientRect.USER32(00000000,?), ref: 0022290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00222955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00222964
GetStockObject.GDI32(00000011), ref: 00222974
SelectObject.GDI32(00000000,00000000), ref: 00222978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00222988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00222991
DeleteDC.GDI32(00000000), ref: 0022299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 002229C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 002229DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00222A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00222A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00222A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00222A77
GetStockObject.GDI32(00000011), ref: 00222A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00222A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00222A97

Strings

DISPLAY, xrefs: 0022295A
AutoIt v3, xrefs: 002228F8
msctls_progress32, xrefs: 00222A13
static, xrefs: 0022294F, 00222A71

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 4c9b10905ee1f09c8f155552650daa5242e978293b0cc52bdfe6347dc0677476
Instruction ID: 61814d216b7f50a03b2b5b1149070a3f19d0e55aee78919100010687832f36d6
Opcode Fuzzy Hash: 4c9b10905ee1f09c8f155552650daa5242e978293b0cc52bdfe6347dc0677476
Instruction Fuzzy Hash: 36B15A75A10215BFEB14DFA8EC8AFAABBA9EF09710F104154F914E7290D774E950CBA0

Function 00214ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00214AED
GetDriveTypeW.KERNEL32(?,0023CB68,?,\\.\,0023CC08), ref: 00214BCA
SetErrorMode.KERNEL32(00000000,0023CB68,?,\\.\,0023CC08), ref: 00214D36

Strings

RAID, xrefs: 00214CBB
RAMDisk, xrefs: 00214BF4
USB, xrefs: 00214CB4
1394, xrefs: 00214C9F
Virtual, xrefs: 00214CE5
SSA, xrefs: 00214CA6
Fibre, xrefs: 00214CAD
SSD, xrefs: 00214C4A
PhysicalDrive, xrefs: 00214B76
SATA, xrefs: 00214CD0
Unknown, xrefs: 00214BED, 00214C83
CDROM, xrefs: 00214BFB
SAS, xrefs: 00214CC9
\\.\, xrefs: 00214B3F
FileBackedVirtual, xrefs: 00214CEC
ATA, xrefs: 00214C98
SCSI, xrefs: 00214C8A
Removable, xrefs: 00214C10, 00214C15
Network, xrefs: 00214C02
iSCSI, xrefs: 00214CC2
MMC, xrefs: 00214CDE
ATAPI, xrefs: 00214C91
Fixed, xrefs: 00214C09

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 5df4d423d40e60dae69100b6372b8574e786228a5b04ca676219f9fdbe8eb225
Instruction ID: 10c4ae0fa281581fa916301617073e8ffb3b7c8777c09a99d1ca2a09c73809c6
Opcode Fuzzy Hash: 5df4d423d40e60dae69100b6372b8574e786228a5b04ca676219f9fdbe8eb225
Instruction Fuzzy Hash: 9961C334635206DBCB04FF24CA85DE9B7E0AB66744F244116F80EAB291DB71EDE1DB81

Function 002373E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00237421
SetTextColor.GDI32(?,?), ref: 00237425
GetSysColorBrush.USER32(0000000F), ref: 0023743B
GetSysColor.USER32(0000000F), ref: 00237446
CreateSolidBrush.GDI32(?), ref: 0023744B
GetSysColor.USER32(00000011), ref: 00237463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00237471
SelectObject.GDI32(?,00000000), ref: 00237482
SetBkColor.GDI32(?,00000000), ref: 0023748B
SelectObject.GDI32(?,?), ref: 00237498
InflateRect.USER32(?,000000FF,000000FF), ref: 002374B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 002374CE
GetWindowLongW.USER32(00000000,000000F0), ref: 002374DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0023752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00237554
InflateRect.USER32(?,000000FD,000000FD), ref: 00237572
DrawFocusRect.USER32(?,?), ref: 0023757D
GetSysColor.USER32(00000011), ref: 0023758E
SetTextColor.GDI32(?,00000000), ref: 00237596
DrawTextW.USER32(?,002370F5,000000FF,?,00000000), ref: 002375A8
SelectObject.GDI32(?,?), ref: 002375BF
DeleteObject.GDI32(?), ref: 002375CA
SelectObject.GDI32(?,?), ref: 002375D0
DeleteObject.GDI32(?), ref: 002375D5
SetTextColor.GDI32(?,?), ref: 002375DB
SetBkColor.GDI32(?,?), ref: 002375E5

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 5ac7dc583b4f020d19dac64fff29f7d62299de0414c1356050166960c50c5019
Instruction ID: 37b24b3c9df52656fbbeab6d4d68295b361bb37a71d5faed7ea586e9262f49e2
Opcode Fuzzy Hash: 5ac7dc583b4f020d19dac64fff29f7d62299de0414c1356050166960c50c5019
Instruction Fuzzy Hash: BB6181B2910218AFDF109FA4EC49EEE7FB9EB08320F214115F915BB2A1D770A940DF90

Function 00230FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00231128
GetDesktopWindow.USER32 ref: 0023113D
GetWindowRect.USER32(00000000), ref: 00231144
GetWindowLongW.USER32(?,000000F0), ref: 00231199
DestroyWindow.USER32(?), ref: 002311B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 002311ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0023120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0023121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00231232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00231245
IsWindowVisible.USER32(00000000), ref: 002312A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 002312BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 002312D0
GetWindowRect.USER32(00000000,?), ref: 002312E8
MonitorFromPoint.USER32(?,?,00000002), ref: 0023130E
GetMonitorInfoW.USER32(00000000,?), ref: 00231328
CopyRect.USER32(?,?), ref: 0023133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 002313AA

Strings

tooltips_class32, xrefs: 002311E6
0, xrefs: 002310D3
(, xrefs: 0023131B

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 5c3c1d295425cffdbc86a9fb901ac5ff8d81fef63487d28a7711246d0d85b7ee
Instruction ID: d436c9846e6ef7e8132f8106398c3304ed9cfd8ef2f09277e5c255c936cfeff8
Opcode Fuzzy Hash: 5c3c1d295425cffdbc86a9fb901ac5ff8d81fef63487d28a7711246d0d85b7ee
Instruction Fuzzy Hash: E4B18EB1618341AFD704DF64D889B6BBBE4FF85350F008918F999AB2A1C771E864CF91

Function 00230241 Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 002302E5
_wcslen.LIBCMT ref: 0023031F
_wcslen.LIBCMT ref: 00230389
_wcslen.LIBCMT ref: 002303F1
_wcslen.LIBCMT ref: 00230475
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 002304C5
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00230504

Part of subcall function 001BF9F2: _wcslen.LIBCMT ref: 001BF9FD

Part of subcall function 0020223F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00202258
Part of subcall function 0020223F: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 0020228A

Strings

SELECT, xrefs: 00230548
SELECTINVERT, xrefs: 0023057E
DESELECT, xrefs: 0023059C
GETSUBITEMCOUNT, xrefs: 00230384, 0023039F
FINDITEM, xrefs: 00230627
VIEWCHANGE, xrefs: 00230675
GETITEMCOUNT, xrefs: 00230316, 00230337
ISSELECTED, xrefs: 002304DD
SELECTCLEAR, xrefs: 0023052D
GETTEXT, xrefs: 002303EC, 00230407
GETSELECTEDCOUNT, xrefs: 00230470, 0023048B
SELECTALL, xrefs: 00230515
GETSELECTED, xrefs: 002305E1

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 1103490817-719923060
Opcode ID: a8ee99af90ba98c3c5c32f1558a667c98ad39a263ea189c0be8fa24828f8add1
Instruction ID: 047eacbb8326f189e20d8b695cfb95b11f2e0672f45217e3c0dce6be7e11d841
Opcode Fuzzy Hash: a8ee99af90ba98c3c5c32f1558a667c98ad39a263ea189c0be8fa24828f8add1
Instruction Fuzzy Hash: 65E1D0712283018FC714DF24C8A192AB3E6BFD8718F14495DF8969B3A6DB30ED55CB61

Function 001B8891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 001B8968
GetSystemMetrics.USER32(00000007), ref: 001B8970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 001B899B
GetSystemMetrics.USER32(00000008), ref: 001B89A3
GetSystemMetrics.USER32(00000004), ref: 001B89C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 001B89E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 001B89F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 001B8A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 001B8A3C
GetClientRect.USER32(00000000,000000FF), ref: 001B8A5A
GetStockObject.GDI32(00000011), ref: 001B8A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 001B8A81

Part of subcall function 001B912D: GetCursorPos.USER32(?), ref: 001B9141
Part of subcall function 001B912D: ScreenToClient.USER32(00000000,?), ref: 001B915E
Part of subcall function 001B912D: GetAsyncKeyState.USER32(00000001), ref: 001B9183
Part of subcall function 001B912D: GetAsyncKeyState.USER32(00000002), ref: 001B919D

SetTimer.USER32(00000000,00000000,00000028,001B90FC), ref: 001B8AA8

Strings

AutoIt v3 GUI, xrefs: 001B8A20

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: e02b7af66ecbbad070f851adabce5bceb485b75e56cd6161dd940af5c05c6865
Instruction ID: 8e5a2f5c900b125b82d588988ddd1c9a869056dfa206c66fb40033e9ce682ccd
Opcode Fuzzy Hash: e02b7af66ecbbad070f851adabce5bceb485b75e56cd6161dd940af5c05c6865
Instruction Fuzzy Hash: 09B16875A0020AEFDF14DFA8DC49BEA3BB5FB48714F114229FA19A7290DB30A851CB51

Function 00200D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 002010F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00201114
Part of subcall function 002010F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00200B9B,?,?,?), ref: 00201120
Part of subcall function 002010F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00200B9B,?,?,?), ref: 0020112F
Part of subcall function 002010F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00200B9B,?,?,?), ref: 00201136
Part of subcall function 002010F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0020114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00200DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00200E29
GetLengthSid.ADVAPI32(?), ref: 00200E40
GetAce.ADVAPI32(?,00000000,?), ref: 00200E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00200E96
GetLengthSid.ADVAPI32(?), ref: 00200EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00200EB5
HeapAlloc.KERNEL32(00000000), ref: 00200EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00200EDD
CopySid.ADVAPI32(00000000), ref: 00200EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00200F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00200F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00200F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00200F6E
HeapFree.KERNEL32(00000000), ref: 00200F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00200F7E
HeapFree.KERNEL32(00000000), ref: 00200F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00200F8E
HeapFree.KERNEL32(00000000), ref: 00200F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00200FA1
HeapFree.KERNEL32(00000000), ref: 00200FA8

Part of subcall function 00201193: GetProcessHeap.KERNEL32(00000008,00200BB1,?,00000000,?,00200BB1,?), ref: 002011A1
Part of subcall function 00201193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00200BB1,?), ref: 002011A8
Part of subcall function 00201193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00200BB1,?), ref: 002011B7

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 1863bef2bdb624ab711e19a8a823016a52501181bd68cdb90a0d1312897d7872
Instruction ID: 61583c0cfe4187ffda9e331a9c889b46dfaf4c7288ea6da1ecd60ca0d73e54c5
Opcode Fuzzy Hash: 1863bef2bdb624ab711e19a8a823016a52501181bd68cdb90a0d1312897d7872
Instruction Fuzzy Hash: E671617191030AEBEF209FA4DC88FAEBBB8BF05301F144125F959F6192DB719915DB60

Function 0022C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0022C4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,0023CC08,00000000,?,00000000,?,?), ref: 0022C544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 0022C5A4
_wcslen.LIBCMT ref: 0022C5F4
_wcslen.LIBCMT ref: 0022C66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 0022C6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 0022C7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 0022C84D
RegCloseKey.ADVAPI32(?), ref: 0022C881
RegCloseKey.ADVAPI32(00000000), ref: 0022C88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 0022C960

Strings

REG_QWORD, xrefs: 0022C8C3
REG_SZ, xrefs: 0022C644
REG_MULTI_SZ, xrefs: 0022C6F5
REG_BINARY, xrefs: 0022C913
REG_DWORD, xrefs: 0022C804
REG_EXPAND_SZ, xrefs: 0022C5CD

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: e0e8ad4be6ad9ad8eddb9262fd4df4f89be6ac52be20436c5a38ab60bf55885e
Instruction ID: 1429302d8e0b13586594da98bd2bb7105ea513dbb94bd88f324812a03af48f9f
Opcode Fuzzy Hash: e0e8ad4be6ad9ad8eddb9262fd4df4f89be6ac52be20436c5a38ab60bf55885e
Instruction Fuzzy Hash: AB128939614211AFCB14EF14D891B2AB7E5FF89314F14885CF88A9B3A2DB31ED51CB81

Function 0023091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 002309C6
_wcslen.LIBCMT ref: 00230A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00230A54
_wcslen.LIBCMT ref: 00230A8A
_wcslen.LIBCMT ref: 00230B06
_wcslen.LIBCMT ref: 00230B81

Part of subcall function 001BF9F2: _wcslen.LIBCMT ref: 001BF9FD

Part of subcall function 00202BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00202BFA

Strings

SELECT, xrefs: 00230D11
CHECK, xrefs: 00230A85, 00230AA0
EXISTS, xrefs: 00230B7C, 00230B97
GETTOTALCOUNT, xrefs: 002309F2, 00230A17
ISCHECKED, xrefs: 00230CE1
GETTEXT, xrefs: 00230C97
EXPAND, xrefs: 00230BF8
COLLAPSE, xrefs: 00230B01, 00230B1C
UNCHECK, xrefs: 00230D3E
GETSELECTED, xrefs: 00230C4E
GETITEMCOUNT, xrefs: 00230C1E

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: 7c264624c67ab1b392c934a0ea6fb03a96a00f6669b0420345182ec13446284f
Instruction ID: 03415ecfbf776924d52294a645396b7bde6c9765928c4c07d80223a6de930af7
Opcode Fuzzy Hash: 7c264624c67ab1b392c934a0ea6fb03a96a00f6669b0420345182ec13446284f
Instruction Fuzzy Hash: 39E1C2752283028FC714EF24C4A092AB7E2FF99718F14495DF8969B3A2D730ED55CB91

Function 0022C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,0022B6AE,?,?), ref: 0022C9B5
_wcslen.LIBCMT ref: 0022C9F1
_wcslen.LIBCMT ref: 0022CA68
_wcslen.LIBCMT ref: 0022CA9E
_wcslen.LIBCMT ref: 0022CAF9
_wcslen.LIBCMT ref: 0022CB2F
_wcslen.LIBCMT ref: 0022CB7F

Strings

HKEY_CURRENT_CONFIG, xrefs: 0022CB79, 0022CB7E
HKU, xrefs: 0022CBF0
HKCR, xrefs: 0022CB29, 0022CB2E
HKLM, xrefs: 0022CA98, 0022CA9D
HKCU, xrefs: 0022CBCE
HKEY_LOCAL_MACHINE, xrefs: 0022CA62, 0022CA67
HKCC, xrefs: 0022CBAC
HKEY_CURRENT_USER, xrefs: 0022CBBD
HKEY_USERS, xrefs: 0022CBDF
HKEY_CLASSES_ROOT, xrefs: 0022CAF3, 0022CAF8

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 16bfeceb72cb9c7f5b3453242cbf9308e6e7316d0b6af8bf2b337b34ef81d3ea
Instruction ID: 91db74f0268630b7acfb7a9994e6a7f4c502a21fd7bcaaf78f883b9793619e8d
Opcode Fuzzy Hash: 16bfeceb72cb9c7f5b3453242cbf9308e6e7316d0b6af8bf2b337b34ef81d3ea
Instruction Fuzzy Hash: AB71E23263413BABCB20DEB8EC516BE3391AF71758B300129F85697284E771CDA5C3A0

Function 0023833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0023835A
_wcslen.LIBCMT ref: 0023836E
_wcslen.LIBCMT ref: 00238391
_wcslen.LIBCMT ref: 002383B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 002383F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00235BF2), ref: 0023844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00238487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 002384CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00238501
FreeLibrary.KERNEL32(?), ref: 0023850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0023851D
DestroyIcon.USER32(?,?,?,?,?,00235BF2), ref: 0023852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00238549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00238555

Strings

.icl, xrefs: 00238368
.dll, xrefs: 002383AB
.exe, xrefs: 00238388

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 09ebf17fd616c62cdf8819fda6800455cee94434bebd22324d7993e2fbc4a623
Instruction ID: 3eab52cffe4c29065a86d5e6cd276924f9ca69efbafdc5ca5292a60415f29fa2
Opcode Fuzzy Hash: 09ebf17fd616c62cdf8819fda6800455cee94434bebd22324d7993e2fbc4a623
Instruction Fuzzy Hash: 6961F1B1924316BBEB14DF64DC45BBE77A8BB18710F104209F915EA1D1DBB4E9A0CBA0

Function 001A7778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#requireadmin, xrefs: 001A77FF
#include-once, xrefs: 001A782F
#comments-start, xrefs: 001A785F, 001A78B1
Cannot parse #include, xrefs: 001E5279
Bad directive syntax error, xrefs: 001E519A
#OnAutoItStartRegister, xrefs: 001A7817
', xrefs: 001E5169
#notrayicon, xrefs: 001A77E7
#comments-end, xrefs: 001A78D9
Unterminated group of comments, xrefs: 001E528C
#cs, xrefs: 001A7873, 001A78C5
", xrefs: 001E5153
#include, xrefs: 001A7847
#pragma compile, xrefs: 001A77D3
#ce, xrefs: 001A78ED

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: d4988d311478a1ac51b210bd94c813a3e923c525c2d164749f0a033c033788c9
Instruction ID: 35fa062fcf8448b78b0fc407e7e1940a48504fb04a4922f24e76923f029d797b
Opcode Fuzzy Hash: d4988d311478a1ac51b210bd94c813a3e923c525c2d164749f0a033c033788c9
Instruction Fuzzy Hash: 3B814B75A04605BBDB24BFA0DC46FBF37A9AF26300F044024F904AB1D6EB70DA51D7A1

Function 00213E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00213EF8
_wcslen.LIBCMT ref: 00213F03
_wcslen.LIBCMT ref: 00213F5A
_wcslen.LIBCMT ref: 00213F98
GetDriveTypeW.KERNEL32(?), ref: 00213FD6
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0021401E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00214059
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00214087

Strings

type cdaudio alias cd wait, xrefs: 00214001
closed, xrefs: 00213F08, 00213F2D, 00213F46, 00213F7E, 00213F97
set cd door , xrefs: 00214028
close, xrefs: 00213EFE, 00213F18
open, xrefs: 00213F54, 00213F59
close cd wait, xrefs: 00214072
wait, xrefs: 00214044
open , xrefs: 00213FE5

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: d5f898359ac3e9543df7f9ef4b45148e630e86d62cb9deb7c0c17584cafc22e5
Instruction ID: cf12e9beb25b9e638f51331701f267e1334d5b95e4eb4ca4a7204747791a66c3
Opcode Fuzzy Hash: d5f898359ac3e9543df7f9ef4b45148e630e86d62cb9deb7c0c17584cafc22e5
Instruction Fuzzy Hash: 1E71E2326142129FC710EF34C8808AAB7F5EFB9758F10492DF89597251EB31DE96CB91

Function 00205A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00205A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00205A40
SetWindowTextW.USER32(?,?), ref: 00205A57
GetDlgItem.USER32(?,000003EA), ref: 00205A6C
SetWindowTextW.USER32(00000000,?), ref: 00205A72
GetDlgItem.USER32(?,000003E9), ref: 00205A82
SetWindowTextW.USER32(00000000,?), ref: 00205A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00205AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00205AC3
GetWindowRect.USER32(?,?), ref: 00205ACC
_wcslen.LIBCMT ref: 00205B33
SetWindowTextW.USER32(?,?), ref: 00205B6F
GetDesktopWindow.USER32 ref: 00205B75
GetWindowRect.USER32(00000000), ref: 00205B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00205BD3
GetClientRect.USER32(?,?), ref: 00205BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00205C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00205C2F

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: 525d827b6180b2efaf2cb37344d015af513f467d5d003c052d4103516c540655
Instruction ID: 74b109b322f2f75766aff1f75cb2ddcd0d6b2386d16a14bc8f6692a7bca6faf4
Opcode Fuzzy Hash: 525d827b6180b2efaf2cb37344d015af513f467d5d003c052d4103516c540655
Instruction Fuzzy Hash: 48716C31A10B1AAFDB20DFA8CE89AAFBBF5FF48704F104518E542A25A5D774E950CF50

Function 0021FE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 0021FE27
LoadCursorW.USER32(00000000,00007F8A), ref: 0021FE32
LoadCursorW.USER32(00000000,00007F00), ref: 0021FE3D
LoadCursorW.USER32(00000000,00007F03), ref: 0021FE48
LoadCursorW.USER32(00000000,00007F8B), ref: 0021FE53
LoadCursorW.USER32(00000000,00007F01), ref: 0021FE5E
LoadCursorW.USER32(00000000,00007F81), ref: 0021FE69
LoadCursorW.USER32(00000000,00007F88), ref: 0021FE74
LoadCursorW.USER32(00000000,00007F80), ref: 0021FE7F
LoadCursorW.USER32(00000000,00007F86), ref: 0021FE8A
LoadCursorW.USER32(00000000,00007F83), ref: 0021FE95
LoadCursorW.USER32(00000000,00007F85), ref: 0021FEA0
LoadCursorW.USER32(00000000,00007F82), ref: 0021FEAB
LoadCursorW.USER32(00000000,00007F84), ref: 0021FEB6
LoadCursorW.USER32(00000000,00007F04), ref: 0021FEC1
LoadCursorW.USER32(00000000,00007F02), ref: 0021FECC
GetCursorInfo.USER32(?), ref: 0021FEDC
GetLastError.KERNEL32 ref: 0021FF1E

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 01853458181709a8e546fec13c598d55e4f885b4a1600cdda1def4a982c644e7
Instruction ID: e803d3a4a3f796817965ff9df5352fbf8cb7993e5d427fb8bcb032e73707ef35
Opcode Fuzzy Hash: 01853458181709a8e546fec13c598d55e4f885b4a1600cdda1def4a982c644e7
Instruction Fuzzy Hash: C74161B0D0831A6ADB109FBA8C8985EBFE8FF04354B50452AE11DE7681DB78E941CF90

Function 002030F7 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0020318D
_wcslen.LIBCMT ref: 002031F8

Strings

[&, xrefs: 0020339A
CLASS, xrefs: 00203188, 002031A5
NAME, xrefs: 00203335, 00203346
REGEXPCLASS, xrefs: 00203255, 00203266
TEXT, xrefs: 0020347C
CLASSNN, xrefs: 002031F3, 00203204
INSTANCE, xrefs: 00203453

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT$[&
API String ID: 176396367-842257027
Opcode ID: 469e491f48b3a32bb5e8adb14302c11307fb222810c1eedcd0981ab101bfca5d
Instruction ID: 1a11fb31dee529d1532412fa3f71836de57279234b9874494cfe83f02dc32275
Opcode Fuzzy Hash: 469e491f48b3a32bb5e8adb14302c11307fb222810c1eedcd0981ab101bfca5d
Instruction Fuzzy Hash: 86E1E632A207269FCB14DF64C8917EDFBB8BF58710F548119E456E7282DB30AEA5C790

Function 001C00C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 001C00C6

Part of subcall function 001C00ED: InitializeCriticalSectionAndSpinCount.KERNEL32(0027070C,00000FA0,A0B3449E,?,?,?,?,001E23B3,000000FF), ref: 001C011C
Part of subcall function 001C00ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,001E23B3,000000FF), ref: 001C0127
Part of subcall function 001C00ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,001E23B3,000000FF), ref: 001C0138
Part of subcall function 001C00ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 001C014E
Part of subcall function 001C00ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 001C015C
Part of subcall function 001C00ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 001C016A
Part of subcall function 001C00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 001C0195
Part of subcall function 001C00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 001C01A0

___scrt_fastfail.LIBCMT ref: 001C00E7

Part of subcall function 001C00A3: __onexit.LIBCMT ref: 001C00A9

Strings

InitializeConditionVariable, xrefs: 001C0148
kernel32.dll, xrefs: 001C0133
WakeAllConditionVariable, xrefs: 001C0162
api-ms-win-core-synch-l1-2-0.dll, xrefs: 001C0122
SleepConditionVariableCS, xrefs: 001C0154

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: d98e97ec5b2879f21364948bf108c2cb04b36454cf8d19c3d5027a3bec88db88
Instruction ID: 45bdbb306d768becde95da70e8c7d11738690ea8e477d6af3f1c6135ce70c139
Opcode Fuzzy Hash: d98e97ec5b2879f21364948bf108c2cb04b36454cf8d19c3d5027a3bec88db88
Instruction Fuzzy Hash: 8821F672A44710EBE7166BA4BD4EF6AB3E4EB2DB51F15012DF845E2291DBB0DC008A90

Function 002144C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,0023CC08), ref: 00214527
_wcslen.LIBCMT ref: 0021453B
_wcslen.LIBCMT ref: 00214599
_wcslen.LIBCMT ref: 002145F4
_wcslen.LIBCMT ref: 0021463F
_wcslen.LIBCMT ref: 002146A7

Part of subcall function 001BF9F2: _wcslen.LIBCMT ref: 001BF9FD

GetDriveTypeW.KERNEL32(?,00266BF0,00000061), ref: 00214743

Strings

all, xrefs: 00214531, 00214536
network, xrefs: 0021469D, 002146A2
ramdisk, xrefs: 002146F1
fixed, xrefs: 00214635, 0021463A
removable, xrefs: 002145EA, 002145EF
unknown, xrefs: 00214708
cdrom, xrefs: 0021458F, 00214594

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 561e514e5317bdc2ed48f7b811bfb09207adaa85524b19006401a84e311a604b
Instruction ID: 11269534fec1ed8c6235d82b14367bd63f4f279159b4e1b7855fe6b51188c9fb
Opcode Fuzzy Hash: 561e514e5317bdc2ed48f7b811bfb09207adaa85524b19006401a84e311a604b
Instruction Fuzzy Hash: 1EB112716283029FC710EF28C890AAAF7E5BFB6724F50491DF49AD7291D730D895CB92

Function 0023911E Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 001B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 001B9BB2

DragQueryPoint.SHELL32(?,?), ref: 00239147

Part of subcall function 00237674: ClientToScreen.USER32(?,?), ref: 0023769A
Part of subcall function 00237674: GetWindowRect.USER32(?,?), ref: 00237710
Part of subcall function 00237674: PtInRect.USER32(?,?,00238B89), ref: 00237720

SendMessageW.USER32(?,000000B0,?,?), ref: 002391B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 002391BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 002391DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00239225
SendMessageW.USER32(?,000000B0,?,?), ref: 0023923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00239255
SendMessageW.USER32(?,000000B1,?,?), ref: 00239277
DragFinish.SHELL32(?), ref: 0023927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00239371

Strings

p#', xrefs: 002392BB
@GUI_DRAGID, xrefs: 002392E9
@GUI_DRAGFILE, xrefs: 00239320
@GUI_DROPID, xrefs: 0023929E

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$p#'
API String ID: 221274066-3577977142
Opcode ID: 50dba577402063223e20cfe5e782d5b1e03a2bb80b5ae61ef9414229a3ec1838
Instruction ID: 2a48c89f3f13c3284b4ddf53988a47f5778315a153623d8465d94d4237ca890f
Opcode Fuzzy Hash: 50dba577402063223e20cfe5e782d5b1e03a2bb80b5ae61ef9414229a3ec1838
Instruction Fuzzy Hash: 97618B71108301AFC705EF64DC89DAFBBF8EF9A750F10091EF595922A0DB709A99CB52

Function 0022AFF9 Relevance: 24.4, APIs: 16, Instructions: 418processCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0022B198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0022B1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0022B1D4
_wcslen.LIBCMT ref: 0022B200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0022B214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0022B236
_wcslen.LIBCMT ref: 0022B332

Part of subcall function 002105A7: GetStdHandle.KERNEL32(000000F6), ref: 002105C6

_wcslen.LIBCMT ref: 0022B34B
_wcslen.LIBCMT ref: 0022B366
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0022B3B6
GetLastError.KERNEL32(00000000), ref: 0022B407
CloseHandle.KERNEL32(?), ref: 0022B439
CloseHandle.KERNEL32(00000000), ref: 0022B44A
CloseHandle.KERNEL32(00000000), ref: 0022B45C
CloseHandle.KERNEL32(00000000), ref: 0022B46E
CloseHandle.KERNEL32(?), ref: 0022B4E3

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: a21203f166f6ca3c377c16d06bcbc12ababb467cc6dfc35f6a57b573207dc171
Instruction ID: 34ab1a5d106493b7fa110d15edf5cc873fefe67c3ca89598ed84236f30ef154f
Opcode Fuzzy Hash: a21203f166f6ca3c377c16d06bcbc12ababb467cc6dfc35f6a57b573207dc171
Instruction Fuzzy Hash: 33F1CD31518351EFC715EF24D891B6EBBE1AF85310F18855DF8899B2A2CB31ED50CB52

Function 001A326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00271990), ref: 001E2F8D
GetMenuItemCount.USER32(00271990), ref: 001E303D
GetCursorPos.USER32(?), ref: 001E3081
SetForegroundWindow.USER32(00000000), ref: 001E308A
TrackPopupMenuEx.USER32(00271990,00000000,?,00000000,00000000,00000000), ref: 001E309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 001E30A9

Strings

0, xrefs: 001A327D

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 83e7b69c50418a72e86b3dc143c3f4d4b469ab4e7fc09e169a59501fa6262e3e
Instruction ID: 2a93fdde84f804f9c7278927b783ae3447c302c1ff425e8983cf85de8698efd3
Opcode Fuzzy Hash: 83e7b69c50418a72e86b3dc143c3f4d4b469ab4e7fc09e169a59501fa6262e3e
Instruction Fuzzy Hash: 17713571640655BEFB258F69DC59FAEBF68FF05324F204206F524AA1E0C7B1AD60CB90

Function 00236CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00236DEB

Part of subcall function 001A6B57: _wcslen.LIBCMT ref: 001A6B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00236E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00236E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00236E94
DestroyWindow.USER32(?), ref: 00236EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,001A0000,00000000), ref: 00236EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00236EFD
GetDesktopWindow.USER32 ref: 00236F16
GetWindowRect.USER32(00000000), ref: 00236F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00236F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00236F4D

Part of subcall function 001B9944: GetWindowLongW.USER32(?,000000EB), ref: 001B9952

Strings

tooltips_class32, xrefs: 00236E58, 00236EDD
0, xrefs: 00236D98

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 88af7822adeb90cc609ae506435abf516fa11f1bc95782569f67ae2f2c56fdad
Instruction ID: 9ba5f95db3a7112175784da77d9259453cdf6b686c0b8335be2f224883c7610e
Opcode Fuzzy Hash: 88af7822adeb90cc609ae506435abf516fa11f1bc95782569f67ae2f2c56fdad
Instruction Fuzzy Hash: 1B718CB4114241AFDB25CF18EC48F6ABBF9FB89304F14441DFA8997260C770A956CF21

Function 0021C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0021C4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0021C4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0021C4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0021C4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 0021C533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 0021C549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0021C554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0021C584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 0021C5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 0021C5F0
InternetCloseHandle.WININET(00000000), ref: 0021C5FB

Strings

, xrefs: 0021C575

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: 85d2bbe1243b992e193c8fd5f758c8ec0a5a77d180f99922cf406cd33016ad93
Instruction ID: 0d6beb8b6b9ca06f01d0b6432f31ef44282d8f92787e21e365f4d2fbc73a437e
Opcode Fuzzy Hash: 85d2bbe1243b992e193c8fd5f758c8ec0a5a77d180f99922cf406cd33016ad93
Instruction Fuzzy Hash: 83517DB5550205BFDB218F60DD48ABBBBFDFF18754F20441AF945E6210DB30E9949B60

Function 0023856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00000000,?,000000EC), ref: 00238592
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 002385A2
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 002385AD
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 002385BA
GlobalLock.KERNEL32(00000000), ref: 002385C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 002385D7
GlobalUnlock.KERNEL32(00000000), ref: 002385E0
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 002385E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,000000F0,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 002385F8
OleLoadPicture.OLEAUT32(000000F0,00000000,00000000,0023FC38,?), ref: 00238611
GlobalFree.KERNEL32(00000000), ref: 00238621
GetObjectW.GDI32(?,00000018,?), ref: 00238641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00238671
DeleteObject.GDI32(?), ref: 00238699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 002386AF

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 531d3fb15b5c32ce670d2d3bd7e37cfb92da177a9148ff0127adb9053c263d09
Instruction ID: 5ea0707384f1acb1206aa1d1f0bd36c37c289cb8e1c43c4038dcbfb592cc1339
Opcode Fuzzy Hash: 531d3fb15b5c32ce670d2d3bd7e37cfb92da177a9148ff0127adb9053c263d09
Instruction Fuzzy Hash: B441FAB5600205AFDB119FA5DC8DEAB7BBCEF89B11F108059F909EB260DB709911DF60

Function 002114BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00211502
VariantCopy.OLEAUT32(?,?), ref: 0021150B
VariantClear.OLEAUT32(?), ref: 00211517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 002115FB
VarR8FromDec.OLEAUT32(?,?), ref: 00211657
VariantInit.OLEAUT32(?), ref: 00211708
SysFreeString.OLEAUT32(?), ref: 0021178C
VariantClear.OLEAUT32(?), ref: 002117D8
VariantClear.OLEAUT32(?), ref: 002117E7
VariantInit.OLEAUT32(00000000), ref: 00211823

Strings

Default, xrefs: 002116AF
%4d%02d%02d%02d%02d%02d, xrefs: 00211625

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: c228f4037b53653ea483e411082c3a543bdca23cbf57743b78e54edb49596b9e
Instruction ID: 2a678ef03b18fdcc72a5caf074e9d2f57d444937ac7846c487f10d7b774d6be2
Opcode Fuzzy Hash: c228f4037b53653ea483e411082c3a543bdca23cbf57743b78e54edb49596b9e
Instruction Fuzzy Hash: 57D10231620115EBDB109F64E884BFEB7F6BF65700F60805AE646AB280DB70DCB1DB52

Function 0022B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

Part of subcall function 0022C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0022B6AE,?,?), ref: 0022C9B5
Part of subcall function 0022C998: _wcslen.LIBCMT ref: 0022C9F1
Part of subcall function 0022C998: _wcslen.LIBCMT ref: 0022CA68
Part of subcall function 0022C998: _wcslen.LIBCMT ref: 0022CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0022B6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0022B772
RegDeleteValueW.ADVAPI32(?,?), ref: 0022B80A
RegCloseKey.ADVAPI32(?), ref: 0022B87E
RegCloseKey.ADVAPI32(?), ref: 0022B89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 0022B8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0022B904
RegDeleteKeyW.ADVAPI32(?,?), ref: 0022B922
FreeLibrary.KERNEL32(00000000), ref: 0022B983
RegCloseKey.ADVAPI32(00000000), ref: 0022B994

Strings

RegDeleteKeyExW, xrefs: 0022B8FE
advapi32.dll, xrefs: 0022B8ED

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: 7790ac5b81ef7366c365d1347708edd851a6c36906c6274307f90aa195dabc51
Instruction ID: 9db573f5715f4d1b03e43098ff73dfae816c07e8be77e264c566802e1a795936
Opcode Fuzzy Hash: 7790ac5b81ef7366c365d1347708edd851a6c36906c6274307f90aa195dabc51
Instruction Fuzzy Hash: F2C1BD35218212AFD715DF54D494F2ABBE5FF85318F14845CF49A8B2A2CB71EC86CB82

Function 0022255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 002225D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 002225E8
CreateCompatibleDC.GDI32(?), ref: 002225F4
SelectObject.GDI32(00000000,?), ref: 00222601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 0022266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 002226AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 002226D0
SelectObject.GDI32(?,?), ref: 002226D8
DeleteObject.GDI32(?), ref: 002226E1
DeleteDC.GDI32(?), ref: 002226E8
ReleaseDC.USER32(00000000,?), ref: 002226F3

Strings

(, xrefs: 0022268D

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 5a06e9487088c66e5841e06786ed0ee020decfc44bcf2295f6d6cc90b515da1b
Instruction ID: 9f46de9d16a1764c84acd5c4810d9c57c5034ea5d977ec087af676a80194b56e
Opcode Fuzzy Hash: 5a06e9487088c66e5841e06786ed0ee020decfc44bcf2295f6d6cc90b515da1b
Instruction Fuzzy Hash: BD611376D10219EFCF14CFE4E888AAEBBB9FF48310F208429E955A7250D371A951CF60

Function 001DDA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 001DDAA1

Part of subcall function 001DD63C: _free.LIBCMT ref: 001DD659
Part of subcall function 001DD63C: _free.LIBCMT ref: 001DD66B
Part of subcall function 001DD63C: _free.LIBCMT ref: 001DD67D
Part of subcall function 001DD63C: _free.LIBCMT ref: 001DD68F
Part of subcall function 001DD63C: _free.LIBCMT ref: 001DD6A1
Part of subcall function 001DD63C: _free.LIBCMT ref: 001DD6B3
Part of subcall function 001DD63C: _free.LIBCMT ref: 001DD6C5
Part of subcall function 001DD63C: _free.LIBCMT ref: 001DD6D7
Part of subcall function 001DD63C: _free.LIBCMT ref: 001DD6E9
Part of subcall function 001DD63C: _free.LIBCMT ref: 001DD6FB
Part of subcall function 001DD63C: _free.LIBCMT ref: 001DD70D
Part of subcall function 001DD63C: _free.LIBCMT ref: 001DD71F
Part of subcall function 001DD63C: _free.LIBCMT ref: 001DD731

_free.LIBCMT ref: 001DDA96

Part of subcall function 001D29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,001DD7D1,00000000,00000000,00000000,00000000,?,001DD7F8,00000000,00000007,00000000,?,001DDBF5,00000000), ref: 001D29DE
Part of subcall function 001D29C8: GetLastError.KERNEL32(00000000,?,001DD7D1,00000000,00000000,00000000,00000000,?,001DD7F8,00000000,00000007,00000000,?,001DDBF5,00000000,00000000), ref: 001D29F0

_free.LIBCMT ref: 001DDAB8
_free.LIBCMT ref: 001DDACD
_free.LIBCMT ref: 001DDAD8
_free.LIBCMT ref: 001DDAFA
_free.LIBCMT ref: 001DDB0D
_free.LIBCMT ref: 001DDB1B
_free.LIBCMT ref: 001DDB26
_free.LIBCMT ref: 001DDB5E
_free.LIBCMT ref: 001DDB65
_free.LIBCMT ref: 001DDB82
_free.LIBCMT ref: 001DDB9A

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 27f66aa4772b55e71ddbd3a41c828195c6f7593c6a07653b9533621dc09aaed2
Instruction ID: 9b7933bdaeb997513925d9ca33b0d3709cb9355373d98399e0d47684c830b447
Opcode Fuzzy Hash: 27f66aa4772b55e71ddbd3a41c828195c6f7593c6a07653b9533621dc09aaed2
Instruction Fuzzy Hash: DA315C316047059FEB25AA39E845B6A77E9FF21318F15841BE459D7391DF31EC80DB20

Function 0020365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0020369C
_wcslen.LIBCMT ref: 002036A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00203797
GetClassNameW.USER32(?,?,00000400), ref: 0020380C
GetDlgCtrlID.USER32(?), ref: 0020385D
GetWindowRect.USER32(?,?), ref: 00203882
GetParent.USER32(?), ref: 002038A0
ScreenToClient.USER32(00000000), ref: 002038A7
GetClassNameW.USER32(?,?,00000100), ref: 00203921
GetWindowTextW.USER32(?,?,00000400), ref: 0020395D

Strings

%s%u, xrefs: 00203734

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: 9fd7708b046e242496e72927a5f5d0e8bf1523d2ffbf26b048a4472f5b7cb763
Instruction ID: b522ad6ce437b3103ea85233496350b3ae0a3f226a7d822ed7b8d1d98d542490
Opcode Fuzzy Hash: 9fd7708b046e242496e72927a5f5d0e8bf1523d2ffbf26b048a4472f5b7cb763
Instruction Fuzzy Hash: 5591BB7121470BAFD719DF24C885BAAB7ACFF44310F108629F999D2192DB30EA65CB91

Function 00204954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00204994
GetWindowTextW.USER32(?,?,00000400), ref: 002049DA
_wcslen.LIBCMT ref: 002049EB
CharUpperBuffW.USER32(?,00000000), ref: 002049F7
_wcsstr.LIBVCRUNTIME ref: 00204A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00204A64
GetWindowTextW.USER32(?,?,00000400), ref: 00204A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00204AE6
GetClassNameW.USER32(?,?,00000400), ref: 00204B20
GetWindowRect.USER32(?,?), ref: 00204B8B

Strings

ThumbnailClass, xrefs: 00204A6F, 00204AF1

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: d4bfea2fc22a8cb324dd9650365eb5425a6fa986e5fcf60342ff13852d1dd200
Instruction ID: 5aa9c43c2dc7af5669e5470424cfdaae85bfe53cba872c5a5b65db9bcfbf3842
Opcode Fuzzy Hash: d4bfea2fc22a8cb324dd9650365eb5425a6fa986e5fcf60342ff13852d1dd200
Instruction Fuzzy Hash: 9991BCB11183069BDB04EE14C985FAA77E8FF84318F04846AFE859A0D6DB30ED55CBA1

Function 00238D0E Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 221windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 001B9BB2

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00238D5A
GetFocus.USER32 ref: 00238D6A
GetDlgCtrlID.USER32(00000000), ref: 00238D75
DefDlgProcW.USER32(?,00000111,?,?,00000000,?,?,?,?,?,?,?), ref: 00238E1D
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00238ECF
GetMenuItemCount.USER32(?), ref: 00238EEC
GetMenuItemID.USER32(?,00000000), ref: 00238EFC
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00238F2E
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00238F70
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00238FA1

Strings

0, xrefs: 00238E9F

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
String ID: 0
API String ID: 1026556194-4108050209
Opcode ID: 5e610fec1b7923c27097eb4c2e05389857db2ed68d79fc0f0148d62b0d32d852
Instruction ID: dfd7a6b070acc20c07ce81f116194431f4a9de68cc39fd3a7a3925a9a70c26bc
Opcode Fuzzy Hash: 5e610fec1b7923c27097eb4c2e05389857db2ed68d79fc0f0148d62b0d32d852
Instruction Fuzzy Hash: C681C2B15243029FD710DF24D888EABBBE9FF88714F14091DF985AB291DB70D911CBA2

Function 0020DC0E Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 178COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 0020DC20
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 0020DC46
_wcslen.LIBCMT ref: 0020DC50
_wcsstr.LIBVCRUNTIME ref: 0020DCA0
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 0020DCBC

Strings

\VarFileInfo\Translation, xrefs: 0020DCB4
%u.%u.%u.%u, xrefs: 0020DD9A
DefaultLangCodepage, xrefs: 0020DD1F
04090000, xrefs: 0020DCF2
StringFileInfo\, xrefs: 0020DC8F

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue_wcslen_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 1939486746-1459072770
Opcode ID: 984bd90b92447b2ca0d8d74cc8e7f25a201e012b8212de424ebec2839dcc3c2c
Instruction ID: bf8601912881f9894d6a93798b111af11b4a0e3d4a51cb8daeb0ae9ddb9ce248
Opcode Fuzzy Hash: 984bd90b92447b2ca0d8d74cc8e7f25a201e012b8212de424ebec2839dcc3c2c
Instruction Fuzzy Hash: 8941D2729503017ADB14ABB49C47EFF776CEF66710F100069F900A6183EB70DA2187A4

Function 0022CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0022CC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 0022CC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0022CD48

Part of subcall function 0022CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 0022CCAA
Part of subcall function 0022CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 0022CCBD
Part of subcall function 0022CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 0022CCCF
Part of subcall function 0022CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 0022CD05
Part of subcall function 0022CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 0022CD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 0022CCF3

Strings

RegDeleteKeyExW, xrefs: 0022CCC9
advapi32.dll, xrefs: 0022CCB8

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: e026b12b9aa866dfa2194b1c27c9eda1c42293d8d7dda7d220eadad1c1f57753
Instruction ID: c2733779d86df0ee9fd1a498be7cfcfb1083e50670b4d800a4d2ef1d3f5004c0
Opcode Fuzzy Hash: e026b12b9aa866dfa2194b1c27c9eda1c42293d8d7dda7d220eadad1c1f57753
Instruction Fuzzy Hash: 2B318075911129BBD7248FA1EC8CEFFBB7CEF05750F200165A905E3240DA749E45ABA0

Function 00213D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00213D40
_wcslen.LIBCMT ref: 00213D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00213D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00213DBE
RemoveDirectoryW.KERNEL32(?), ref: 00213DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00213E55
CloseHandle.KERNEL32(00000000), ref: 00213E60
CloseHandle.KERNEL32(00000000), ref: 00213E6B

Strings

\, xrefs: 00213D77
\??\%s, xrefs: 00213D5B
:, xrefs: 00213D82

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: 46178155362ec1b5fb65c8da36e8b1bb6094c0e1ce996025a425cf1d57424fef
Instruction ID: d78d826f578f38b1ce30ea3f14280d93d4ab33caf22dacad25de8f37caf96fea
Opcode Fuzzy Hash: 46178155362ec1b5fb65c8da36e8b1bb6094c0e1ce996025a425cf1d57424fef
Instruction Fuzzy Hash: 8431927291020AABDB20DFA0EC49FEF37BDEF99700F1040A5F505E6090E77497948B64

Function 0020E6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0020E6B4

Part of subcall function 001BE551: timeGetTime.WINMM(?,?,0020E6D4), ref: 001BE555

Sleep.KERNEL32(0000000A), ref: 0020E6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 0020E705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 0020E727
SetActiveWindow.USER32 ref: 0020E746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 0020E754
SendMessageW.USER32(00000010,00000000,00000000), ref: 0020E773
Sleep.KERNEL32(000000FA), ref: 0020E77E
IsWindow.USER32 ref: 0020E78A
EndDialog.USER32(00000000), ref: 0020E79B

Strings

BUTTON, xrefs: 0020E719

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: b42710ac632ef168a3deadfceb8de18ec262172130e7366ea5c1f1a7e92f736e
Instruction ID: ebaf77e1e0fe9f8ac1b397678fae5e7d761211f029ae4611e31e068dd42b8868
Opcode Fuzzy Hash: b42710ac632ef168a3deadfceb8de18ec262172130e7366ea5c1f1a7e92f736e
Instruction Fuzzy Hash: EA21A1B0210301EFEF006F20FC8DA257B6DFB94348F250825F90AA11F2DB71ACA49B24

Function 0020E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 0020EA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 0020EA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0020EA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0020EA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0020EAA7

Strings

play PlayMe wait, xrefs: 0020EA91
status PlayMe mode, xrefs: 0020EA58
alias PlayMe, xrefs: 0020EA36
play PlayMe, xrefs: 0020EAA2
close PlayMe, xrefs: 0020EA6E, 0020EA9B
open , xrefs: 0020EA0C

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: 90033ae8293a45de2ff94796fdf3ee7dac443b2e10380529599fca248adac8fe
Instruction ID: e73da22dd73c6e229dc29e1d98fb99fb53072bbb9d988797691a6acbf600bdba
Opcode Fuzzy Hash: 90033ae8293a45de2ff94796fdf3ee7dac443b2e10380529599fca248adac8fe
Instruction Fuzzy Hash: DB117735A6125979DB10A762DC4EEFF6A7CEFD7B40F4408297811A20D1DFB00995C5B0

Function 00205CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00205CE2
GetWindowRect.USER32(00000000,?), ref: 00205CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00205D59
GetDlgItem.USER32(?,00000002), ref: 00205D69
GetWindowRect.USER32(00000000,?), ref: 00205D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00205DCF
GetDlgItem.USER32(?,000003E9), ref: 00205DDD
GetWindowRect.USER32(00000000,?), ref: 00205DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00205E31
GetDlgItem.USER32(?,000003EA), ref: 00205E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00205E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00205E67

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 21518b529318768f273c1e3249b1c8ca8794364c96742332daf93abe2064de48
Instruction ID: 4747233ffd2bcd64c51ab538e022346cb533f1dfa69d1a619dcd12a6903f53e0
Opcode Fuzzy Hash: 21518b529318768f273c1e3249b1c8ca8794364c96742332daf93abe2064de48
Instruction Fuzzy Hash: B1512EB0A10715AFDF18CF68DD89AAEBBB9FB48310F208129F915E6291D7709E10CF50

Function 001B8BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 001B8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,001B8BE8,?,00000000,?,?,?,?,001B8BBA,00000000,?), ref: 001B8FC5

DestroyWindow.USER32(?), ref: 001B8C81
KillTimer.USER32(00000000,?,?,?,?,001B8BBA,00000000,?), ref: 001B8D1B
DestroyAcceleratorTable.USER32(00000000), ref: 001F6973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,001B8BBA,00000000,?), ref: 001F69A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,001B8BBA,00000000,?), ref: 001F69B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,001B8BBA,00000000), ref: 001F69D4
DeleteObject.GDI32(00000000), ref: 001F69E6

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: e1b7f6616502b2bf11dd31fc3f962835e5d637056c36a82bc8eb81a5ddd415ef
Instruction ID: 9b68fb5e67e3f2929e2e7969b7dbc126ee73720458baaac7be5bc44a2df12062
Opcode Fuzzy Hash: e1b7f6616502b2bf11dd31fc3f962835e5d637056c36a82bc8eb81a5ddd415ef
Instruction Fuzzy Hash: E061B971102605DFCB299F28E948BA5BBF5FF40716F244518E246AB960CB71A8A1DFA0

Function 001B9838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 001B9944: GetWindowLongW.USER32(?,000000EB), ref: 001B9952

GetSysColor.USER32(0000000F), ref: 001B9862

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: a2cc7f5a2d4b2dafae3bc5f274570b0b8d56126bc282513e14675436440e7670
Instruction ID: 010c234e673c26b5c4894d763b821ecd63224ab33ac0fc0253c3b5db3d90c773
Opcode Fuzzy Hash: a2cc7f5a2d4b2dafae3bc5f274570b0b8d56126bc282513e14675436440e7670
Instruction Fuzzy Hash: 15418E31104648AFDB215F38AC88BF93BB5AB06331F244659FBA69B2E1D7319C43DB10

Function 002096E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,001EF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00209717
LoadStringW.USER32(00000000,?,001EF7F8,00000001), ref: 00209720

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,001EF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00209742
LoadStringW.USER32(00000000,?,001EF7F8,00000001), ref: 00209745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00209866

Strings

Error: , xrefs: 0020981D
%s (%d) : ==> %s: %s %s, xrefs: 0020984A
Line %d (File "%s"):, xrefs: 0020978F
^ ERROR, xrefs: 002097FB
Line %d:, xrefs: 002097A0

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: a6345cd86b39792f8a3bbb90745bf46d15e0bc4da0da8a0a2e7f19eabf12599c
Instruction ID: 53550bbf7f63a0b43b64bb47f8069067723d3a60f45fa852e65fbf94518d63b5
Opcode Fuzzy Hash: a6345cd86b39792f8a3bbb90745bf46d15e0bc4da0da8a0a2e7f19eabf12599c
Instruction Fuzzy Hash: E5415172800219AACF05EBE1DD46EEEB778EF66340F504065F50672092EF356F99CB61

Function 002006DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 001A6B57: _wcslen.LIBCMT ref: 001A6B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 002007A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 002007BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 002007DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00200804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 0020082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00200837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0020083C

Strings

SOFTWARE\Classes\, xrefs: 0020070E
\CLSID, xrefs: 00200724
\IPC$, xrefs: 00200784

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: 853a44564232bcb4a27f7c67cb33e78e1b0c1f505a878e7240680f6ff263172a
Instruction ID: 66f1eb9bc7e23b6d211b6e1d107033aca3d8fdefbbedfc9853ed125033ee17b9
Opcode Fuzzy Hash: 853a44564232bcb4a27f7c67cb33e78e1b0c1f505a878e7240680f6ff263172a
Instruction Fuzzy Hash: 39411476C20229ABDF15EFA4DC85DEEB778BF14350F544129E901B31A1EB349E54CBA0

Function 00223C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00223C5C
CoInitialize.OLE32(00000000), ref: 00223C8A
CoUninitialize.OLE32 ref: 00223C94
_wcslen.LIBCMT ref: 00223D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00223DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00223ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00223F0E
CoGetObject.OLE32(?,00000000,0023FB98,?), ref: 00223F2D
SetErrorMode.KERNEL32(00000000), ref: 00223F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00223FC4
VariantClear.OLEAUT32(?), ref: 00223FD8

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 23c9f33afd2ec78ea0f252f5e761256aacae61ac5562ec069c291b67bfd48527
Instruction ID: 8e1992bbf71559c2554b525c88dbd0c94e3f3dedde40738530fb035e37d3f774
Opcode Fuzzy Hash: 23c9f33afd2ec78ea0f252f5e761256aacae61ac5562ec069c291b67bfd48527
Instruction Fuzzy Hash: B0C17671618311AFD700DFA8E88492BB7E9FF89748F10491DF98A9B251DB34EE05CB52

Function 00217A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00217AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00217B8F
SHGetDesktopFolder.SHELL32(?), ref: 00217BA3
CoCreateInstance.OLE32(0023FD08,00000000,00000001,00266E6C,?), ref: 00217BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00217C74
CoTaskMemFree.OLE32(?,?), ref: 00217CCC
SHBrowseForFolderW.SHELL32(?), ref: 00217D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00217D7A
CoTaskMemFree.OLE32(00000000), ref: 00217D81
CoTaskMemFree.OLE32(00000000), ref: 00217DD6
CoUninitialize.OLE32 ref: 00217DDC

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 9a1642866dacbcf45fa4ed72bf7ae58156537c7b3cdb30d33f747c13ca5a19a8
Instruction ID: 39a5684903a05a71ec41c29e5f9f2145a492bbada19d950458651c4d4b83824d
Opcode Fuzzy Hash: 9a1642866dacbcf45fa4ed72bf7ae58156537c7b3cdb30d33f747c13ca5a19a8
Instruction Fuzzy Hash: F2C13C75A04109AFCB14DF64D888DAEBBF9FF59304B148499F916EB261D730EE81CB90

Function 0023541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00235504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00235515
CharNextW.USER32(00000158), ref: 00235544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00235585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 0023559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 002355AC

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: 07d2e2724096d216253be37fa180b3580c39a5e30b90af33345dc8db4d64fdb2
Instruction ID: 67325e325ffca5af01a36070438242899c45b10c17f8bc3cc80cd473ed3a2f46
Opcode Fuzzy Hash: 07d2e2724096d216253be37fa180b3580c39a5e30b90af33345dc8db4d64fdb2
Instruction Fuzzy Hash: DA61B0B0920629EBDF14CF54DC85AFE7BB9FF09320F504045F629A6290D7749AA1DFA0

Function 001FFA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 001FFAAF
SafeArrayAllocData.OLEAUT32(?), ref: 001FFB08
VariantInit.OLEAUT32(?), ref: 001FFB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 001FFB3A
VariantCopy.OLEAUT32(?,?), ref: 001FFB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 001FFBA1
VariantClear.OLEAUT32(?), ref: 001FFBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 001FFBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 001FFBCC
VariantClear.OLEAUT32(?), ref: 001FFBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 001FFBE9

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: cfcd382d8196abcbdc2caa6a230c7cc6dc1938de2c588502792bac86444cde24
Instruction ID: 0098a9bf6e0a2de340bec2d6c2849a13b09df482de9f0a0085649d823a06e800
Opcode Fuzzy Hash: cfcd382d8196abcbdc2caa6a230c7cc6dc1938de2c588502792bac86444cde24
Instruction Fuzzy Hash: 6D414035A0021D9FCB04DF68D8589FEBBB9FF58354F108069EA56A7261CB70E946CF90

Function 00209C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00209CA1
GetAsyncKeyState.USER32(000000A0), ref: 00209D22
GetKeyState.USER32(000000A0), ref: 00209D3D
GetAsyncKeyState.USER32(000000A1), ref: 00209D57
GetKeyState.USER32(000000A1), ref: 00209D6C
GetAsyncKeyState.USER32(00000011), ref: 00209D84
GetKeyState.USER32(00000011), ref: 00209D96
GetAsyncKeyState.USER32(00000012), ref: 00209DAE
GetKeyState.USER32(00000012), ref: 00209DC0
GetAsyncKeyState.USER32(0000005B), ref: 00209DD8
GetKeyState.USER32(0000005B), ref: 00209DEA

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 26e515ab461bbc536b250d807b520f940385e1d2c1631a074cdbdc22ae29ced8
Instruction ID: ea322b34136f1474b4cc4482330bc70e04947cdd73931c6399686b7da2afbb96
Opcode Fuzzy Hash: 26e515ab461bbc536b250d807b520f940385e1d2c1631a074cdbdc22ae29ced8
Instruction Fuzzy Hash: 0D41E6309647CB69FF309F64C8043B5BEA0AB15304F44805ACAC7565C3DBA49DE8C792

Function 0022055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 002205BC
inet_addr.WSOCK32(?), ref: 0022061C
gethostbyname.WSOCK32(?), ref: 00220628
IcmpCreateFile.IPHLPAPI ref: 00220636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 002206C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 002206E5
IcmpCloseHandle.IPHLPAPI(?), ref: 002207B9
WSACleanup.WSOCK32 ref: 002207BF

Strings

Ping, xrefs: 00220676

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 573a1da061756c25fe160728d3111edf0e790e1f91c408a1d09c3769159ff413
Instruction ID: aeb6b11bc61351ce7946f29bbf02b0eed60c28739954aa8b5ddadf2db0b8f046
Opcode Fuzzy Hash: 573a1da061756c25fe160728d3111edf0e790e1f91c408a1d09c3769159ff413
Instruction Fuzzy Hash: A191AD35618212AFD320CF55E8C8F1ABBE4AF48318F1485A9F4699B6A3C770ED51CF81

Function 00228CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00228CF3

Part of subcall function 00208E54: _wcslen.LIBCMT ref: 00208E77

_wcslen.LIBCMT ref: 00228D4E
_wcslen.LIBCMT ref: 00228D9C
_wcslen.LIBCMT ref: 00228DDC
_wcslen.LIBCMT ref: 00228E6E

Strings

cdecl, xrefs: 00228D48, 00228D4D
none, xrefs: 00228E65, 00228E6A
winapi, xrefs: 00228D96, 00228D9B
stdcall, xrefs: 00228DD6, 00228DDB

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: c29aded0ec029317e90d0248762f1b9b69875a4da4f7011a9afb25f9d3eb02ad
Instruction ID: 8c69faab3642a8f8079418b200440ac652cf74b5fa7328c48630677387d09f64
Opcode Fuzzy Hash: c29aded0ec029317e90d0248762f1b9b69875a4da4f7011a9afb25f9d3eb02ad
Instruction Fuzzy Hash: 4B51D331A25127ABCF24DFA8D8409BEB3A5BF75324B614229F426E72C4DB30DD50C790

Function 0022372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00223774
CoUninitialize.OLE32 ref: 0022377F
CoCreateInstance.OLE32(?,00000000,00000017,0023FB78,?), ref: 002237D9
IIDFromString.OLE32(?,?), ref: 0022384C
VariantInit.OLEAUT32(?), ref: 002238E4
VariantClear.OLEAUT32(?), ref: 00223936

Strings

NULL Pointer assignment, xrefs: 0022381E
Failed to create object, xrefs: 002237E4, 0022389A
Invalid parameter, xrefs: 00223865

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: 3b6190108b461f6863ce077e733bc63a74365b569c12a9300d0e3696e6adc4ef
Instruction ID: 40802867a061e6f461da338cd1345ccf8314da7e94dddcc0dfcd1658f77c6dc5
Opcode Fuzzy Hash: 3b6190108b461f6863ce077e733bc63a74365b569c12a9300d0e3696e6adc4ef
Instruction Fuzzy Hash: E661E370628321AFD711DF94E888F5AB7E8EF49714F10081DF9859B291C774EE98CB92

Function 00238B02 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 001B9BB2

Part of subcall function 001B912D: GetCursorPos.USER32(?), ref: 001B9141
Part of subcall function 001B912D: ScreenToClient.USER32(00000000,?), ref: 001B915E
Part of subcall function 001B912D: GetAsyncKeyState.USER32(00000001), ref: 001B9183
Part of subcall function 001B912D: GetAsyncKeyState.USER32(00000002), ref: 001B919D

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?,?), ref: 00238B6B
ImageList_EndDrag.COMCTL32 ref: 00238B71
ReleaseCapture.USER32 ref: 00238B77
SetWindowTextW.USER32(?,00000000), ref: 00238C12
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00238C25
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?,?), ref: 00238CFF

Strings

@GUI_DRAGFILE, xrefs: 00238C9A
@GUI_DROPID, xrefs: 00238C51
p#', xrefs: 00238C71

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID$p#'
API String ID: 1924731296-3649935686
Opcode ID: 8e440199691d04be225f134333f27692509869d21dbb73bf51180243f51ec96a
Instruction ID: 1777ffa834b1e4788b71bb7bf333c5b8f3af6d848e5b47ab3b41453d80a7aa26
Opcode Fuzzy Hash: 8e440199691d04be225f134333f27692509869d21dbb73bf51180243f51ec96a
Instruction Fuzzy Hash: 0D51ABB5104300AFD704DF14DC5AFAA77E4FF88714F000A2DF956AB2A1CB70A964CB62

Function 00213388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 002133CF

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 002133F0

Strings

Incorrect parameters to object property !, xrefs: 002134AB
^ ERROR , xrefs: 0021349E
Error: , xrefs: 002134D1
"%s" (%d) : ==> %s:%s%s, xrefs: 00213504
Line %d (File "%s"):, xrefs: 00213443, 0021345C
"%s" (%d) : ==> %s:, xrefs: 00213522

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 1ea048315e8b5b4813494632cc85d4276ac8a3df9c332b52d23d2b8eec6988e3
Instruction ID: 1eb97ce3554528edba0228f60d789e79d7127c6bcf4b97488baa5b44b2031568
Opcode Fuzzy Hash: 1ea048315e8b5b4813494632cc85d4276ac8a3df9c332b52d23d2b8eec6988e3
Instruction Fuzzy Hash: 47518071910219BADF15EBE0DD46EEEB7B9AF25740F204065F40572092EB352FA8DF60

Function 0020B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 0020B5FC
_wcslen.LIBCMT ref: 0020B608
_wcslen.LIBCMT ref: 0020B64D
_wcslen.LIBCMT ref: 0020B68C
_wcslen.LIBCMT ref: 0020B6C7

Strings

KEYS, xrefs: 0020B647, 0020B64C
EXISTS, xrefs: 0020B686, 0020B68B
REMOVE, xrefs: 0020B602, 0020B607
APPEND, xrefs: 0020B6C1, 0020B6C6

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: 7768f8b1918f96bebc55b8731c5584e1b6ebd6336e25181991480dd1e8a5d722
Instruction ID: 5bdf850ee564676c5040657964aa65b3494cb0042e5e3cc727a8fdb3c2aaebd5
Opcode Fuzzy Hash: 7768f8b1918f96bebc55b8731c5584e1b6ebd6336e25181991480dd1e8a5d722
Instruction Fuzzy Hash: 5541C932A202279BCB315F7DC8905BEB7A9AF71754B244229E421D72C6E732CD91C790

Function 00215393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 002153A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00215416
GetLastError.KERNEL32 ref: 00215420
SetErrorMode.KERNEL32(00000000,READY), ref: 002154A7

Strings

INVALID, xrefs: 00215459
READONLY, xrefs: 00215452
UNKNOWN, xrefs: 00215444
NOTREADY, xrefs: 0021544B
READY, xrefs: 00215460, 00215468

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 31acdb3faab49a794bc0a40dad1d7f44c90069c7fecab730ab54430194b6c071
Instruction ID: 6da53141db36360d3be59f556ba8be136c18b240a549ab878b866251f9ed184d
Opcode Fuzzy Hash: 31acdb3faab49a794bc0a40dad1d7f44c90069c7fecab730ab54430194b6c071
Instruction Fuzzy Hash: FB319D39A20615DFC710DF68D488AEABBF4EBA5305F1480A5E405DB292DB71EDD2CB90

Function 00233C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00233C79
SetMenu.USER32(?,00000000), ref: 00233C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00233D10
IsMenu.USER32(?), ref: 00233D24
CreatePopupMenu.USER32 ref: 00233D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00233D5B
DrawMenuBar.USER32 ref: 00233D63

Strings

F, xrefs: 00233D4E
0, xrefs: 00233C54

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: ed4f165be71f00adf6c6daa14c6ec8ae854bf4c69a25c9c7798f5423ffa46fa1
Instruction ID: ca266ebe776366c852959679e888d0658356ad2b01878fb0e1e2883562dec24b
Opcode Fuzzy Hash: ed4f165be71f00adf6c6daa14c6ec8ae854bf4c69a25c9c7798f5423ffa46fa1
Instruction Fuzzy Hash: 46413DB5A1120AEFDB14DF64E848A9A7BB5FF49350F140029F946A7360D770AA20CF94

Function 00233A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00233A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00233AA0
GetWindowLongW.USER32(?,000000F0), ref: 00233AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00233AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00233B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00233BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00233BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00233BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00233BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00233C13

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: a8930249fcce63369a034dc10b1ee7366f0c3174d876890b2d90fd3d3c233635
Instruction ID: c8d2d4a9447825e5b2e17adce2af685f32e44c03e8059beb437b644c644df371
Opcode Fuzzy Hash: a8930249fcce63369a034dc10b1ee7366f0c3174d876890b2d90fd3d3c233635
Instruction Fuzzy Hash: 44617BB5900248AFDB10DF68CC81EEEB7B8EF09704F10409AFA15E72A1C770AE56DB50

Function 0020B12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0020B151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,0020A1E1,?,00000001), ref: 0020B165
GetWindowThreadProcessId.USER32(00000000), ref: 0020B16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,0020A1E1,?,00000001), ref: 0020B17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 0020B18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,0020A1E1,?,00000001), ref: 0020B1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,0020A1E1,?,00000001), ref: 0020B1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,0020A1E1,?,00000001), ref: 0020B1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,0020A1E1,?,00000001), ref: 0020B212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,0020A1E1,?,00000001), ref: 0020B21D

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 0392dd604735adb02908ac6bf01448bbe643ed5284b75aedc91b840fef9639b5
Instruction ID: 5a54ab43ea057b8b098c767a9c23f977ee1d7745996adecb6a603782a9bfad3c
Opcode Fuzzy Hash: 0392dd604735adb02908ac6bf01448bbe643ed5284b75aedc91b840fef9639b5
Instruction Fuzzy Hash: D231CC71520305BFDB22DF24EC4DB6DBBADBB60311F204414FA08E62D1D7B49A909F60

Function 001D2C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 001D2C94

Part of subcall function 001D29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,001DD7D1,00000000,00000000,00000000,00000000,?,001DD7F8,00000000,00000007,00000000,?,001DDBF5,00000000), ref: 001D29DE
Part of subcall function 001D29C8: GetLastError.KERNEL32(00000000,?,001DD7D1,00000000,00000000,00000000,00000000,?,001DD7F8,00000000,00000007,00000000,?,001DDBF5,00000000,00000000), ref: 001D29F0

_free.LIBCMT ref: 001D2CA0
_free.LIBCMT ref: 001D2CAB
_free.LIBCMT ref: 001D2CB6
_free.LIBCMT ref: 001D2CC1
_free.LIBCMT ref: 001D2CCC
_free.LIBCMT ref: 001D2CD7
_free.LIBCMT ref: 001D2CE2
_free.LIBCMT ref: 001D2CED
_free.LIBCMT ref: 001D2CFB

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5954d9d00d97fec5ee8f0c01de52cafb9086a42d6b4e53e83ac9373ad0d68d25
Instruction ID: 7cd0863c511c7773438c14c6a2f819d128a68c472145d47bdf02ecc203446142
Opcode Fuzzy Hash: 5954d9d00d97fec5ee8f0c01de52cafb9086a42d6b4e53e83ac9373ad0d68d25
Instruction Fuzzy Hash: C811A476110118AFCB06EF54D892CDD3BA5FF25354F4144A6FA589F322DB31EE50AB90

Function 001A1410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 001A1459
OleUninitialize.OLE32(?,00000000), ref: 001A14F8
UnregisterHotKey.USER32(?), ref: 001A16DD
DestroyWindow.USER32(?), ref: 001E24B9
FreeLibrary.KERNEL32(?), ref: 001E251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 001E254B

Strings

close all, xrefs: 001A1454

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 5bb071106158fb8f5646a4fd30318cb829fab6dd6193d68484c838c1a7512a0f
Instruction ID: ad1b4d45796442f5319162b5f0b7b9ccef185e4daa65e905f6376d746923b49a
Opcode Fuzzy Hash: 5bb071106158fb8f5646a4fd30318cb829fab6dd6193d68484c838c1a7512a0f
Instruction Fuzzy Hash: 27D1A235701212DFCB19EF15C9A9B69F7A5BF16700F2542ADE84AAB251CB30ED22CF50

Function 00217DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00217FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00217FC1
GetFileAttributesW.KERNEL32(?), ref: 00217FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00218005
SetCurrentDirectoryW.KERNEL32(?), ref: 00218017
SetCurrentDirectoryW.KERNEL32(?), ref: 00218060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 002180B0

Strings

*.*, xrefs: 00218066

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: a0c99450873f3763ff0c26d9f37a1db422d5c9cd6a2cf20545615d11878a993b
Instruction ID: 6438cbe02050c65fcc6cc8ec7628ccb470219064e8d0aea60426d445592845fd
Opcode Fuzzy Hash: a0c99450873f3763ff0c26d9f37a1db422d5c9cd6a2cf20545615d11878a993b
Instruction Fuzzy Hash: 9F81A1725282469BCB20EF14C884AEAB3E8BFE9310F14485EF885D7250DB75DD958B92

Function 001A5BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 001A5C7A

Part of subcall function 001A5D0A: GetClientRect.USER32(?,?), ref: 001A5D30
Part of subcall function 001A5D0A: GetWindowRect.USER32(?,?), ref: 001A5D71
Part of subcall function 001A5D0A: ScreenToClient.USER32(?,?), ref: 001A5D99

GetDC.USER32 ref: 001E46F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 001E4708
SelectObject.GDI32(00000000,00000000), ref: 001E4716
SelectObject.GDI32(00000000,00000000), ref: 001E472B
ReleaseDC.USER32(?,00000000), ref: 001E4733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 001E47C4

Strings

U, xrefs: 001E4693

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 14a0b83fce4f6539afe46b9496831795b21c527c6119f3af937cc36d3bd47fe2
Instruction ID: 940b028b617836da7b3126987491345419526dc50e437b6a7d0afb30d10cbac0
Opcode Fuzzy Hash: 14a0b83fce4f6539afe46b9496831795b21c527c6119f3af937cc36d3bd47fe2
Instruction Fuzzy Hash: 5471F234800A45DFCF25CF65C988ABE7BB6FF4A360F184269ED565A16AC3318C81DF90

Function 0021359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 002135E4

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

LoadStringW.USER32(00272390,?,00000FFF,?), ref: 0021360A

Strings

Error: , xrefs: 002136EF
"%s" (%d) : ==> %s:%s%s, xrefs: 00213724
Line %d (File "%s"):, xrefs: 0021366B
^ ERROR, xrefs: 002136C9
"%s" (%d) : ==> %s:, xrefs: 00213742

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: 2adfe76c94a76475fe3469be7668927588711e89cba84bdf6bff3e5a6bf893e2
Instruction ID: 61694e2069342fa84dd2bd054897af06b9a471e62c32aafde0033ff93c363eed
Opcode Fuzzy Hash: 2adfe76c94a76475fe3469be7668927588711e89cba84bdf6bff3e5a6bf893e2
Instruction Fuzzy Hash: 31519F7181021ABADF15EBA0DC46EEEBB79EF25340F144165F105721A2EB301BE9DFA0

Function 0021C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0021C272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0021C29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 0021C2CA
GetLastError.KERNEL32 ref: 0021C322
SetEvent.KERNEL32(?), ref: 0021C336
InternetCloseHandle.WININET(00000000), ref: 0021C341

Strings

, xrefs: 0021C2BB

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: bf290e1a8b17e8bd775b0551079ed378151461e6e28a19a0285ca0d796ad984d
Instruction ID: 73b962a638aad0ffd2dbd3af96f48be7167c2d91e47a15f2993d32199f022659
Opcode Fuzzy Hash: bf290e1a8b17e8bd775b0551079ed378151461e6e28a19a0285ca0d796ad984d
Instruction Fuzzy Hash: 3531B1B5550204AFD7219F65DC88AEB7BFCEB69740F20851EF856E2200DB30DD948B60

Function 0020989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,001E3AAF,?,?,Bad directive syntax error,0023CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 002098BC
LoadStringW.USER32(00000000,?,001E3AAF,?), ref: 002098C3

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00209987

Strings

., xrefs: 0020996D
%s (%d) : ==> %s.: %s %s, xrefs: 002098F1
Line %d (File "%s"):, xrefs: 0020992D
Error: , xrefs: 00209955
Line %d:, xrefs: 00209912

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 15f5f5ed44dcda7b54599b592b62d25eb4b55aa5874f9e2da4470afd4d9d8816
Instruction ID: 45d4ce8655c19fce4e5d668b7a5611362e7b704279eb3f78dbc6b15855de65b9
Opcode Fuzzy Hash: 15f5f5ed44dcda7b54599b592b62d25eb4b55aa5874f9e2da4470afd4d9d8816
Instruction Fuzzy Hash: 30216D3281021EABCF15AF90CC0AEEE7779FF29700F044469F515660A2EB719AA8DB50

Function 0020209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 002020AB
GetClassNameW.USER32(00000000,?,00000100), ref: 002020C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 0020214D

Strings

details, xrefs: 002020FB
smallicons, xrefs: 00202115
SHELLDLL_DefView, xrefs: 002020CC
largeicons, xrefs: 002020E1
list, xrefs: 0020212F

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: 05121b716626ccc89d4fe25144714dcca0e1d9f215a48ad5272c42482c5f768a
Instruction ID: d31864a16f3fd206da4796c09c31369584312064872b1fa9723ee38407fedf4f
Opcode Fuzzy Hash: 05121b716626ccc89d4fe25144714dcca0e1d9f215a48ad5272c42482c5f768a
Instruction Fuzzy Hash: 96113D761A8327F6F7152620DC0FEA6B39CCB25314F20001BF709A50D3EBA1D8655A14

Function 001D8D45 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e32383d687d7313e7637335d6145f5f65b7f39790b8543a70ba7190287e28c52
Instruction ID: e4f73e3d0a6fc2a2a5226aafc1aef69de854a3f5227845b0d4772e70c0521d31
Opcode Fuzzy Hash: e32383d687d7313e7637335d6145f5f65b7f39790b8543a70ba7190287e28c52
Instruction Fuzzy Hash: E7C1F374A04349AFDF11DFA8E885BADBBB5AF29310F14419AF418A7392CB30D941CB61

Function 001DCE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 001DCEB7
_free.LIBCMT ref: 001DCF22
_free.LIBCMT ref: 001DCF48
_free.LIBCMT ref: 001DCF71
_free.LIBCMT ref: 001DCFA9
_free.LIBCMT ref: 001DCFDA
_free.LIBCMT ref: 001DD01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 001DD09C
_free.LIBCMT ref: 001DD0B5

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: fa5571967d64059c148a1d3c410ce6651a1e2f3478736392a0ac6650eb2b4ac0
Instruction ID: 702ed6fedd57c44298a3d9977b5298cfc63a774083bf4601efa88ad90bee6211
Opcode Fuzzy Hash: fa5571967d64059c148a1d3c410ce6651a1e2f3478736392a0ac6650eb2b4ac0
Instruction Fuzzy Hash: DE6156B1904312AFDF25AFB4E885AAA7BA6EF22310F04456FF94497381D7319D01D790

Function 002350D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00235186
ShowWindow.USER32(?,00000000), ref: 002351C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 002351CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 002351D1

Part of subcall function 00236FBA: DeleteObject.GDI32(00000000), ref: 00236FE6

GetWindowLongW.USER32(?,000000F0), ref: 0023520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0023521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 0023524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00235287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00235296

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 122b8fbc53d9abfaaf4a4469b1aad5e4bf5ab092f48ea32aae52fc33cd72848d
Instruction ID: acd1a0159aef8667c3b5d8aa27386c00f4295d3d669f92e8011eb7272b47d054
Opcode Fuzzy Hash: 122b8fbc53d9abfaaf4a4469b1aad5e4bf5ab092f48ea32aae52fc33cd72848d
Instruction Fuzzy Hash: 4A51B3B0A70A29BFEF249F24CC4ABD93BA5EB05321F144011FE5D962E0C7B599A0DF41

Function 001B8B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 001F6890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 001F68A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 001F68B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 001F68D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 001F68F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,001B8874,00000000,00000000,00000000,000000FF,00000000), ref: 001F6901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 001F691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,001B8874,00000000,00000000,00000000,000000FF,00000000), ref: 001F692D

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: df722fffa623ba7bdbff7785f305646ca962f05a7bdaa54afa9104525c7b7155
Instruction ID: 775ab5789bec8457dd2155aa6face861b6ba999cfe5e7e0fb82e13bf28b1cddb
Opcode Fuzzy Hash: df722fffa623ba7bdbff7785f305646ca962f05a7bdaa54afa9104525c7b7155
Instruction Fuzzy Hash: 2A518A70600209EFDB24CF28DD55FAA7BB9FF58B50F204518FA16A72A0DB70E991DB50

Function 0021C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0021C182
GetLastError.KERNEL32 ref: 0021C195
SetEvent.KERNEL32(?), ref: 0021C1A9

Part of subcall function 0021C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0021C272
Part of subcall function 0021C253: GetLastError.KERNEL32 ref: 0021C322
Part of subcall function 0021C253: SetEvent.KERNEL32(?), ref: 0021C336
Part of subcall function 0021C253: InternetCloseHandle.WININET(00000000), ref: 0021C341

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: 89bddc0022e687f2cbaa8b1ef1858f6e53cb250ea7095047030a8925d6e348ad
Instruction ID: cf9d642dca9c7672c597b3489fbbf7571a3baaee84a3e7f16025a43e48f2bca6
Opcode Fuzzy Hash: 89bddc0022e687f2cbaa8b1ef1858f6e53cb250ea7095047030a8925d6e348ad
Instruction Fuzzy Hash: 5F318375190601BFDB219FA5DC48AA7BBF9FF68300B20441EFD5692610D730E864DF60

Function 002025A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00203A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00203A57
Part of subcall function 00203A3D: GetCurrentThreadId.KERNEL32 ref: 00203A5E
Part of subcall function 00203A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,002025B3), ref: 00203A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 002025BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 002025DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 002025DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 002025E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00202601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00202605
MapVirtualKeyW.USER32(00000025,00000000), ref: 0020260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00202623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00202627

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 60965bdb9951c1a6dcc47e8ced2c9e045f09c6fa05c82f227a71cb67790044bb
Instruction ID: 2aaaf1c88bae0283109252665b2785b511da7a1be586a8bbc0e7a024f55ef102
Opcode Fuzzy Hash: 60965bdb9951c1a6dcc47e8ced2c9e045f09c6fa05c82f227a71cb67790044bb
Instruction Fuzzy Hash: 6A01D4317A0310BBFB106768AC8EF593F5DDB8EB12F200012F358BE0D2C9E224549E69

Function 00201803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00201449,?,?,00000000), ref: 0020180C
HeapAlloc.KERNEL32(00000000,?,00201449,?,?,00000000), ref: 00201813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00201449,?,?,00000000), ref: 00201828
GetCurrentProcess.KERNEL32(?,00000000,?,00201449,?,?,00000000), ref: 00201830
DuplicateHandle.KERNEL32(00000000,?,00201449,?,?,00000000), ref: 00201833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00201449,?,?,00000000), ref: 00201843
GetCurrentProcess.KERNEL32(00201449,00000000,?,00201449,?,?,00000000), ref: 0020184B
DuplicateHandle.KERNEL32(00000000,?,00201449,?,?,00000000), ref: 0020184E
CreateThread.KERNEL32(00000000,00000000,00201874,00000000,00000000,00000000), ref: 00201868

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 4534762e018a8021342e86d0f862ccc2fa2dcf9b725f1bc1eebf8a6152accda0
Instruction ID: 95396961fa61b9c2009e89e5158b14f957912934614b3b3232b129d96f41d623
Opcode Fuzzy Hash: 4534762e018a8021342e86d0f862ccc2fa2dcf9b725f1bc1eebf8a6152accda0
Instruction Fuzzy Hash: 4C01BF75240304BFE710AB65EC4DF573B6CEB89B11F104411FA45DB191C670D810DB20

Function 0022A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 0020D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 0020D501
Part of subcall function 0020D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 0020D50F
Part of subcall function 0020D4DC: CloseHandle.KERNEL32(00000000), ref: 0020D5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0022A16D
GetLastError.KERNEL32 ref: 0022A180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0022A1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 0022A268
GetLastError.KERNEL32(00000000), ref: 0022A273
CloseHandle.KERNEL32(00000000), ref: 0022A2C4

Strings

SeDebugPrivilege, xrefs: 0022A18F

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 039d76734698be3be051a67754bcc599fe39b260a9682b65700ea7b4ea475e28
Instruction ID: 34f799f3398ecdbef060d76c7a11a8acaa1aef218344adbafd32b0a4a2103512
Opcode Fuzzy Hash: 039d76734698be3be051a67754bcc599fe39b260a9682b65700ea7b4ea475e28
Instruction Fuzzy Hash: C761C034214252EFD720DF58D894F15BBE1AF54318F18858CE86A8BBA3C772EC55CB92

Function 00233886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00233925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 0023393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00233954
_wcslen.LIBCMT ref: 00233999
SendMessageW.USER32(?,00001057,00000000,?), ref: 002339C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 002339F4

Strings

SysListView32, xrefs: 002338F7

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: 6ee3fdac7329c99da0bee33048f0bbb1edaa2fb128d294e4b3d03352c9e30ec7
Instruction ID: 163015b82cbfe88bc093c7760a1b0b2ab24a8e8bd759b8a04b39f70adbc25310
Opcode Fuzzy Hash: 6ee3fdac7329c99da0bee33048f0bbb1edaa2fb128d294e4b3d03352c9e30ec7
Instruction Fuzzy Hash: 2A41B471A10219ABEB21DF64CC49FEA77A9EF08350F100526F548E7281D771DAA0CB90

Function 0020BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 0020BCFD
IsMenu.USER32(00000000), ref: 0020BD1D
CreatePopupMenu.USER32 ref: 0020BD53
GetMenuItemCount.USER32(01524D10), ref: 0020BDA4
InsertMenuItemW.USER32(01524D10,?,00000001,00000030), ref: 0020BDCC

Strings

2, xrefs: 0020BD37
0, xrefs: 0020BCA8

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: e387e417d30d328c25eaead6342f5b02c8db96c18b1bc3d8a073369fc833fa4a
Instruction ID: d16a52cdb081d3e0fbaa20faabec7c93e8c9dbd8385f03a01bd5e52e0dd498cd
Opcode Fuzzy Hash: e387e417d30d328c25eaead6342f5b02c8db96c18b1bc3d8a073369fc833fa4a
Instruction Fuzzy Hash: 64518F70A20306DBDF22DFA8D888BAEFBF4AF55314F244259E411A72D2D7709951CB61

Function 0020C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 0020C913

Strings

stop, xrefs: 0020C8E4
warning, xrefs: 0020C8FC
info, xrefs: 0020C8B4
question, xrefs: 0020C8CC
blank, xrefs: 0020C895

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 4c7d25b9585145d58a3cef60a08c7667a8ba8400bff36c2cd59f80abed8f821c
Instruction ID: b89e8fb5573a9ace86ee98e15df9b5a80099b46120441c1fe51c920ed3728a6b
Opcode Fuzzy Hash: 4c7d25b9585145d58a3cef60a08c7667a8ba8400bff36c2cd59f80abed8f821c
Instruction Fuzzy Hash: F2112B716A930BBAE7065F14DC82DBA679CDF25314F30412EF904A72C3D7B0DD505268

Function 0020DE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 0020DE42
gethostname.WSOCK32(?,00000100), ref: 0020DE5C
gethostbyname.WSOCK32(?), ref: 0020DE69
inet_ntoa.WSOCK32(?), ref: 0020DEAB
_strcat.LIBCMT ref: 0020DEB9
WSACleanup.WSOCK32 ref: 0020DEDE

Strings

0.0.0.0, xrefs: 0020DE87

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: aae2c69d5303162b3fa54fcf44f22da925ecadfc93cd3d91a84b17e06666b8a4
Instruction ID: d1508e2fe5251a174a898b1dadbabba06617927c736c7b66267cf3247ec25d70
Opcode Fuzzy Hash: aae2c69d5303162b3fa54fcf44f22da925ecadfc93cd3d91a84b17e06666b8a4
Instruction Fuzzy Hash: 80110672914215AFDB20ABB0EC0AEEE77ACDF25714F110169F505AA0D2EF71CA918B60

Function 0020ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0020ED2A
_wcslen.LIBCMT ref: 0020ED3B
_wcslen.LIBCMT ref: 0020ED79
_wcslen.LIBCMT ref: 0020EDAF
_wcslen.LIBCMT ref: 0020EDDF
_wcslen.LIBCMT ref: 0020EDEF
_wcslen.LIBCMT ref: 0020EE2B
_wcslen.LIBCMT ref: 0020EE5A

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: c8161f422a4388e9b07f274a7b3ea370e059176dd10cdcbf99a2ef5d165ed661
Instruction ID: 82eedb3b9bc01cdb32bf29eb86c0f9cda5cbed3fbc1f505891717e08b3653dd2
Opcode Fuzzy Hash: c8161f422a4388e9b07f274a7b3ea370e059176dd10cdcbf99a2ef5d165ed661
Instruction Fuzzy Hash: 0141A465C1021876CB11EBF4C88AFCFB7ACAF65310F50886AE518E3562FB34D255C3A6

Function 001BF8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,001F682C,00000004,00000000,00000000), ref: 001BF953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,001F682C,00000004,00000000,00000000), ref: 001FF3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,001F682C,00000004,00000000,00000000), ref: 001FF454

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: f7b1e22bf02c80a97ce6770f020469da65776178a5433dd30202eb623ea0ab61
Instruction ID: 0f7f51e3b2c75db0f8b30d8af803a83c0869b061eaca891c0298576a7f188188
Opcode Fuzzy Hash: f7b1e22bf02c80a97ce6770f020469da65776178a5433dd30202eb623ea0ab61
Instruction Fuzzy Hash: 6C412631208680FAC7398B29DC8C7BA7B96AF56318F15403CF18762560C772A883CB11

Function 00232D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00232D1B
GetDC.USER32(00000000), ref: 00232D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00232D2E
ReleaseDC.USER32(00000000,00000000), ref: 00232D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00232D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00232D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00235A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00232DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00232DE1

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: ca0b9e1264b649b14156b4ee154814907270bbdd4599a73b800f9c8f2e96690b
Instruction ID: 09fec3d2366d09ff650106a74a9c74ecc5f98f4aa1a6ce99a7338706cc73e4a7
Opcode Fuzzy Hash: ca0b9e1264b649b14156b4ee154814907270bbdd4599a73b800f9c8f2e96690b
Instruction Fuzzy Hash: EC31AE72211214BFEB258F50DC8AFEB3FADEF49711F144055FE08AA291C6759C50CBA0

Function 00205622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00205637
_memcmp.LIBVCRUNTIME ref: 00205659
_memcmp.LIBVCRUNTIME ref: 00205671
_memcmp.LIBVCRUNTIME ref: 00205684
_memcmp.LIBVCRUNTIME ref: 0020569E
_memcmp.LIBVCRUNTIME ref: 002056B1
_memcmp.LIBVCRUNTIME ref: 002056C9
_memcmp.LIBVCRUNTIME ref: 002056E4

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 995c194ab7f3eb8bed1fdb9fdf75b667fb638843982103253444986298349a0c
Instruction ID: a49f42d87595ae2cf6ee22e9bd23f04d0b913d500bd576fd28e90844442d4c2d
Opcode Fuzzy Hash: 995c194ab7f3eb8bed1fdb9fdf75b667fb638843982103253444986298349a0c
Instruction Fuzzy Hash: 2821F8A1AB0B6A77D31499109F82FBB635DBE32398F441025FD045A5C3F762ED308DA5

Function 00224FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 0022502E, 00225383
Not an Object type, xrefs: 00225007

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: f6e9f08970f2f410ddc4da4b15f8098dd356fb17859e37ff28e611a01ab8b7ff
Instruction ID: 65787fa3d0c59ed55e717e6a1f5a693df3ce2cbe8f04e392ec50d042b64242ef
Opcode Fuzzy Hash: f6e9f08970f2f410ddc4da4b15f8098dd356fb17859e37ff28e611a01ab8b7ff
Instruction Fuzzy Hash: 19D1C471A1062AAFDF10CF98E880BAEB7B5FF48344F14C169E915AB281E770DD51CB90

Function 001E1522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,?,7FFFFFFF,?,?,001E17FB,00000000,00000000,?,00000000,?,?,?,?,00000000), ref: 001E15CE
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,001E17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 001E1651
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,001E17FB,?,001E17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 001E16E4
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,001E17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 001E16FB

Part of subcall function 001D3820: RtlAllocateHeap.NTDLL(00000000,?,00271444,?,001BFDF5,?,?,001AA976,00000010,00271440,001A13FC,?,001A13C6,?,001A1129), ref: 001D3852

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,001E17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 001E1777
__freea.LIBCMT ref: 001E17A2
__freea.LIBCMT ref: 001E17AE

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: 261cd858d101c2eb1b782df3cecd4ff33449babd2a7177db2a690c776e27b499
Instruction ID: a7e69e4602aeaa7753aebd9863442574cc88a02e3f7f5840d1e8c058186633af
Opcode Fuzzy Hash: 261cd858d101c2eb1b782df3cecd4ff33449babd2a7177db2a690c776e27b499
Instruction Fuzzy Hash: 3F91D672E00A96BADF248FB6C881EEE7BB5AF4A710F184659E912E7140D735CD40CB60

Function 00224523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00224648
VariantInit.OLEAUT32(?), ref: 00224749
VariantClear.OLEAUT32(?), ref: 00224753
VariantClear.OLEAUT32(?), ref: 002247B0

Strings

Null Object assignment in FOR..IN loop, xrefs: 002245D8, 00224706, 002247BE
Incorrect Object type in FOR..IN loop, xrefs: 0022472C

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: 053c38f1c2ab160d01e40d6bcabeda52dd374ad8e8b350a4c35bd97df505d03d
Instruction ID: a5f78a023e6e56d5ac158c9fbc26aa0e0ee5169e45f132881d1270c43f6a27f5
Opcode Fuzzy Hash: 053c38f1c2ab160d01e40d6bcabeda52dd374ad8e8b350a4c35bd97df505d03d
Instruction Fuzzy Hash: 0B91A170A20225BBDF24DFA4E844FAEBBB8EF46714F108559F515AB280D7B09951CFA0

Function 00211187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 0021125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00211284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 002112A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 002112D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 0021135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 002113C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00211430

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 40efa6243b10e2810f6a8220009bc44e47c2bacf3b51b571e3f8422507d5a0b1
Instruction ID: edd2484898eb2076ee2f5c8dfc9df5c5f7c222951430541fed892d168b200849
Opcode Fuzzy Hash: 40efa6243b10e2810f6a8220009bc44e47c2bacf3b51b571e3f8422507d5a0b1
Instruction Fuzzy Hash: 1E911375A10219AFEB00DFA8D884BFEB7F5FF65714F104029EA00E7291D774A9A1CB90

Function 001B948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: ddee39f265c94e06df2c5dcea781766cae7810ef044797300c2301fc94930fbf
Instruction ID: daf8b694e6b97e20112829c028bed4ea6828c725ef3fe0b268616a5a02f360a7
Opcode Fuzzy Hash: ddee39f265c94e06df2c5dcea781766cae7810ef044797300c2301fc94930fbf
Instruction Fuzzy Hash: 55914A71D40219EFCB14CFA9CC88AEEBBB8FF49320F144156E615B7291D374AA42CB60

Function 00223947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0022396B
CharUpperBuffW.USER32(?,?), ref: 00223A7A
_wcslen.LIBCMT ref: 00223A8A
VariantClear.OLEAUT32(?), ref: 00223C1F

Part of subcall function 00210CDF: VariantInit.OLEAUT32(00000000), ref: 00210D1F
Part of subcall function 00210CDF: VariantCopy.OLEAUT32(?,?), ref: 00210D28
Part of subcall function 00210CDF: VariantClear.OLEAUT32(?), ref: 00210D34

Strings

Incorrect Parameter format, xrefs: 002239A6, 00223BA1
AUTOIT.ERROR, xrefs: 00223A80, 00223A85

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: f6d5b7b2d7a2dcee899e135055010b40743bdd243cd96e9df3b8e358b139fcff
Instruction ID: 9c551da3d9ab61de50e6b2231fb9c67ec8e50604a6877ec9002237e535f78dc5
Opcode Fuzzy Hash: f6d5b7b2d7a2dcee899e135055010b40743bdd243cd96e9df3b8e358b139fcff
Instruction Fuzzy Hash: 8E917774A18315AFC700EF64D48096AB7E4FF99314F14882EF88A9B351DB34EE55CB92

Function 00224BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 0020000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,001FFF41,80070057,?,?,?,0020035E), ref: 0020002B
Part of subcall function 0020000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,001FFF41,80070057,?,?), ref: 00200046
Part of subcall function 0020000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,001FFF41,80070057,?,?), ref: 00200054
Part of subcall function 0020000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,001FFF41,80070057,?), ref: 00200064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00224C51
_wcslen.LIBCMT ref: 00224D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00224DCF
CoTaskMemFree.OLE32(?), ref: 00224DDA

Strings

NULL Pointer assignment, xrefs: 00224E23, 00224E52

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: 4b19cb483c4150b2e763774e7a2c6155fed0e5543dd88d8e93c16e7e65750303
Instruction ID: ac4119267938a6947fbf8b212b66678b2a05e5acc7ae7b80fd95d98f5a5910f7
Opcode Fuzzy Hash: 4b19cb483c4150b2e763774e7a2c6155fed0e5543dd88d8e93c16e7e65750303
Instruction Fuzzy Hash: E3913871D1022DAFDF15EFE4D880AEEB7B9BF08304F10816AE915AB251DB749A54CF60

Function 002320FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00232183
GetMenuItemCount.USER32(00000000), ref: 002321B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 002321DD
_wcslen.LIBCMT ref: 00232213
GetMenuItemID.USER32(?,?), ref: 0023224D
GetSubMenu.USER32(?,?), ref: 0023225B

Part of subcall function 00203A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00203A57
Part of subcall function 00203A3D: GetCurrentThreadId.KERNEL32 ref: 00203A5E
Part of subcall function 00203A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,002025B3), ref: 00203A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 002322E3

Part of subcall function 0020E97B: Sleep.KERNEL32 ref: 0020E9F3

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: 87989978d21fa215db6aeb4b74395c4fdbf335e46b6c8d91b63c37b89add86ef
Instruction ID: b38af5441f6f6738993af15248de20a788dc8502ad89afe1d8ed2f9e6588a4da
Opcode Fuzzy Hash: 87989978d21fa215db6aeb4b74395c4fdbf335e46b6c8d91b63c37b89add86ef
Instruction Fuzzy Hash: F4718CB5A10205EFCB10EF68C885AAEB7F5EF48310F108459E956BB351DB34EE558B90

Function 0020AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0020AEF9
GetKeyboardState.USER32(?), ref: 0020AF0E
SetKeyboardState.USER32(?), ref: 0020AF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 0020AF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 0020AFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 0020AFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 0020B020

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: d21b5344bd1a2d2b5a98f0cedb786643a1379857d29c4680bbe1ddc42f1d453d
Instruction ID: 06bde4ab9ec79db26d8962c1dadd68855736f9b96754a925e46aed69bf6c8f62
Opcode Fuzzy Hash: d21b5344bd1a2d2b5a98f0cedb786643a1379857d29c4680bbe1ddc42f1d453d
Instruction Fuzzy Hash: FE51B1A0A247D73DFB378734C849BBABEA95B06304F088589E1D9958C3C3D9A8E4D751

Function 0020ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 0020AD19
GetKeyboardState.USER32(?), ref: 0020AD2E
SetKeyboardState.USER32(?), ref: 0020AD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 0020ADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 0020ADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 0020AE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 0020AE38

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 9e64ffc5f23c9ef9d8493799abdb258b828808051984dcc6fa3c785c9d726851
Instruction ID: 1826eea7ffc51a825084b1ccab143e4f158ccc24db764e8646581a3d156f2c35
Opcode Fuzzy Hash: 9e64ffc5f23c9ef9d8493799abdb258b828808051984dcc6fa3c785c9d726851
Instruction Fuzzy Hash: 475129A19247D23DFB378B34CC46B7A7EE86B46300F488499E1D5568C3D394ECA8D752

Function 001D542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(001E3CD6,?,?,?,?,?,?,?,?,001D5BA3,?,?,001E3CD6,?,?), ref: 001D5470
__fassign.LIBCMT ref: 001D54EB
__fassign.LIBCMT ref: 001D5506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,001E3CD6,00000005,00000000,00000000), ref: 001D552C
WriteFile.KERNEL32(?,001E3CD6,00000000,001D5BA3,00000000,?,?,?,?,?,?,?,?,?,001D5BA3,?), ref: 001D554B
WriteFile.KERNEL32(?,?,00000001,001D5BA3,00000000,?,?,?,?,?,?,?,?,?,001D5BA3,?), ref: 001D5584

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 9568c6054c607eed77334cce2c97e4f45be50e0c249f3cb745b6816502d3c351
Instruction ID: 0694b93f22d235f8ae1da6278b966c4405932f620e0f8725c88288b39dad5c1f
Opcode Fuzzy Hash: 9568c6054c607eed77334cce2c97e4f45be50e0c249f3cb745b6816502d3c351
Instruction Fuzzy Hash: A451A3719006499FDB11CFA8E885AEEBBFAEF09300F14415BE555E7391D730DA41CB61

Function 001C2D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 001C2D4B
___except_validate_context_record.LIBVCRUNTIME ref: 001C2D53
_ValidateLocalCookies.LIBCMT ref: 001C2DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 001C2E0C
_ValidateLocalCookies.LIBCMT ref: 001C2E61

Strings

csm, xrefs: 001C2DF6

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: e7674fb35dcbb9b662c7f024650dad4871c7519cafa6425d4eb069d7bdc0cdba
Instruction ID: 5675f46e842f53df3dca9693fc3db633021293df73805e3236005f3a94acbb21
Opcode Fuzzy Hash: e7674fb35dcbb9b662c7f024650dad4871c7519cafa6425d4eb069d7bdc0cdba
Instruction Fuzzy Hash: 6041D334A00209ABCF14DFA8C845FAEBBB4BF65324F148159E9156B392D731DA01CBD1

Function 002210B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0022304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0022307A
Part of subcall function 0022304E: _wcslen.LIBCMT ref: 0022309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00221112
WSAGetLastError.WSOCK32 ref: 00221121
WSAGetLastError.WSOCK32 ref: 002211C9
closesocket.WSOCK32(00000000), ref: 002211F9

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: 1d7da383248763e7c02168dae7b6949ef04511fe9054e4a717f51ef3a19d6633
Instruction ID: ac48b488d1aed1251eb3caee900e23345fcd03231482c0d9d4a3b44ff081cab4
Opcode Fuzzy Hash: 1d7da383248763e7c02168dae7b6949ef04511fe9054e4a717f51ef3a19d6633
Instruction Fuzzy Hash: 38412735610214AFDB109F64E884FA9B7E9FF55324F148059FD09AB291C770EE61CBE1

Function 0020CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0020DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0020CF22,?), ref: 0020DDFD

Part of subcall function 0020DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0020CF22,?), ref: 0020DE16

lstrcmpiW.KERNEL32(?,?), ref: 0020CF45
MoveFileW.KERNEL32(?,?), ref: 0020CF7F
_wcslen.LIBCMT ref: 0020D005
_wcslen.LIBCMT ref: 0020D01B
SHFileOperationW.SHELL32(?), ref: 0020D061

Strings

\*.*, xrefs: 0020CFF3

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: 06ca69201045b9a0c15c1ed7e5a53a467adcd1923d82f0b99b05aa8dd64b006a
Instruction ID: f00bdfcd643699559e98f43828264cf9aa0d5c817fb8ecb2f8488f39e53c6aea
Opcode Fuzzy Hash: 06ca69201045b9a0c15c1ed7e5a53a467adcd1923d82f0b99b05aa8dd64b006a
Instruction Fuzzy Hash: C54167B18152195FDF12EFA4D985ADEB7B9AF18340F1000E6E505E7182EB34A694CF51

Function 00232DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00232E1C
GetWindowLongW.USER32(?,000000F0), ref: 00232E4F
GetWindowLongW.USER32(?,000000F0), ref: 00232E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00232EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00232EE0
GetWindowLongW.USER32(?,000000F0), ref: 00232EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00232F0B

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: adf52c07ae1d64fb7bb71922b8ab5994f4541dc87e1b2dea3b18f4d5492ba3ab
Instruction ID: ca39ea638453afac642717d024473884535b1bb3991ad8e00b48eafbb39c8d64
Opcode Fuzzy Hash: adf52c07ae1d64fb7bb71922b8ab5994f4541dc87e1b2dea3b18f4d5492ba3ab
Instruction Fuzzy Hash: E4311371614251EFDB21CF18EC8AF6537E4EB8AB10F240164FA049B2B2CB71B8A5DB40

Function 00207726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00207769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0020778F
SysAllocString.OLEAUT32(00000000), ref: 00207792
SysAllocString.OLEAUT32(?), ref: 002077B0
SysFreeString.OLEAUT32(?), ref: 002077B9
StringFromGUID2.OLE32(?,?,00000028), ref: 002077DE
SysAllocString.OLEAUT32(?), ref: 002077EC

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 66b9ea41c582d5304f9a315fec49ee35d512b36645303c58ab332d4d873ca02a
Instruction ID: a7d8a84bab9a6b13c6a427582620602fe377e731d413ca8d278416540e28eef5
Opcode Fuzzy Hash: 66b9ea41c582d5304f9a315fec49ee35d512b36645303c58ab332d4d873ca02a
Instruction Fuzzy Hash: E621C476A14319AFDF10EFA8DC88CBBB3ACEB093A47108025FA04DB1A1D770EC518760

Function 002077FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00207842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00207868
SysAllocString.OLEAUT32(00000000), ref: 0020786B
SysAllocString.OLEAUT32 ref: 0020788C
SysFreeString.OLEAUT32 ref: 00207895
StringFromGUID2.OLE32(?,?,00000028), ref: 002078AF
SysAllocString.OLEAUT32(?), ref: 002078BD

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 8e4647710a9abe40803354c2e7f4651871613564e0908df387ff20a2b60b0e66
Instruction ID: 5ac77aa757c45beb3e4be62a4fd6b05c91d58a000c50df457f48977bde65f417
Opcode Fuzzy Hash: 8e4647710a9abe40803354c2e7f4651871613564e0908df387ff20a2b60b0e66
Instruction Fuzzy Hash: A1216232A18205AFDB10AFA8DC8CDAA77ACEB097607108125FA15DB2A1D774EC51DB64

Function 002104D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 002104F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0021052E

Strings

nul, xrefs: 00210567

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: a757c8f4b34403c41d5515d632ef3cbbf985731c67f0a579f4871a985a600cec
Instruction ID: a5f376ffb75e4dfdb6a63825f597ea5db6d467f7bc842865a48dd1b78bcb14c8
Opcode Fuzzy Hash: a757c8f4b34403c41d5515d632ef3cbbf985731c67f0a579f4871a985a600cec
Instruction Fuzzy Hash: 4F218571510306ABDB205F29DC88ADA77E5BF54724F604A19FCA1E61D0D7F099E0CF20

Function 002105A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 002105C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00210601

Strings

nul, xrefs: 00210639

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 5d988e0d6aef9e4186e36245a9bd67568be98f1dc1ce1d4e5cfb08bc8312e81e
Instruction ID: 3d2b7062f5b210efe471c97b980448b4cf9d012b2cf333a99b2142474cc7abb4
Opcode Fuzzy Hash: 5d988e0d6aef9e4186e36245a9bd67568be98f1dc1ce1d4e5cfb08bc8312e81e
Instruction Fuzzy Hash: 3B2153755103469BDB209F699C88ADA77E8BFA5720F204A19FCA1E72D0D7F099F0CB50

Function 002340AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001A600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 001A604C
Part of subcall function 001A600E: GetStockObject.GDI32(00000011), ref: 001A6060
Part of subcall function 001A600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 001A606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00234112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0023411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0023412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00234139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00234145

Strings

Msctls_Progress32, xrefs: 002340E3

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: ce9417f8c69dda23e06e8f0725b1b8e3eb15fff82f5b43ab4bdd7fd0922dcdb7
Instruction ID: 4f93013ce4e3fde4e3b1e7fa25a3cb30b0c085902ea0416147fb7c92dd39abdd
Opcode Fuzzy Hash: ce9417f8c69dda23e06e8f0725b1b8e3eb15fff82f5b43ab4bdd7fd0922dcdb7
Instruction Fuzzy Hash: 5411B2B215021ABEEF119F64CC86EE77F6DEF09798F014111FA58A6050CB729C61DBA4

Function 001DD7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 001DD7A3: _free.LIBCMT ref: 001DD7CC

_free.LIBCMT ref: 001DD82D

Part of subcall function 001D29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,001DD7D1,00000000,00000000,00000000,00000000,?,001DD7F8,00000000,00000007,00000000,?,001DDBF5,00000000), ref: 001D29DE
Part of subcall function 001D29C8: GetLastError.KERNEL32(00000000,?,001DD7D1,00000000,00000000,00000000,00000000,?,001DD7F8,00000000,00000007,00000000,?,001DDBF5,00000000,00000000), ref: 001D29F0

_free.LIBCMT ref: 001DD838
_free.LIBCMT ref: 001DD843
_free.LIBCMT ref: 001DD897
_free.LIBCMT ref: 001DD8A2
_free.LIBCMT ref: 001DD8AD
_free.LIBCMT ref: 001DD8B8

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: cbc18e0a9550c0fe51c718776e67c20982726d44ffdfc239b5484901b739cfee
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: 5E115E71540B14AAD621BFF0DC47FCB7BDCAF20704F400826F2ADA6292DB75B5059661

Function 0020DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0020DA74
LoadStringW.USER32(00000000), ref: 0020DA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0020DA91
LoadStringW.USER32(00000000), ref: 0020DA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0020DADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 0020DAB9

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: b6c23032227471da425e6df53002bee1bd1e409757576a5b0a78d65a2b5c132c
Instruction ID: 1445a81f81f4a738d42bd7515ee23294549e3c83f82a3b79da34bcc59ed056c2
Opcode Fuzzy Hash: b6c23032227471da425e6df53002bee1bd1e409757576a5b0a78d65a2b5c132c
Instruction Fuzzy Hash: 350162F29102087FE7109BA4AD8DEE7726CE708301F500896B746F2082EA749E844F74

Function 0021096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(0151E360,0151E360), ref: 0021097B
EnterCriticalSection.KERNEL32(0151E340,00000000), ref: 0021098D
TerminateThread.KERNEL32(?,000001F6), ref: 0021099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 002109A9
CloseHandle.KERNEL32(?), ref: 002109B8
InterlockedExchange.KERNEL32(0151E360,000001F6), ref: 002109C8
LeaveCriticalSection.KERNEL32(0151E340), ref: 002109CF

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: e7c0dfa24f4604dfa848b7c593a06991587c537c458fbad97a9dcf4559c3fd7d
Instruction ID: 5575cd7480b1d3479e5c05c1328931c0018b26decd6ed63535ff658833151c36
Opcode Fuzzy Hash: e7c0dfa24f4604dfa848b7c593a06991587c537c458fbad97a9dcf4559c3fd7d
Instruction Fuzzy Hash: 02F0CD31442512ABD7515F94EE8DAD67A65BF05702F501025F501608A1C7B5A4B5CF90

Function 00221C60 Relevance: 9.3, APIs: 6, Instructions: 298networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00221DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00221DE1
WSAGetLastError.WSOCK32 ref: 00221DF2
htons.WSOCK32(?,?,?,?,?), ref: 00221EDB
inet_ntoa.WSOCK32(?), ref: 00221E8C

Part of subcall function 002039E8: _strlen.LIBCMT ref: 002039F2

Part of subcall function 00223224: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,?,0021EC0C), ref: 00223240

_strlen.LIBCMT ref: 00221F35

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _strlen$ByteCharErrorLastMultiWidehtonsinet_ntoa
String ID:
API String ID: 3203458085-0
Opcode ID: 760f0bac18c1857f6d526dd8ac3a6a9b64bc642d9d532cfa339dafa6575e18b3
Instruction ID: 69c0baee267d642d53938deabd1c6579126ca9c8f2b9ab0da5d75052c8f0f237
Opcode Fuzzy Hash: 760f0bac18c1857f6d526dd8ac3a6a9b64bc642d9d532cfa339dafa6575e18b3
Instruction Fuzzy Hash: 8CB11034204311AFC324DF64D885E2A7BE5AFA5318F58894CF46A5F2E2CB71ED52CB91

Function 001A5D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 001A5D30
GetWindowRect.USER32(?,?), ref: 001A5D71
ScreenToClient.USER32(?,?), ref: 001A5D99
GetClientRect.USER32(?,?), ref: 001A5ED7
GetWindowRect.USER32(?,?), ref: 001A5EF8

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 178e3d79a8e347d303cfc7b14ce412f11b6f6008a04f0c2dbeaee934c59ecf84
Instruction ID: 0afffcc8ed970560bc2ad7d3e0fb24401abd1a25fb5a791b2d8b95edef4002c6
Opcode Fuzzy Hash: 178e3d79a8e347d303cfc7b14ce412f11b6f6008a04f0c2dbeaee934c59ecf84
Instruction Fuzzy Hash: E5B17B39A04B8ADBDB14CFA9C4407EEB7F2FF58310F14841AE8A9D7250DB34AA51DB54

Function 001D01B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 001D00BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 001D00D6
__allrem.LIBCMT ref: 001D00ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 001D010B
__allrem.LIBCMT ref: 001D0122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 001D0140

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction ID: 4b0162c3defa73debad09faea933bf64313f38eb058c32900e9d06167ff5d322
Opcode Fuzzy Hash: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction Fuzzy Hash: BF81E372A00B06ABE7259A69CC82B6B73E9EF65364F25423FF411D7381E770D9018790

Function 001D61FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,001C82D9,001C82D9,?,?,?,001D644F,00000001,00000001,8BE85006), ref: 001D6258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,001D644F,00000001,00000001,8BE85006,?,?,?), ref: 001D62DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 001D63D8
__freea.LIBCMT ref: 001D63E5

Part of subcall function 001D3820: RtlAllocateHeap.NTDLL(00000000,?,00271444,?,001BFDF5,?,?,001AA976,00000010,00271440,001A13FC,?,001A13C6,?,001A1129), ref: 001D3852

__freea.LIBCMT ref: 001D63EE
__freea.LIBCMT ref: 001D6413

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 7e31dba642cf104dc07465e2cd0c0d8f56c6881c7bcfa5f83b17535776c4791d
Instruction ID: 45c2507b0b41a17764cb693653e0b73d931ff5ce1dd89df192d788711326c50a
Opcode Fuzzy Hash: 7e31dba642cf104dc07465e2cd0c0d8f56c6881c7bcfa5f83b17535776c4791d
Instruction Fuzzy Hash: CD51B072A00216BBEB258F64DC81EAF77A9EB54750F25472AFC09D6241EB34DC44D6A0

Function 0022BBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

Part of subcall function 0022C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0022B6AE,?,?), ref: 0022C9B5
Part of subcall function 0022C998: _wcslen.LIBCMT ref: 0022C9F1
Part of subcall function 0022C998: _wcslen.LIBCMT ref: 0022CA68
Part of subcall function 0022C998: _wcslen.LIBCMT ref: 0022CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0022BCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0022BD25
RegCloseKey.ADVAPI32(00000000), ref: 0022BD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 0022BD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0022BDF3
RegCloseKey.ADVAPI32(?), ref: 0022BDFF

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: 7358cef6decbfb9f411f04831ed41bc6c846824efbcfb431f619991e81a0af8b
Instruction ID: ecd1e9c665cdcc431c8708666cb679410c38071ca05246027879dca62a36db01
Opcode Fuzzy Hash: 7358cef6decbfb9f411f04831ed41bc6c846824efbcfb431f619991e81a0af8b
Instruction Fuzzy Hash: 1F81FE34228241EFC715DF64D885E6ABBE5FF85308F14886CF4598B2A2CB31ED45CB92

Function 001FF7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 001FF7B9
SysAllocString.OLEAUT32(00000001), ref: 001FF860
VariantCopy.OLEAUT32(001FFA64,00000000), ref: 001FF889
VariantClear.OLEAUT32(001FFA64), ref: 001FF8AD
VariantCopy.OLEAUT32(001FFA64,00000000), ref: 001FF8B1
VariantClear.OLEAUT32(?), ref: 001FF8BB

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: f170d8e8d9f4c9f2c0ddad038ab0a68d7e1b4730ff62c2b539abe14eb49ad86e
Instruction ID: 52688fbd250527d02bc7e5cf3d8dab7894b64938c9d386c6f725d25bc3d6a9ab
Opcode Fuzzy Hash: f170d8e8d9f4c9f2c0ddad038ab0a68d7e1b4730ff62c2b539abe14eb49ad86e
Instruction Fuzzy Hash: E651E635500318BACF24AB65D895B39B3A4FF55314F24846EFA06DF292DBF08C42DB96

Function 0021910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 001A7620: _wcslen.LIBCMT ref: 001A7625

Part of subcall function 001A6B57: _wcslen.LIBCMT ref: 001A6B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 002194E5
_wcslen.LIBCMT ref: 00219506
_wcslen.LIBCMT ref: 0021952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00219585

Strings

X, xrefs: 00219412

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: 8fefcc97230bf465190be3b6abfcccc298fee5803ff493a3d184dac91b6cb4f6
Instruction ID: 6cfef8b9366f007e199a8e81ca586c204172846ceb517d78baa6e2887bb05974
Opcode Fuzzy Hash: 8fefcc97230bf465190be3b6abfcccc298fee5803ff493a3d184dac91b6cb4f6
Instruction Fuzzy Hash: 99E1F435518341DFC724DF24C891BAAB7E5BFA5310F04896CF8999B2A2DB30DD85CB92

Function 001B920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 001B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 001B9BB2

BeginPaint.USER32(?,?,?), ref: 001B9241
GetWindowRect.USER32(?,?), ref: 001B92A5
ScreenToClient.USER32(?,?), ref: 001B92C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 001B92D3
EndPaint.USER32(?,?,?,?,?), ref: 001B9321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 001F71EA

Part of subcall function 001B9339: BeginPath.GDI32(00000000), ref: 001B9357

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: b9e0a5633ff83fa2b22bc9b1599d3529db182a42a1b0495ee7b8c4d44c888746
Instruction ID: a148ef96e2ed5ad16d8c036ea1bbd449df27d9e90ae3c3711d513b911068f2c8
Opcode Fuzzy Hash: b9e0a5633ff83fa2b22bc9b1599d3529db182a42a1b0495ee7b8c4d44c888746
Instruction Fuzzy Hash: 6B418D71108201AFD711DF28D889FBA7BB8EF55320F140669FAA8962E1C7319846DB61

Function 002107EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 0021080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00210847
EnterCriticalSection.KERNEL32(?), ref: 00210863
LeaveCriticalSection.KERNEL32(?), ref: 002108DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 002108F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00210921

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: de00024217522d62080b369f2f0022ad3570e03a83dafef3d02945ab683ae7b8
Instruction ID: 8b3c0250f4c6da0d77464c987c7f86c75a444825bddc51c52a94c584bd0d12f2
Opcode Fuzzy Hash: de00024217522d62080b369f2f0022ad3570e03a83dafef3d02945ab683ae7b8
Instruction Fuzzy Hash: 24419A71900205EFDF14AF64DC85AAA77B9FF18700F1140A9ED04AA297DB70DEA1DBA0

Function 002381DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,001FF3AB,00000000,?,?,00000000,?,001F682C,00000004,00000000,00000000), ref: 0023824C
EnableWindow.USER32(?,00000000), ref: 00238272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 002382D1
ShowWindow.USER32(?,00000004), ref: 002382E5
EnableWindow.USER32(?,00000001), ref: 0023830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 0023832F

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 2860fe9d404a7a3dc8a70f47885f2c4c1b8626b18557ef75f9e9313ba544bfc8
Instruction ID: 9f40ca01f4a2ea67a18838182ddce1d84d3245a25ce652078a4dfa42cde4645e
Opcode Fuzzy Hash: 2860fe9d404a7a3dc8a70f47885f2c4c1b8626b18557ef75f9e9313ba544bfc8
Instruction Fuzzy Hash: 2B41A370611785EFDB15CF15D899BA57BE0BF4A714F1841A9FA084F262CB31A862CF50

Function 00204C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00204C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00204CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00204CEA
_wcslen.LIBCMT ref: 00204D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00204D10
_wcsstr.LIBVCRUNTIME ref: 00204D1A

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: 7254869292673a01e44a5a5196a235051cbe2c871e42e50071688881e680c182
Instruction ID: 48ca78582aea4c8407038eb0c1a3971a595925ad5d4a5ac8673d184570327cda
Opcode Fuzzy Hash: 7254869292673a01e44a5a5196a235051cbe2c871e42e50071688881e680c182
Instruction Fuzzy Hash: CE2107B12143017BEB196F35AC4AE7B7BACDF95750F10802EF905DA192DB71DD1187A0

Function 0021581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 001A3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,001A3A97,?,?,001A2E7F,?,?,?,00000000), ref: 001A3AC2

_wcslen.LIBCMT ref: 0021587B
CoInitialize.OLE32(00000000), ref: 00215995
CoCreateInstance.OLE32(0023FCF8,00000000,00000001,0023FB68,?), ref: 002159AE
CoUninitialize.OLE32 ref: 002159CC

Strings

.lnk, xrefs: 00215876, 002158C1, 00215985

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: 793fdd3792fed332870078222500fd436634ce9285c72972ef14d90aa5ef720f
Instruction ID: 7f2dd84bac3fc573718fe505e915951c67c39b3c0d2aedda4bc6ca11c548eb2c
Opcode Fuzzy Hash: 793fdd3792fed332870078222500fd436634ce9285c72972ef14d90aa5ef720f
Instruction Fuzzy Hash: 9CD16474618711DFC704DF24C480A6ABBE1EFAA314F14889DF8899B361C731ED85CB92

Function 0020175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00200FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00200FCA
Part of subcall function 00200FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00200FD6
Part of subcall function 00200FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00200FE5
Part of subcall function 00200FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00200FEC
Part of subcall function 00200FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00201002

GetLengthSid.ADVAPI32(?,00000000,00201335), ref: 002017AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 002017BA
HeapAlloc.KERNEL32(00000000), ref: 002017C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 002017DA
GetProcessHeap.KERNEL32(00000000,00000000,00201335), ref: 002017EE
HeapFree.KERNEL32(00000000), ref: 002017F5

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: a668a8e34dd420254058eb13d45e18b4336b1cb1ac398eb5259d5b283557119e
Instruction ID: 97ea7c443f8e8694347ca5e5e7273f165c8139cf2e8049240db62a09f2877553
Opcode Fuzzy Hash: a668a8e34dd420254058eb13d45e18b4336b1cb1ac398eb5259d5b283557119e
Instruction Fuzzy Hash: 0111B131520306FFDB149FA4DC49BAEBBF9EB45355F204018F485A71A2C7359960DB60

Function 002014CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 002014FF
OpenProcessToken.ADVAPI32(00000000), ref: 00201506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00201515
CloseHandle.KERNEL32(00000004), ref: 00201520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0020154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00201563

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 31e02a43d38e5b4a2ac7a4045561dcd7d32f7eced2e1a933afbcdfe43cb45feb
Instruction ID: ecb35c6c659aedf01a1fb3f60251a9546fe93f991d23821d43b5cc1a7fdbd5b3
Opcode Fuzzy Hash: 31e02a43d38e5b4a2ac7a4045561dcd7d32f7eced2e1a933afbcdfe43cb45feb
Instruction Fuzzy Hash: A511267260024AABDF119FA8ED49BDE7BA9EF48748F144065FA05A20A1C375CE74DB60

Function 001C3382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,001C3379,001C2FE5), ref: 001C3390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 001C339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 001C33B7
SetLastError.KERNEL32(00000000,?,001C3379,001C2FE5), ref: 001C3409

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 355d26810112549784b1dbea45c4fe83dfa30d71b9209d8198d0826ee21b9d94
Instruction ID: 9f5eb09257ca458df6d69e03d8cba2abf97df551e44580b7680aebe58a3fe4f1
Opcode Fuzzy Hash: 355d26810112549784b1dbea45c4fe83dfa30d71b9209d8198d0826ee21b9d94
Instruction Fuzzy Hash: 2A01B13260D361AEA62937757CD9F762A94EB35379730C22EF430852F0EF51CE015694

Function 001D2D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,001D5686,001E3CD6,?,00000000,?,001D5B6A,?,?,?,?,?,001CE6D1,?,00268A48), ref: 001D2D78
_free.LIBCMT ref: 001D2DAB
_free.LIBCMT ref: 001D2DD3
SetLastError.KERNEL32(00000000,?,?,?,?,001CE6D1,?,00268A48,00000010,001A4F4A,?,?,00000000,001E3CD6), ref: 001D2DE0
SetLastError.KERNEL32(00000000,?,?,?,?,001CE6D1,?,00268A48,00000010,001A4F4A,?,?,00000000,001E3CD6), ref: 001D2DEC
_abort.LIBCMT ref: 001D2DF2

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 9be319964bf72c46c1746ff65fcdb335a636423f68970dddb56c5f110d5f52af
Instruction ID: 99f5beaa3c54c1e4e813fd05a8d0d3fac11d530cad54f87fdc002538f222e3ac
Opcode Fuzzy Hash: 9be319964bf72c46c1746ff65fcdb335a636423f68970dddb56c5f110d5f52af
Instruction Fuzzy Hash: B8F0A431905E106BC62637B8BC0AA1B255BABF27A5F35442BF878A3392EF7488015261

Function 00238A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 001B9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 001B9693
Part of subcall function 001B9639: SelectObject.GDI32(?,00000000), ref: 001B96A2
Part of subcall function 001B9639: BeginPath.GDI32(?), ref: 001B96B9
Part of subcall function 001B9639: SelectObject.GDI32(?,00000000), ref: 001B96E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00238A4E
LineTo.GDI32(?,00000003,00000000), ref: 00238A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00238A70
LineTo.GDI32(?,00000000,00000003), ref: 00238A80
EndPath.GDI32(?), ref: 00238A90
StrokePath.GDI32(?), ref: 00238AA0

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 40d2075359e2f970bbc8a46a1094f9e1ffe57da8dd69308a220a3233148723fd
Instruction ID: 08df1aa3a9238a59418e1df45bec60a5ec0def05086497701a32004d9be46465
Opcode Fuzzy Hash: 40d2075359e2f970bbc8a46a1094f9e1ffe57da8dd69308a220a3233148723fd
Instruction Fuzzy Hash: 8111C97600014DFFDB129F94EC88EAA7F6DEF08354F148012BA19AA1A1C7719D65DBA0

Function 002051FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00205218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00205229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00205230
ReleaseDC.USER32(00000000,00000000), ref: 00205238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 0020524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00205261

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: aa414dd039dcc264e3bed95421932c39f3ec9bf6be24d8012575791920565cfe
Instruction ID: f83e28993972d8d120e52b77d4302a81ce707673d44f944d75f52265ec876a69
Opcode Fuzzy Hash: aa414dd039dcc264e3bed95421932c39f3ec9bf6be24d8012575791920565cfe
Instruction Fuzzy Hash: 81014F76A00719BBEB109FA59C49A5EBFB8EF48751F144065FA04E7291D670DC10CFA0

Function 001A1BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 001A1BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 001A1BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 001A1C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 001A1C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 001A1C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 001A1C22

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: b5f73e75d3f4d159d184f7b92c1e177da4853d55127f04bb14510640d72b7104
Instruction ID: 02a9bab16ae7b07eaf9d8968e5e300c4a5aec55a88e8083258c16dd6c42c3943
Opcode Fuzzy Hash: b5f73e75d3f4d159d184f7b92c1e177da4853d55127f04bb14510640d72b7104
Instruction Fuzzy Hash: E20144B0902B5ABDE3008F6A8C85A52FEA8FF59354F00411BA15C4BA42C7B5A864CBE5

Function 0020EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0020EB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0020EB46
GetWindowThreadProcessId.USER32(?,?), ref: 0020EB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0020EB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0020EB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0020EB75

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 902fb6af279bf8771525b237c17e805e5dcc1ca38a46c8cbaec3632c3decc720
Instruction ID: 1c97c87dda4c8f16d15645cb4b1a3096a7b9fe22736711dabff8f0e1dea69905
Opcode Fuzzy Hash: 902fb6af279bf8771525b237c17e805e5dcc1ca38a46c8cbaec3632c3decc720
Instruction Fuzzy Hash: 22F03A72240158BBE7215B62AC0EEEF3A7CEFCAB11F104158F601E1091D7A05A01DBB5

Function 001F7439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 001F7452
SendMessageW.USER32(?,00001328,00000000,?), ref: 001F7469
GetWindowDC.USER32(?), ref: 001F7475
GetPixel.GDI32(00000000,?,?), ref: 001F7484
ReleaseDC.USER32(?,00000000), ref: 001F7496
GetSysColor.USER32(00000005), ref: 001F74B0

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: 507645956b861a7ca1293f780527880e8a44994efbe2428a66b30f923adc6731
Instruction ID: 6a8833beac387f2cad7f834847cd783420f5843c6f94fbeda15d613c70c2e6f9
Opcode Fuzzy Hash: 507645956b861a7ca1293f780527880e8a44994efbe2428a66b30f923adc6731
Instruction Fuzzy Hash: 1E014B31500619EFEB515F64EC0DBBA7BB5FF04311F650164FA19B21A1CB311E51AF50

Function 00201874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0020187F
UnloadUserProfile.USERENV(?,?), ref: 0020188B
CloseHandle.KERNEL32(?), ref: 00201894
CloseHandle.KERNEL32(?), ref: 0020189C
GetProcessHeap.KERNEL32(00000000,?), ref: 002018A5
HeapFree.KERNEL32(00000000), ref: 002018AC

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: fe7fa4505321e66624577cbed71748807bfbe03a42516720f05fbc4dda444fa4
Instruction ID: 46c3304aa76c388944dc344d2a9926a52b29036dafcf6124238a3e04c6410ac3
Opcode Fuzzy Hash: fe7fa4505321e66624577cbed71748807bfbe03a42516720f05fbc4dda444fa4
Instruction Fuzzy Hash: F7E0E536004101BBDB016FA1FD0C90ABF39FF49B22B208220F229A1070CB329430EF50

Function 001ABBE0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 232COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 001ABEB3

Strings

D%', xrefs: 001ABE9A
D%', xrefs: 001ABDED, 001ABD91, 001ABD1B
D%', xrefs: 001ABCA2
D%'D%', xrefs: 001ABCA5

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: D%'$D%'$D%'$D%'D%'
API String ID: 1385522511-1173686633
Opcode ID: 5873473402c31aeb7702e7d7f91a8e0da609477ec8357373551017eb9294ea72
Instruction ID: 97163c1f268626a7012b55d8bdc16fb6201f81f15e969c6e63c1ee79db5235b4
Opcode Fuzzy Hash: 5873473402c31aeb7702e7d7f91a8e0da609477ec8357373551017eb9294ea72
Instruction Fuzzy Hash: 05914A79A0424ACFCB18CF98C0D0AA9B7F1FF5A314B64816DD945AB356D731E981CB90

Function 0020C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001A7620: _wcslen.LIBCMT ref: 001A7625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0020C6EE
_wcslen.LIBCMT ref: 0020C735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0020C79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 0020C7CA

Strings

0, xrefs: 0020C6AF

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 25cbc230782ba6717360ff994216a2ddc2fd306a6408d8b62160951ecb917c74
Instruction ID: 111e5b4c01fc035d94f5c5492c97c8fe0c4c31994d37f2398a6c9f6fc4ea57b4
Opcode Fuzzy Hash: 25cbc230782ba6717360ff994216a2ddc2fd306a6408d8b62160951ecb917c74
Instruction Fuzzy Hash: EE51D5B16243029BD7159F28C885B6BB7ECAF95310F24072DF595D31E2D770D924CB52

Function 0020719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00207206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0020723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0020724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 002072CF

Strings

DllGetClassObject, xrefs: 00207242

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: fa2085cc18e5ca3a493207d2965a7b155e6e3b5c4914c468e8f82b96128d454b
Instruction ID: cff7d5e6327d6da0aeb2731db8667e892ef32faaea29d6bde0d6bca17bc418b3
Opcode Fuzzy Hash: fa2085cc18e5ca3a493207d2965a7b155e6e3b5c4914c468e8f82b96128d454b
Instruction Fuzzy Hash: 7C4181B1A14304EFDB15CF54C884A9A7BB9EF44310F2580A9BD059F28BD7B0ED54DBA0

Function 00233D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00233E35
IsMenu.USER32(?), ref: 00233E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00233E92
DrawMenuBar.USER32 ref: 00233EA5

Strings

0, xrefs: 00233D89

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: 8e080cf60d6982e14e82c956560886ed58da997053d82f802be50594ca218c77
Instruction ID: 1f94b4d698b3bc53b4b7834ed82923971736c9dc933fe77c824def3ba3dcfa0d
Opcode Fuzzy Hash: 8e080cf60d6982e14e82c956560886ed58da997053d82f802be50594ca218c77
Instruction Fuzzy Hash: F44148B5A2020AEFDB10DF54E884EEABBB9FF49350F144129E905A7250D730EE65CF60

Function 00201DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

Part of subcall function 00203CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00203CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00201E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00201E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00201EA9

Part of subcall function 001A6B57: _wcslen.LIBCMT ref: 001A6B6A

Strings

ListBox, xrefs: 00201E25
ComboBox, xrefs: 00201DF0

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: 235fd762060dadb92bbbe3ae3e0921b71c3d6b921665e9a5e287cf52a8fbdf97
Instruction ID: efafd1da5545951ff6719dfa60fe32d3f3f6f9e32e344211e1e26c7943a7205a
Opcode Fuzzy Hash: 235fd762060dadb92bbbe3ae3e0921b71c3d6b921665e9a5e287cf52a8fbdf97
Instruction Fuzzy Hash: DB213575A10204BBDB18AF60DC46CFFB7B8EF56360B144119F821A71E2DB34496A8A20

Function 00232F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00232F8D
LoadLibraryW.KERNEL32(?), ref: 00232F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00232FA9
DestroyWindow.USER32(?), ref: 00232FB1

Strings

SysAnimate32, xrefs: 00232F68

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 0974d27eb9b6fb743b83c9005612271c5189f90724939bc08f701c8ddcc96ba9
Instruction ID: c939a3de12da1e1c8baa35ff0fdd55c3d2671c07f31e2166105443c0f9894322
Opcode Fuzzy Hash: 0974d27eb9b6fb743b83c9005612271c5189f90724939bc08f701c8ddcc96ba9
Instruction Fuzzy Hash: 3F21CDB2224206EBEB104F64EC85EBB77BDEF59364F100218FA50E2590D771DCA59B60

Function 001C4D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,001C4D1E,001D28E9,?,001C4CBE,001D28E9,002688B8,0000000C,001C4E15,001D28E9,00000002), ref: 001C4D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 001C4DA0
FreeLibrary.KERNEL32(00000000,?,?,?,001C4D1E,001D28E9,?,001C4CBE,001D28E9,002688B8,0000000C,001C4E15,001D28E9,00000002,00000000), ref: 001C4DC3

Strings

mscoree.dll, xrefs: 001C4D86
CorExitProcess, xrefs: 001C4D98

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b34d5455fda882498f38e166d4ad8841efe6d31c8f18cc0ed650bfd19ec3cd82
Instruction ID: 36a9b1f7debd209ec17133ef2d55f01dd6b130ffccd830ee87bafaff88280850
Opcode Fuzzy Hash: b34d5455fda882498f38e166d4ad8841efe6d31c8f18cc0ed650bfd19ec3cd82
Instruction Fuzzy Hash: ABF04F35A40208BBDB15AF90EC4DFADBBB5EF54751F1001A8F90AA2660CB709A90DB91

Function 001FD3A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 001FD3AD
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 001FD3BF
FreeLibrary.KERNEL32(00000000), ref: 001FD3E5

Strings

GetSystemWow64DirectoryW, xrefs: 001FD3B9
X64, xrefs: 001FD2A8

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 145871493-2590602151
Opcode ID: e410f3cbb13f08b82f6f89e6918dababf504ccf84e296ce56ef1e2fac03030f1
Instruction ID: 68b4eb46fd10523502a08296cb3758d6fad8d25ead091a751c09daaa43c0e964
Opcode Fuzzy Hash: e410f3cbb13f08b82f6f89e6918dababf504ccf84e296ce56ef1e2fac03030f1
Instruction Fuzzy Hash: 68F055B2805A289BE7385710FC489793325BF11B01B668098F74BF2018DB30CC40A7C3

Function 001A4E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,001A4EDD,?,00271418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 001A4E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 001A4EAE
FreeLibrary.KERNEL32(00000000,?,?,001A4EDD,?,00271418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 001A4EC0

Strings

kernel32.dll, xrefs: 001A4E94
Wow64DisableWow64FsRedirection, xrefs: 001A4EA8

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: d74874ad28d0c8c808665a8c3f7b89d7e5166e8684256286c0628f09a1c0993d
Instruction ID: e0f266b68924e02f1f4ec489d4be78b4a62e46cc983e1cb6106e9ffd69f2d86d
Opcode Fuzzy Hash: d74874ad28d0c8c808665a8c3f7b89d7e5166e8684256286c0628f09a1c0993d
Instruction Fuzzy Hash: 9BE0863AA015225BD22117257C1CA6BA564AFC3F62B150115FC05F2100DBA4CD0152F4

Function 001A4E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,001E3CDE,?,00271418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 001A4E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 001A4E74
FreeLibrary.KERNEL32(00000000,?,?,001E3CDE,?,00271418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 001A4E87

Strings

Wow64RevertWow64FsRedirection, xrefs: 001A4E6E
kernel32.dll, xrefs: 001A4E5B

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 8dbc6ab1ef3f2daa0d4fdb7ee33798887d5b46916ab607da864098fece0b433c
Instruction ID: d3d62adc163a4294e40b25a3988d905d24b205a209d7271d200f25987ebc2dc7
Opcode Fuzzy Hash: 8dbc6ab1ef3f2daa0d4fdb7ee33798887d5b46916ab607da864098fece0b433c
Instruction Fuzzy Hash: 24D0C23A50262157A6231B247C0CD8B6A28AFC7F113150111B809F2110CFA4CD0192E0

Function 00212947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00212C05
DeleteFileW.KERNEL32(?), ref: 00212C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00212C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00212CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00212CC0

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: 5a006203a9a238a73f0cffa929e8bd46a54cb401b3dbe737bc7e7255da2f97ab
Instruction ID: a265dcb9f738436db63ae954700cf569156ea0900b379f2a986543d1a340e40d
Opcode Fuzzy Hash: 5a006203a9a238a73f0cffa929e8bd46a54cb401b3dbe737bc7e7255da2f97ab
Instruction Fuzzy Hash: CDB16171D10119ABDF21DFA4CD85EDEB7BDEF29350F1040A6F609E6141EB309A988FA1

Function 0022A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0022A427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0022A435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0022A468
CloseHandle.KERNEL32(?), ref: 0022A63D

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 19fabf232f018c8317870d42f318b1d266afa6a74a32d09d1282bc75612c3886
Instruction ID: 560b074a98ba624fb04ef1852c2746067ad3b6e9eb2a2049d416e7874b91aeb3
Opcode Fuzzy Hash: 19fabf232f018c8317870d42f318b1d266afa6a74a32d09d1282bc75612c3886
Instruction Fuzzy Hash: 87A1C075604301AFD720EF28D886F2AB7E5AF98714F14885CF55A9B6D2D7B0EC41CB82

Function 001DBB27 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00243700), ref: 001DBB91
WideCharToMultiByte.KERNEL32(00000000,00000000,0027121C,000000FF,00000000,0000003F,00000000,?,?), ref: 001DBC09
WideCharToMultiByte.KERNEL32(00000000,00000000,00271270,000000FF,?,0000003F,00000000,?), ref: 001DBC36
_free.LIBCMT ref: 001DBB7F

Part of subcall function 001D29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,001DD7D1,00000000,00000000,00000000,00000000,?,001DD7F8,00000000,00000007,00000000,?,001DDBF5,00000000), ref: 001D29DE
Part of subcall function 001D29C8: GetLastError.KERNEL32(00000000,?,001DD7D1,00000000,00000000,00000000,00000000,?,001DD7F8,00000000,00000007,00000000,?,001DDBF5,00000000,00000000), ref: 001D29F0

_free.LIBCMT ref: 001DBD4B

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 1286116820-0
Opcode ID: 33c4500afdec1f82f72dc0a034ada2cc2c0d4dd6118e54871eaab153de7785c7
Instruction ID: 61b7d673a8922ceb799dce5e0ca12a8298917b0cb67909818c770b92667c422e
Opcode Fuzzy Hash: 33c4500afdec1f82f72dc0a034ada2cc2c0d4dd6118e54871eaab153de7785c7
Instruction Fuzzy Hash: BB513771908219EFCB14EF69DCC59AEB7B8FF50310B12426BE456E73A1EB309E509B50

Function 0020E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0020DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,0020CF22,?), ref: 0020DDFD

Part of subcall function 0020DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,0020CF22,?), ref: 0020DE16

Part of subcall function 0020E199: GetFileAttributesW.KERNEL32(?,0020CF95), ref: 0020E19A

lstrcmpiW.KERNEL32(?,?), ref: 0020E473
MoveFileW.KERNEL32(?,?), ref: 0020E4AC
_wcslen.LIBCMT ref: 0020E5EB
_wcslen.LIBCMT ref: 0020E603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 0020E650

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: c233bd4772367576f5198edb77e1a28f575e56e36add272c9d8bed1a7ada1f36
Instruction ID: e42a43c889cc15606dbede5d34d3af5be536725d3607e202708f7af4b5edd668
Opcode Fuzzy Hash: c233bd4772367576f5198edb77e1a28f575e56e36add272c9d8bed1a7ada1f36
Instruction Fuzzy Hash: 025172B24183455BCB24EB90DC819DBB3ECAF95340F00491EF68993192EF75E6988B66

Function 0022B9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

Part of subcall function 0022C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0022B6AE,?,?), ref: 0022C9B5
Part of subcall function 0022C998: _wcslen.LIBCMT ref: 0022C9F1
Part of subcall function 0022C998: _wcslen.LIBCMT ref: 0022CA68
Part of subcall function 0022C998: _wcslen.LIBCMT ref: 0022CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0022BAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0022BB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 0022BB63
RegCloseKey.ADVAPI32(?,?), ref: 0022BBA6
RegCloseKey.ADVAPI32(00000000), ref: 0022BBB3

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 00e82417df033884b7a07016b8540bf27292ecc93899a267025ea981937ec617
Instruction ID: b85515594564b92e6c31b95e9f462c10ac5431d5573795d04b3180bb48736bbe
Opcode Fuzzy Hash: 00e82417df033884b7a07016b8540bf27292ecc93899a267025ea981937ec617
Instruction Fuzzy Hash: 8061C135218241BFC715DF54D490E2ABBE5FF85308F54895CF4998B2A2CB31ED45CB92

Function 00208BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00208BCD
VariantClear.OLEAUT32 ref: 00208C3E
VariantClear.OLEAUT32 ref: 00208C9D
VariantClear.OLEAUT32(?), ref: 00208D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00208D3B

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 80a3c758ca95b5bb180220e574723ce30d143d37f925fbb54234675a2cf8df70
Instruction ID: f4bcf4e14f8bccb2ebbffbd410d28503a3840bcceca1bf7122c0dc73573bca40
Opcode Fuzzy Hash: 80a3c758ca95b5bb180220e574723ce30d143d37f925fbb54234675a2cf8df70
Instruction Fuzzy Hash: A6516AB5A10219EFDB14CF68D884AAAB7F8FF89310B158569E945DB350E730E921CF90

Function 00218AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00218BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00218BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00218C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00218C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00218C5F

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 31b5af00c786864165940ba3597915052683865d647021d297c59145576437a3
Instruction ID: 057aab9410cd998c8010f668f5a154baa8dfe565550e57ef4ea1d94d66fead94
Opcode Fuzzy Hash: 31b5af00c786864165940ba3597915052683865d647021d297c59145576437a3
Instruction Fuzzy Hash: 47515A39A00215DFCB05DF64C881AAEBBF5FF59314F088059E849AB3A2CB31ED51CB90

Function 00228EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00228F40
GetProcAddress.KERNEL32(00000000,?), ref: 00228FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00228FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00229032
FreeLibrary.KERNEL32(00000000), ref: 00229052

Part of subcall function 001BF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00211043,?,75C0E610), ref: 001BF6E6
Part of subcall function 001BF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,001FFA64,00000000,00000000,?,?,00211043,?,75C0E610,?,001FFA64), ref: 001BF70D

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: 76c15a7479de7d2f6213b5ebd8ad91adc6950b8eb9983c54ea490852c3154567
Instruction ID: 0320dc452213ca5eff054a3a2a60d8b3ad7377df670dd78f4a8663342e96e223
Opcode Fuzzy Hash: 76c15a7479de7d2f6213b5ebd8ad91adc6950b8eb9983c54ea490852c3154567
Instruction Fuzzy Hash: 04518E38A05215EFC701DF94D4948ADBBF1FF59314F588098E809AB762DB31EE85CB90

Function 00236B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00236C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00236C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00236C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,0021AB79,00000000,00000000), ref: 00236C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00236CC7

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: b4914faaed94966b2513a81143e6e073ac576e738d50627a4eea5fb961e69474
Instruction ID: a6f1f71f1af0a96827e0900fbc90185847dc2f01932c2b48b09b771528a0a8db
Opcode Fuzzy Hash: b4914faaed94966b2513a81143e6e073ac576e738d50627a4eea5fb961e69474
Instruction Fuzzy Hash: 19410AB5620105BFDB24CF28CC5DFA9BBADEB09350F149625F855A72E0C371ED61CA50

Function 001D2051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 001D20C3
_free.LIBCMT ref: 001D20E3

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 2f4b9782920c3b29c482850540d5a061ed05fdcb2ac29f1190665a254ffb4a67
Instruction ID: fd607fca82cc57c255278bea8f97b200a970c39e799da584398b14040bf83654
Opcode Fuzzy Hash: 2f4b9782920c3b29c482850540d5a061ed05fdcb2ac29f1190665a254ffb4a67
Instruction Fuzzy Hash: 9541D732A00200AFCB24DF78C881A6DB7F5EFA9314F1585AAE525EB351D731ED01DB80

Function 001B912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 001B9141
ScreenToClient.USER32(00000000,?), ref: 001B915E
GetAsyncKeyState.USER32(00000001), ref: 001B9183
GetAsyncKeyState.USER32(00000002), ref: 001B919D

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: eca2f111e2eaf0a562552f9226068d6e86647af14f7f37fd70144d4d5e7d0ac7
Instruction ID: 38a77112b5512a55103b56cd633854da76274e484d71f5c8e5787d6d8dc32bc9
Opcode Fuzzy Hash: eca2f111e2eaf0a562552f9226068d6e86647af14f7f37fd70144d4d5e7d0ac7
Instruction Fuzzy Hash: 6B415C71A0860AFBDF199F68C848BFEB774FF05320F21821AE529A62D0C7346955DF91

Function 00213874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 002138CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00213922
TranslateMessage.USER32(?), ref: 0021394B
DispatchMessageW.USER32(?), ref: 00213955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00213966

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: 677225ce0522ab4c958d38fb9a3281f47e1666fb920baf6939fe5b112aa55018
Instruction ID: 9757f6d2e990ea62893840028df08ee4947d43ae5d4209eb78975cf97b9c8ace
Opcode Fuzzy Hash: 677225ce0522ab4c958d38fb9a3281f47e1666fb920baf6939fe5b112aa55018
Instruction Fuzzy Hash: E231C470924346DEEB35CF34A84DBF63BE9AF25300F140569E466921A0E3F4AAE5CB51

Function 0021CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,00000000,?,?,?,0021C21E,00000000), ref: 0021CF38
InternetReadFile.WININET(?,00000000,?,?), ref: 0021CF6F
GetLastError.KERNEL32(?,00000000,?,?,?,0021C21E,00000000), ref: 0021CFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,0021C21E,00000000), ref: 0021CFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,0021C21E,00000000), ref: 0021CFF2

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: eb583237ea867ed921df209c77e016e82f4d0df9bdeca8d096e419a6471fa427
Instruction ID: 5e85f0f4ec35d812dc63aa1d354c0f003e65a05c1936e100f817179066a1ef87
Opcode Fuzzy Hash: eb583237ea867ed921df209c77e016e82f4d0df9bdeca8d096e419a6471fa427
Instruction Fuzzy Hash: 7E318075550206EFDB20DFA5D888AEBBBF9EB24310B20442FF516E2550D730ED92DB60

Function 00201901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00201915
PostMessageW.USER32(00000001,00000201,00000001), ref: 002019C1
Sleep.KERNEL32(00000000,?,?,?), ref: 002019C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 002019DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 002019E2

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 1796172c52ea422dae11f339635670b2ff1039b9c99f7cd717f468f0d22e9f5c
Instruction ID: 655714171dd787722a2ce9f495daaf4834c4d36187dce7295ed215eef8f599cd
Opcode Fuzzy Hash: 1796172c52ea422dae11f339635670b2ff1039b9c99f7cd717f468f0d22e9f5c
Instruction Fuzzy Hash: E831E071A1021EEFCB04CFA8DD9DADE3BB5EB44314F104229F921A72D2C3B09964CB90

Function 00235706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00235745
SendMessageW.USER32(?,00001074,?,00000001), ref: 0023579D
_wcslen.LIBCMT ref: 002357AF
_wcslen.LIBCMT ref: 002357BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00235816

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: ac9e86d018798dd31c1b258c501ebf8b4386e38207aa7d8dea686a1eb680dcb1
Instruction ID: 193f765b59526d707344e5dda6520abbc99fad7457fe233216717cb6a4050ed2
Opcode Fuzzy Hash: ac9e86d018798dd31c1b258c501ebf8b4386e38207aa7d8dea686a1eb680dcb1
Instruction Fuzzy Hash: 2421A5B19246299BDB208F64DC85AEDB7B8FF54324F108216F91DEA180D7708995CF50

Function 00220930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00220951
GetForegroundWindow.USER32 ref: 00220968
GetDC.USER32(00000000), ref: 002209A4
GetPixel.GDI32(00000000,?,00000003), ref: 002209B0
ReleaseDC.USER32(00000000,00000003), ref: 002209E8

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 5d1428f0a53138da5b5075d7b5e5c900988ce24b74a9d3c98b024d8c6a15d12d
Instruction ID: e5753093466cd96fca9c76d985469072f7bbd05471e5357e85d05a9beff42d7f
Opcode Fuzzy Hash: 5d1428f0a53138da5b5075d7b5e5c900988ce24b74a9d3c98b024d8c6a15d12d
Instruction Fuzzy Hash: B6218435A00214AFD714EFA5D889A9EB7F9EF55700F148068E84AA7762CB70EC54CF50

Function 001DCDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 001DCDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 001DCDE9

Part of subcall function 001D3820: RtlAllocateHeap.NTDLL(00000000,?,00271444,?,001BFDF5,?,?,001AA976,00000010,00271440,001A13FC,?,001A13C6,?,001A1129), ref: 001D3852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 001DCE0F
_free.LIBCMT ref: 001DCE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 001DCE31

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 0be0cfe37f8b22760710d3b0b7b44a21621739d01e434f0c58e04ebdb60de689
Instruction ID: 61ba7c9b729af3b5117948e3850b1574a109df404e0cc415c6aa7b8d0ec71e7c
Opcode Fuzzy Hash: 0be0cfe37f8b22760710d3b0b7b44a21621739d01e434f0c58e04ebdb60de689
Instruction Fuzzy Hash: 600184B26016167F672116BA6C8CD7BBE6EDEC6BA1325062BF905D7301EB618D01D2F0

Function 001B9639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 001B9693
SelectObject.GDI32(?,00000000), ref: 001B96A2
BeginPath.GDI32(?), ref: 001B96B9
SelectObject.GDI32(?,00000000), ref: 001B96E2

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: b066466bba3630b32dfe1fdf5277a8a7032d40636c470d05f17d6c524c1d1f6d
Instruction ID: b968e937447d6b359189fa1bb06748dc0673b91325b454cdcb50a4a011568078
Opcode Fuzzy Hash: b066466bba3630b32dfe1fdf5277a8a7032d40636c470d05f17d6c524c1d1f6d
Instruction Fuzzy Hash: FE216A71802246EBDB119F28FC1DBE97BA8BF10325F200216F618A61A0D37098A3CF90

Function 00205711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00205726
_memcmp.LIBVCRUNTIME ref: 00205744
_memcmp.LIBVCRUNTIME ref: 00205757
_memcmp.LIBVCRUNTIME ref: 0020576F
_memcmp.LIBVCRUNTIME ref: 00205787

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 1953a0aa27470cf6eba7d1b540385bc430d9840e90dbb19813d385a35e94c553
Instruction ID: 4d24627fee12163f22491f03a95ad6ed4095490ce11cfc734a12da24b53cbdf5
Opcode Fuzzy Hash: 1953a0aa27470cf6eba7d1b540385bc430d9840e90dbb19813d385a35e94c553
Instruction Fuzzy Hash: 8801F9A16E1755BBD70895109F82FBBB35DAF323A8F000025FD049A2C3F760ED3096A1

Function 001D2DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,001CF2DE,001D3863,00271444,?,001BFDF5,?,?,001AA976,00000010,00271440,001A13FC,?,001A13C6), ref: 001D2DFD
_free.LIBCMT ref: 001D2E32
_free.LIBCMT ref: 001D2E59
SetLastError.KERNEL32(00000000,001A1129), ref: 001D2E66
SetLastError.KERNEL32(00000000,001A1129), ref: 001D2E6F

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 9c98e46be4fadb9821f6186570d5375bda1f94be9ba6f750e800daa8bee4ea53
Instruction ID: 2a7d7048c7a45d24607a4b141628a43c7e5217e019164fb3639884db7302dc81
Opcode Fuzzy Hash: 9c98e46be4fadb9821f6186570d5375bda1f94be9ba6f750e800daa8bee4ea53
Instruction Fuzzy Hash: AC0128326056006BC62677347C49D2B275EABF23B6B35442BF435A33D2EFB0CC019120

Function 0020000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,001FFF41,80070057,?,?,?,0020035E), ref: 0020002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,001FFF41,80070057,?,?), ref: 00200046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,001FFF41,80070057,?,?), ref: 00200054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,001FFF41,80070057,?), ref: 00200064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,001FFF41,80070057,?,?), ref: 00200070

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 0d1b65a42a2be4f3401555376eabe38134db486d700dbb899e788db84130fde9
Instruction ID: 7e0513212cbc1d1ab24101fddde065acf1fc5bd162cc18bd5b7c62a3555d9fc5
Opcode Fuzzy Hash: 0d1b65a42a2be4f3401555376eabe38134db486d700dbb899e788db84130fde9
Instruction Fuzzy Hash: 3301A276610315BFEB114F68EC88BAA7AEEEF44751F244124F905E2251DB71DE508BA0

Function 002010F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00201114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00200B9B,?,?,?), ref: 00201120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00200B9B,?,?,?), ref: 0020112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00200B9B,?,?,?), ref: 00201136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0020114D

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: b62dd152896e35463ec1bc9e6d030ce39da524ad95be01fddc4ce3d829abe654
Instruction ID: b24ce3c6023877a0278d913de4fdbc8cde380e48188e545aabb51907c82e06b5
Opcode Fuzzy Hash: b62dd152896e35463ec1bc9e6d030ce39da524ad95be01fddc4ce3d829abe654
Instruction Fuzzy Hash: 89011975200315BFDB154FA5EC4DA6A7B6EEF893A0B204429FA49E73A0DA31DC109B60

Function 00200FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00200FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00200FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00200FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00200FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00201002

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 25681e8ea185f24c28253d5a6183d915c387617e8df92c5c3283f951bebfad49
Instruction ID: d3d6ffa4e5dec83a6b2c43578d41230f1c99740f189750678924c46ed0a2825b
Opcode Fuzzy Hash: 25681e8ea185f24c28253d5a6183d915c387617e8df92c5c3283f951bebfad49
Instruction Fuzzy Hash: B2F06235200311EBD7215FA4EC4DF563B6EEF89761F204414FD89D7291CA70DC608B60

Function 00201014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0020102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00201036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00201045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0020104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00201062

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 085630055e7df8f39ec7a87cb22a7eba0769445a3d0362fef93bcbc0497b3900
Instruction ID: bd2c12466e45fa45abd3aef0d30abf8d82a0a135539db5cc3a5da0b748038cf9
Opcode Fuzzy Hash: 085630055e7df8f39ec7a87cb22a7eba0769445a3d0362fef93bcbc0497b3900
Instruction Fuzzy Hash: 09F06D35200312EBDB215FA4EC4DF563BAEEF89761F200424FE89E7291CA70D8608B60

Function 0021030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,0021017D,?,002132FC,?,00000001,001E2592,?), ref: 00210324
CloseHandle.KERNEL32(?,?,?,?,0021017D,?,002132FC,?,00000001,001E2592,?), ref: 00210331
CloseHandle.KERNEL32(?,?,?,?,0021017D,?,002132FC,?,00000001,001E2592,?), ref: 0021033E
CloseHandle.KERNEL32(?,?,?,?,0021017D,?,002132FC,?,00000001,001E2592,?), ref: 0021034B
CloseHandle.KERNEL32(?,?,?,?,0021017D,?,002132FC,?,00000001,001E2592,?), ref: 00210358
CloseHandle.KERNEL32(?,?,?,?,0021017D,?,002132FC,?,00000001,001E2592,?), ref: 00210365

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 42bb6236cfc8a32ab0303135b5ae1e61bda5ca2f3d208aced64eb064ed571f9f
Instruction ID: ebc2576f87960d96bbe6401a3a190a21a616d767f4eb78d1a7f0de1229ac023e
Opcode Fuzzy Hash: 42bb6236cfc8a32ab0303135b5ae1e61bda5ca2f3d208aced64eb064ed571f9f
Instruction Fuzzy Hash: C301A272810B169FC730AF66D8C0456F7F5BF603153158A7FD1A652931C3B1A9A5DF80

Function 001DD73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 001DD752

Part of subcall function 001D29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,001DD7D1,00000000,00000000,00000000,00000000,?,001DD7F8,00000000,00000007,00000000,?,001DDBF5,00000000), ref: 001D29DE
Part of subcall function 001D29C8: GetLastError.KERNEL32(00000000,?,001DD7D1,00000000,00000000,00000000,00000000,?,001DD7F8,00000000,00000007,00000000,?,001DDBF5,00000000,00000000), ref: 001D29F0

_free.LIBCMT ref: 001DD764
_free.LIBCMT ref: 001DD776
_free.LIBCMT ref: 001DD788
_free.LIBCMT ref: 001DD79A

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9973e0b073f01a3d1d57781fbf986f91ae2c388cee4feeb9e859d1dfa34e0c62
Instruction ID: 710f23c6bd13da9e4a8eca1fb5dde9b8bb68627ba0a8653394babb5aac9e62e5
Opcode Fuzzy Hash: 9973e0b073f01a3d1d57781fbf986f91ae2c388cee4feeb9e859d1dfa34e0c62
Instruction Fuzzy Hash: C8F09632541214AB8725FB64F9C6C2677DDBB54318BA44C47F0A8D7701C734FC808A60

Function 00205C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00205C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00205C6F
MessageBeep.USER32(00000000), ref: 00205C87
KillTimer.USER32(?,0000040A), ref: 00205CA3
EndDialog.USER32(?,00000001), ref: 00205CBD

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: ba4b90a4933b9d217b62c756fc3dee0833b448bf2590f6888577b3a0e27ce131
Instruction ID: f632a91a95dfc7740d0012a80edb264925bbfe36a55bfd0bd2a087fbb0909726
Opcode Fuzzy Hash: ba4b90a4933b9d217b62c756fc3dee0833b448bf2590f6888577b3a0e27ce131
Instruction Fuzzy Hash: 13016231510B14ABFB215B10ED4FFA67BBCBB00B05F04155AA583B14E1DBF4A9958F90

Function 001D22A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 001D22BE

Part of subcall function 001D29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,001DD7D1,00000000,00000000,00000000,00000000,?,001DD7F8,00000000,00000007,00000000,?,001DDBF5,00000000), ref: 001D29DE
Part of subcall function 001D29C8: GetLastError.KERNEL32(00000000,?,001DD7D1,00000000,00000000,00000000,00000000,?,001DD7F8,00000000,00000007,00000000,?,001DDBF5,00000000,00000000), ref: 001D29F0

_free.LIBCMT ref: 001D22D0
_free.LIBCMT ref: 001D22E3
_free.LIBCMT ref: 001D22F4
_free.LIBCMT ref: 001D2305

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9c1f45f0a31e73241a24ed8ce56702eb5f6c5cafc8e90ec131fcb3754cbd695f
Instruction ID: 7b09dbae83218c4ea63318b889a9ce07ea251267223c2bf89315b765ee2204c8
Opcode Fuzzy Hash: 9c1f45f0a31e73241a24ed8ce56702eb5f6c5cafc8e90ec131fcb3754cbd695f
Instruction Fuzzy Hash: 46F03AB08101308B8626BF68BC598183B68BB38760710050BF828D33B2CB7008A1BBE5

Function 001B95C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 001B95D4
StrokeAndFillPath.GDI32(?,?,001F71F7,00000000,?,?,?), ref: 001B95F0
SelectObject.GDI32(?,00000000), ref: 001B9603
DeleteObject.GDI32 ref: 001B9616
StrokePath.GDI32(?), ref: 001B9631

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: a043b69e04511fa1f89761f3cbfea4810a0ce6cce7c281a4a025f7a50762dffe
Instruction ID: ee00e79f48537a9462d8ce7bea5602fee1dc73c0c22527ae732270adbe3ad025
Opcode Fuzzy Hash: a043b69e04511fa1f89761f3cbfea4810a0ce6cce7c281a4a025f7a50762dffe
Instruction Fuzzy Hash: 7AF0E731006288EBDB265F69FD1CBA43F65AF01322F148214F669690F0C73189A7DF20

Function 001D0F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 001D10F9
__freea.LIBCMT ref: 001D1117

Part of subcall function 001D1537: _free.LIBCMT ref: 001D154F

Strings

a/p, xrefs: 001D11DE
am/pm, xrefs: 001D117A

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 72b631817deb138def9e9f6df038a26a1a9651d93d57c2c11ff38600b05e6930
Instruction ID: bb47504cd57436ccc7293871a1514480bf5d840cb0aa8dc69ac2be9db3b36cce
Opcode Fuzzy Hash: 72b631817deb138def9e9f6df038a26a1a9651d93d57c2c11ff38600b05e6930
Instruction Fuzzy Hash: 53D10331900206FADB289F68C895BFEB7B1FF16320F29415BE901AB751D3759D80CB91

Function 002261D0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 324COMMON

Download Yara Rule

APIs

Part of subcall function 001C0242: EnterCriticalSection.KERNEL32(0027070C,00271884,?,?,001B198B,00272518,?,?,?,001A12F9,00000000), ref: 001C024D
Part of subcall function 001C0242: LeaveCriticalSection.KERNEL32(0027070C,?,001B198B,00272518,?,?,?,001A12F9,00000000), ref: 001C028A

Part of subcall function 001C00A3: __onexit.LIBCMT ref: 001C00A9

__Init_thread_footer.LIBCMT ref: 00226238

Part of subcall function 001C01F8: EnterCriticalSection.KERNEL32(0027070C,?,?,001B8747,00272514), ref: 001C0202
Part of subcall function 001C01F8: LeaveCriticalSection.KERNEL32(0027070C,?,001B8747,00272514), ref: 001C0235

Part of subcall function 0021359C: LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 002135E4
Part of subcall function 0021359C: LoadStringW.USER32(00272390,?,00000FFF,?), ref: 0021360A

Strings

x#', xrefs: 00226353
x#', xrefs: 0022633A
x#', xrefs: 0022636F

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeaveLoadString$Init_thread_footer__onexit
String ID: x#'$x#'$x#'
API String ID: 1072379062-1408229380
Opcode ID: 3efdca5f33e49430e3a377f0492078575e804671d5cb4ca7d179c2b1272f836f
Instruction ID: 37defcdb6f2b3eed2d542c3d26f07fd609b7f0ae49c34a90104b25a466c8fc26
Opcode Fuzzy Hash: 3efdca5f33e49430e3a377f0492078575e804671d5cb4ca7d179c2b1272f836f
Instruction Fuzzy Hash: B0C1BD72A10116AFCB24DF98D894EBEB7B9EF58300F108069F9459B291DB70ED64CB90

Function 00227B7E Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 001C0242: EnterCriticalSection.KERNEL32(0027070C,00271884,?,?,001B198B,00272518,?,?,?,001A12F9,00000000), ref: 001C024D
Part of subcall function 001C0242: LeaveCriticalSection.KERNEL32(0027070C,?,001B198B,00272518,?,?,?,001A12F9,00000000), ref: 001C028A

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

Part of subcall function 001C00A3: __onexit.LIBCMT ref: 001C00A9

__Init_thread_footer.LIBCMT ref: 00227BFB

Part of subcall function 001C01F8: EnterCriticalSection.KERNEL32(0027070C,?,?,001B8747,00272514), ref: 001C0202
Part of subcall function 001C01F8: LeaveCriticalSection.KERNEL32(0027070C,?,001B8747,00272514), ref: 001C0235

Strings

G, xrefs: 00227C7F
5, xrefs: 00227C78
Variable must be of type 'Object'., xrefs: 00227C3A

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: 5$G$Variable must be of type 'Object'.
API String ID: 535116098-3733170431
Opcode ID: 86ee2913fb47d6c10029653bb964efaa38a97b3335d69c34bddccec6e1410a34
Instruction ID: 3df461791bb7fece8c859f4060fa531ee47eb21ee15d4985fcfd3798fe9fcf10
Opcode Fuzzy Hash: 86ee2913fb47d6c10029653bb964efaa38a97b3335d69c34bddccec6e1410a34
Instruction Fuzzy Hash: AF91A074628219EFCB14EF94E891DBDB7B1FF49300F508059F8066B292DB71AE61CB51

Function 00202716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0020B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,002021D0,?,?,00000034,00000800,?,00000034), ref: 0020B42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00202760

Part of subcall function 0020B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,002021FF,?,?,00000800,?,00001073,00000000,?,?), ref: 0020B3F8

Part of subcall function 0020B32A: GetWindowThreadProcessId.USER32(?,?), ref: 0020B355
Part of subcall function 0020B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00202194,00000034,?,?,00001004,00000000,00000000), ref: 0020B365
Part of subcall function 0020B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00202194,00000034,?,?,00001004,00000000,00000000), ref: 0020B37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 002027CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0020281A

Strings

@, xrefs: 00202832

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 7637ae7631afa3a947469d8f00a0b813204ffbde91b57e41e9ed4433c13de18e
Instruction ID: 6f8a86957e02fcc8dbff2c0e5c08dacff05c961a078e79038875eac145242aab
Opcode Fuzzy Hash: 7637ae7631afa3a947469d8f00a0b813204ffbde91b57e41e9ed4433c13de18e
Instruction Fuzzy Hash: 41413C76900218AFDB11DFA4CD46AEEBBB8AF09300F108095FA55B7191DB706E59CFA0

Function 001D172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\file.exe,00000104), ref: 001D1769
_free.LIBCMT ref: 001D1834
_free.LIBCMT ref: 001D183E

Strings

C:\Users\user\Desktop\file.exe, xrefs: 001D1760, 001D1767, 001D1796, 001D17CE

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\file.exe
API String ID: 2506810119-4010620828
Opcode ID: 051281f51a06f215a540411fd86acdcbea80795da60a7420d5a2339dd0ae9851
Instruction ID: 08942029d0fa2b9cc8a9bdff37051a776458a7ab11b99cc757c2b370e8b1366c
Opcode Fuzzy Hash: 051281f51a06f215a540411fd86acdcbea80795da60a7420d5a2339dd0ae9851
Instruction Fuzzy Hash: 0C318D71A40258BBDB21DB99D885D9EBBFCEFA5310B1041ABF804D7321D7708E80DBA0

Function 0020C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 0020C306
DeleteMenu.USER32(?,00000007,00000000), ref: 0020C34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00271990,01524D10), ref: 0020C395

Strings

0, xrefs: 0020C2DF

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 5ad55728a38764e67169c0d5e2ba1021ab040a9425ea73cd481db62217446dce
Instruction ID: 66157674c898812fd9a2d8225b1cffa6740c8d6c0b88ff4c2216b2c2a4d452ed
Opcode Fuzzy Hash: 5ad55728a38764e67169c0d5e2ba1021ab040a9425ea73cd481db62217446dce
Instruction Fuzzy Hash: EE41B2B12243029FD720DF24D884B5ABBE4AF85310F20876DF8A5972D2D770E954CB62

Function 00234416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0023CC08,00000000,?,?,?,?), ref: 002344AA
GetWindowLongW.USER32 ref: 002344C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 002344D7

Strings

SysTreeView32, xrefs: 0023447C

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 3dff4296c54616e74b87f008258d86a98ddb379dc43ae00491a18d1e3e08111f
Instruction ID: d40fe634c098aaa47d184cdecce3d7d2227a30d564a52447b4f83edd5f0d4819
Opcode Fuzzy Hash: 3dff4296c54616e74b87f008258d86a98ddb379dc43ae00491a18d1e3e08111f
Instruction Fuzzy Hash: E4319072220206AFDB20AE38DC45BDA77A9EF19334F204725FA75A21D0D770EC619B50

Function 00206E71 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

SysReAllocString.OLEAUT32(?,?), ref: 00206EED
VariantCopyInd.OLEAUT32(?,?), ref: 00206F08
VariantClear.OLEAUT32(?), ref: 00206F12

Strings

*j , xrefs: 00206E8B, 00206E90, 00206EF8

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Variant$AllocClearCopyString
String ID: *j
API String ID: 2173805711-1860680129
Opcode ID: eb87216ed0488e9562718cb99c4c3d8503b1a129ac914a9365a50e0e7fe873b4
Instruction ID: 6cb30cd228519de843451cbca5b724e83a9367ef673a35e16f9c22b6b72a9aab
Opcode Fuzzy Hash: eb87216ed0488e9562718cb99c4c3d8503b1a129ac914a9365a50e0e7fe873b4
Instruction Fuzzy Hash: 6A317075618346DFCB05AFA4E8999BD3776FF55700B2004A8F9034BAE2C7749932DB90

Function 0022304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0022335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00223077,?,?), ref: 00223378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 0022307A
_wcslen.LIBCMT ref: 0022309B
htons.WSOCK32(00000000,?,?,00000000), ref: 00223106

Strings

255.255.255.255, xrefs: 00223095, 0022309A

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: 9c1153835fb874d178e0ddf469b27f285cc61e1d93c0295a1e28b0dadaf3a761
Instruction ID: 7936915b77fa47dce4ecc334ba8bddc17f8ec591f5528eb8bedac92255bfb2d1
Opcode Fuzzy Hash: 9c1153835fb874d178e0ddf469b27f285cc61e1d93c0295a1e28b0dadaf3a761
Instruction Fuzzy Hash: A131D539214226AFCB10CFA8E485EA977E0EF15318F248059E9158B392DB7ADF55CB70

Function 00234653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00234705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00234713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0023471A

Strings

msctls_updown32, xrefs: 00234684

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: e11a84eb13b1a513b0bd2135b9420d26d5741698824d37bea6e7319b282324e9
Instruction ID: f32701a59ade90605ddb85a5e2f5b8e46f5b5452e2e16687d4d508354390bb72
Opcode Fuzzy Hash: e11a84eb13b1a513b0bd2135b9420d26d5741698824d37bea6e7319b282324e9
Instruction Fuzzy Hash: DC215EB5610209AFDB10EF68EC95DA777ADEF5A3A4B140059FA049B251CB70FC62CB60

Function 002095AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0020961D

Strings

#requireadmin, xrefs: 002095D9
#OnAutoItStartRegister, xrefs: 002095F3
#notrayicon, xrefs: 002095B7

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: d8a0228825540534b3b87a4ac82c297f6254075cfcf63605a9dc56ce5c30c8a5
Instruction ID: 379c3fd5d7ad1c2a3bc3f11b278ff81640522ece0b2925356c11c5ffa4d57a41
Opcode Fuzzy Hash: d8a0228825540534b3b87a4ac82c297f6254075cfcf63605a9dc56ce5c30c8a5
Instruction Fuzzy Hash: 0A210B7212471266D331AE259C02FB7779C9F75310F544029F94B971C3EB91DDA1C295

Function 002337B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00233840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00233850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00233876

Strings

Listbox, xrefs: 0023380F

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: a656845efc735b6214166b4fa9a5e2116263c06a1a2bc33c1d5b97c8f1d80f57
Instruction ID: 5ab75f3f3284a7bea0e0b3fb0508979844a83231374fbd9df698e32dea861af8
Opcode Fuzzy Hash: a656845efc735b6214166b4fa9a5e2116263c06a1a2bc33c1d5b97c8f1d80f57
Instruction Fuzzy Hash: E321A4B2620219BBEF21CF54DC45FBB776EEF89764F118114F9049B190C671DD628BA0

Function 002149F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00214A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00214A5C
SetErrorMode.KERNEL32(00000000,?,?,0023CC08), ref: 00214AD0

Strings

%lu, xrefs: 00214A6F

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 9bf397b744a76c587b9c4f15c5ee8f8fb242be541aca1578f99ea0bea0cd814d
Instruction ID: 97cba1810d43f02f4803aa35cdb35929f561aecdb40fd7de82599b0cc64c0c7a
Opcode Fuzzy Hash: 9bf397b744a76c587b9c4f15c5ee8f8fb242be541aca1578f99ea0bea0cd814d
Instruction Fuzzy Hash: E5318575A00109AFD710DF54C885EAE7BF8EF09314F1480A5F909DB252D771EE85CBA1

Function 002341EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 0023424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00234264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00234271

Strings

msctls_trackbar32, xrefs: 00234226

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: c16510d7954907c2587c481b1bc56d32c92e6c72f0d4f3ac53babf9feafae003
Instruction ID: 3af2585345038cb33d6d55e99a772ef0420a2d1d15ab54e2b2cdf59974c6ddf8
Opcode Fuzzy Hash: c16510d7954907c2587c481b1bc56d32c92e6c72f0d4f3ac53babf9feafae003
Instruction Fuzzy Hash: 35110671250208BFEF206F29DC06FAB3BACEF95B64F110114FA55E60A0D271EC619B10

Function 00202F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001A6B57: _wcslen.LIBCMT ref: 001A6B6A

Part of subcall function 00202DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00202DC5
Part of subcall function 00202DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00202DD6
Part of subcall function 00202DA7: GetCurrentThreadId.KERNEL32 ref: 00202DDD
Part of subcall function 00202DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00202DE4

GetFocus.USER32 ref: 00202F78

Part of subcall function 00202DEE: GetParent.USER32(00000000), ref: 00202DF9

GetClassNameW.USER32(?,?,00000100), ref: 00202FC3
EnumChildWindows.USER32(?,0020303B), ref: 00202FEB

Strings

%s%d, xrefs: 00202FFF

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: 906196ec9809599bce58068a9778a1ab0c258e9ec5a53f8b3f0a46ae2d2ccf01
Instruction ID: 4aa91fb1dc6986570c4fe1a11476a5c2d23643529415fd2364766405e352463c
Opcode Fuzzy Hash: 906196ec9809599bce58068a9778a1ab0c258e9ec5a53f8b3f0a46ae2d2ccf01
Instruction Fuzzy Hash: 9311AC75310305ABCF01AF709C8AAEE776EAF95304F044076B909AB293DE3099598F60

Function 00235882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 002358C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 002358EE
DrawMenuBar.USER32(?), ref: 002358FD

Strings

0, xrefs: 0023588F

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: ec73afe1df62f4a5e8b1a0ec05b6f0c5a484dc8a8930d7d48263667a98fa3ff2
Instruction ID: 9670b6c3a7547d83664262eb942b4f123fdb91a02ead97c743245b68d5d6af78
Opcode Fuzzy Hash: ec73afe1df62f4a5e8b1a0ec05b6f0c5a484dc8a8930d7d48263667a98fa3ff2
Instruction Fuzzy Hash: CB018071510228EFDB219F11EC48BEEBBB4FF45360F108099E849E6151DB708AA4DF71

Function 0020007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee47a7223f7242acab3c207dd4d725205048fb0b64ba0a8ec5a3d60994128991
Instruction ID: b122dfdb9dd883f7dbf97817f647dd40b7f4b45a18270de495e9534f3a6df8dd
Opcode Fuzzy Hash: ee47a7223f7242acab3c207dd4d725205048fb0b64ba0a8ec5a3d60994128991
Instruction Fuzzy Hash: E2C13A75A1020AAFEB15CF94C894BAEB7B5FF48304F108598E905EB292D771EE51CB90

Function 0022342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00223459
CoUninitialize.OLE32 ref: 00223463
VariantInit.OLEAUT32(?), ref: 0022346E
VariantClear.OLEAUT32(?), ref: 0022371B

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: 42e9f0508a1426714bf2908168557ede8799bc7b42c596fac68a388a1c5c8a52
Instruction ID: 7a40a2aa8098fd9c885b13a09e3b7e442768a656fc2030af13aa7c0821c9af23
Opcode Fuzzy Hash: 42e9f0508a1426714bf2908168557ede8799bc7b42c596fac68a388a1c5c8a52
Instruction Fuzzy Hash: 37A16E79614311AFC700EF64D485A2AB7E9FF8D710F048859F9899B3A2DB34EE11CB91

Function 00200436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,0023FC08,?), ref: 002005F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,0023FC08,?), ref: 00200608
CLSIDFromProgID.OLE32(?,?,00000000,0023CC40,000000FF,?,00000000,00000800,00000000,?,0023FC08,?), ref: 0020062D
_memcmp.LIBVCRUNTIME ref: 0020064E

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 61a80b6f2153fe8ea83d2ea3f32809b98f2456328c277b2894d9d9e9570b22cd
Instruction ID: c251f5981bac0d8125eb91463125b0b4f0377fdeb6768a3f331aea90eb676033
Opcode Fuzzy Hash: 61a80b6f2153fe8ea83d2ea3f32809b98f2456328c277b2894d9d9e9570b22cd
Instruction Fuzzy Hash: 61815E71A10209EFDB04DF94C984EEEB7B9FF89315F204558F506AB291DB71AE06CB60

Function 001E1391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 001E14C0

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: c09de11e8124a13d428087d4a9bc8f4e6d90dbfaa024a46025036f223890e231
Instruction ID: b9775a532993c5e3205257989f2523f9d33b769643944b84fdfea71b7ecc2bfe
Opcode Fuzzy Hash: c09de11e8124a13d428087d4a9bc8f4e6d90dbfaa024a46025036f223890e231
Instruction Fuzzy Hash: BA412C31600950BBDB256BBA9C45BBE3AE5FF62370F14426AF419D73D2E734C8419262

Function 00236278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 002362E2
ScreenToClient.USER32(?,?), ref: 00236315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00236382

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 742403977fb830239ea8a50da144099ce0a9a3faf7d41598596468d8f2386792
Instruction ID: 71b7d1c6f7ffe9d29371d67d52f21222c0ebc7b39963875639a3c514bf421f33
Opcode Fuzzy Hash: 742403977fb830239ea8a50da144099ce0a9a3faf7d41598596468d8f2386792
Instruction Fuzzy Hash: 83515EB591020AEFCF14DF58D8889AE7BB9FF45760F208199F9159B2A0D730EDA1CB50

Function 00221AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00221AFD
WSAGetLastError.WSOCK32 ref: 00221B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00221B8A
WSAGetLastError.WSOCK32 ref: 00221B94

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 6bd89c5807ba4524797fe576f4dab895f8d875a85c561b84f87d0fce5fcb409c
Instruction ID: 72f1ad3779f16b074697374d8b200683aa3d574ff16285249cc6dcb077edf730
Opcode Fuzzy Hash: 6bd89c5807ba4524797fe576f4dab895f8d875a85c561b84f87d0fce5fcb409c
Instruction Fuzzy Hash: 3E41D278600210AFE720AF24D88AF2A77E5AF55718F54844CF91A9F3D3D772DD528B90

Function 001DB41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15c3f4a1256e993749b977aa1a9bc9ec742168c1776e2a8a99c4f5bb0e2945a0
Instruction ID: 0ad52fc19a0296e5c69dd9eeb33007ce18aa139a8c35994efc585dbd3ef8fa38
Opcode Fuzzy Hash: 15c3f4a1256e993749b977aa1a9bc9ec742168c1776e2a8a99c4f5bb0e2945a0
Instruction Fuzzy Hash: 0041CF72A04644EFD724DF38C881BAEBBA9EB98710F11452FF1539B382D771A9018790

Function 002156D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00215783
GetLastError.KERNEL32(?,00000000), ref: 002157A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 002157CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 002157FA

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 857999db2367a655500c04a3220469400c1618ce13abcfa46718d8c4f477b450
Instruction ID: 26aeccb0b5d98175bd8476d22701b6f86c09771d8f154f0844231a31d90c9b37
Opcode Fuzzy Hash: 857999db2367a655500c04a3220469400c1618ce13abcfa46718d8c4f477b450
Instruction Fuzzy Hash: 86411D39610611DFCB11EF15D585A5EBBE2EF99320F198488EC4A6B3A2CB34FD41CB91

Function 001DD8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,8BE85006,001C6D71,00000000,00000000,001C82D9,?,001C82D9,?,00000001,001C6D71,8BE85006,00000001,001C82D9,001C82D9), ref: 001DD910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 001DD999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 001DD9AB
__freea.LIBCMT ref: 001DD9B4

Part of subcall function 001D3820: RtlAllocateHeap.NTDLL(00000000,?,00271444,?,001BFDF5,?,?,001AA976,00000010,00271440,001A13FC,?,001A13C6,?,001A1129), ref: 001D3852

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 7cc8a86d24050cfc92397f74b71aec9f5d3bd46ae4eb8ee56bb8aa28a24b61eb
Instruction ID: 36ef060dda2c80659e57cf0cd67c7eda17f017efa01ad57bd41b739a89009cd1
Opcode Fuzzy Hash: 7cc8a86d24050cfc92397f74b71aec9f5d3bd46ae4eb8ee56bb8aa28a24b61eb
Instruction Fuzzy Hash: B031F272A0020AABDF29DF64EC95EAE7BA5EF40314F164169FC04D7250EB36DD50CB90

Function 002352C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00235352
GetWindowLongW.USER32(?,000000F0), ref: 00235375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00235382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 002353A8

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: 24a7ad400c8b6741cee4633d8d81a38ade6b9dbca81bb6c4ebc7dcfc5faa5909
Instruction ID: 9b6306779df70f8dd2cef41f5853a4338c8bc762c390593b0b2d9f72c10e71f7
Opcode Fuzzy Hash: 24a7ad400c8b6741cee4633d8d81a38ade6b9dbca81bb6c4ebc7dcfc5faa5909
Instruction Fuzzy Hash: AF31C5B4A75A29EFEB349F14CC0AFE83765EB04390F584181FA18961E1C7F49DA0DB42

Function 0020AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75A4C0D0,?,00008000), ref: 0020ABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 0020AC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 0020AC74
SendInput.USER32(00000001,?,0000001C,75A4C0D0,?,00008000), ref: 0020ACC6

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 39d10935f206d1d5635e338387c3c8b5c67e3bd2102e5b0b620e54fa3cece55c
Instruction ID: e2e61b4be66ce74adf1fcd1f7116ad5efd8200e46959aab9a1265462491bcd6f
Opcode Fuzzy Hash: 39d10935f206d1d5635e338387c3c8b5c67e3bd2102e5b0b620e54fa3cece55c
Instruction Fuzzy Hash: 71312630A24719AFFF35CF648C097FE7BA5AB89310F85431BE485961D2C37489A18B52

Function 00237674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0023769A
GetWindowRect.USER32(?,?), ref: 00237710
PtInRect.USER32(?,?,00238B89), ref: 00237720
MessageBeep.USER32(00000000), ref: 0023778C

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 9ac3c2fd2692b3153637165fc442310dfc05e458bf5e4b768ea706ed609c3384
Instruction ID: 94fe7ef6f0eaa5b83766cf3b78c08608a899c3d747d86b56cc39a5469e9f1b76
Opcode Fuzzy Hash: 9ac3c2fd2692b3153637165fc442310dfc05e458bf5e4b768ea706ed609c3384
Instruction Fuzzy Hash: 12419CF4A15215EFCF21CF58D899EA9B7F4BF49314F1440A8E5149B261C330E9A2CF90

Function 002316DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 002316EB

Part of subcall function 00203A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00203A57
Part of subcall function 00203A3D: GetCurrentThreadId.KERNEL32 ref: 00203A5E
Part of subcall function 00203A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,002025B3), ref: 00203A65

GetCaretPos.USER32(?), ref: 002316FF
ClientToScreen.USER32(00000000,?), ref: 0023174C
GetForegroundWindow.USER32 ref: 00231752

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: c1ae3a35c4886b05b52b8c542683306db877fdddb12b53a607729d44fa630326
Instruction ID: 9ff6b85bb49835769f1fce44446409e5f94e2e64166adb957cc087dfd073bf7e
Opcode Fuzzy Hash: c1ae3a35c4886b05b52b8c542683306db877fdddb12b53a607729d44fa630326
Instruction Fuzzy Hash: E83161B5E10209AFCB00EFA9C881CAEF7FDEF59304B548069E415E7251D7319E45CBA0

Function 0020D4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0020D501
Process32FirstW.KERNEL32(00000000,?), ref: 0020D50F
Process32NextW.KERNEL32(00000000,?), ref: 0020D52F
CloseHandle.KERNEL32(00000000), ref: 0020D5DC

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 85593431300e9f1db733f2604adb1f5070d7a3235e6065269ce422143ccd54d5
Instruction ID: a15d1f461ae3f1c853f0ddb245025af0232908154bf06eb2c0012bee73bf01b7
Opcode Fuzzy Hash: 85593431300e9f1db733f2604adb1f5070d7a3235e6065269ce422143ccd54d5
Instruction Fuzzy Hash: D631C2710083019FD301EF64DC85AAFBBF8EFAA354F54092DF585961A2EB719944CB92

Function 00238FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 001B9BB2

GetCursorPos.USER32(?), ref: 00239001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,001F7711,?,?,?,?,?), ref: 00239016
GetCursorPos.USER32(?), ref: 0023905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,001F7711,?,?,?), ref: 00239094

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 8234e675be480c68ad74b247f72b6f3809784de36023d17b22793cef4588dc46
Instruction ID: 3c06c5f7824eadbe2ccfecaee6761af5b5aea62fa7f23dbd25a3819e1baadbf5
Opcode Fuzzy Hash: 8234e675be480c68ad74b247f72b6f3809784de36023d17b22793cef4588dc46
Instruction Fuzzy Hash: 3D21E275610118EFDB298F98DC58EFA3BB9EF8A350F104065F90557261C3719DA1DF60

Function 0020D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,0023CB68), ref: 0020D2FB
GetLastError.KERNEL32 ref: 0020D30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 0020D319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0023CB68), ref: 0020D376

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 63f0549ce63736c6cd422d87afa89d9b57c5b6e45cd9cbd753edb3b5f80f641a
Instruction ID: 178b8dfb626e7386ece19bb1690097ca33e358459effca8d9f703aafb064a3d5
Opcode Fuzzy Hash: 63f0549ce63736c6cd422d87afa89d9b57c5b6e45cd9cbd753edb3b5f80f641a
Instruction Fuzzy Hash: 8121BF7451A3029FC300DFA8D88186AB7E4AE56364F204A5DF899D72E2D730D956CF93

Function 00201571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00201014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0020102A
Part of subcall function 00201014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00201036
Part of subcall function 00201014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00201045
Part of subcall function 00201014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0020104C
Part of subcall function 00201014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00201062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 002015BE
_memcmp.LIBVCRUNTIME ref: 002015E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00201617
HeapFree.KERNEL32(00000000), ref: 0020161E

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 9f02cf79353054e084f5f09e0f308327dde137b439e3276a005df4806af83ca0
Instruction ID: 0d52308b8c6ba4720dad725c939db3ac5ba9266581798614808d0f6ddfced2ec
Opcode Fuzzy Hash: 9f02cf79353054e084f5f09e0f308327dde137b439e3276a005df4806af83ca0
Instruction Fuzzy Hash: 1D21CF31E10209EFDF04DFA4CD48BEEB7B8EF40344F184459E441AB282E731AA64DBA0

Function 00232782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 0023280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00232824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00232832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00232840

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: b68c624c183b3ac72ffcc43d0d9bad75ae48e090bffbbc2c9126ccac46892985
Instruction ID: 5a0b1e5b54779b1ab6a1b1afc88f48e0fa987e26ddb4ee19cb698d53511fc921
Opcode Fuzzy Hash: b68c624c183b3ac72ffcc43d0d9bad75ae48e090bffbbc2c9126ccac46892985
Instruction Fuzzy Hash: F921F135218111EFD7149F24D844FAABB99EF85324F248158F4268B2E2CB71FC56CB90

Function 002078F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00208D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,0020790A,?,000000FF,?,00208754,00000000,?,0000001C,?,?), ref: 00208D8C
Part of subcall function 00208D7D: lstrcpyW.KERNEL32(00000000,?,?,0020790A,?,000000FF,?,00208754,00000000,?,0000001C,?,?,00000000), ref: 00208DB2
Part of subcall function 00208D7D: lstrcmpiW.KERNEL32(00000000,?,0020790A,?,000000FF,?,00208754,00000000,?,0000001C,?,?), ref: 00208DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00208754,00000000,?,0000001C,?,?,00000000), ref: 00207923
lstrcpyW.KERNEL32(00000000,?,?,00208754,00000000,?,0000001C,?,?,00000000), ref: 00207949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00208754,00000000,?,0000001C,?,?,00000000), ref: 00207984

Strings

cdecl, xrefs: 0020797B

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 447ccdb6463a40abd9ee4110d01013a6a00c9b7dc804d4f3c3ba710178db96ac
Instruction ID: 5572d93e1d54f9924277575d462bdc7e3f3e1ebc3481070188897ded137f1142
Opcode Fuzzy Hash: 447ccdb6463a40abd9ee4110d01013a6a00c9b7dc804d4f3c3ba710178db96ac
Instruction Fuzzy Hash: D011263A210346ABCB159F38DC49D7B77A9FF85350B10402AF846C72A5EB31E821D7A1

Function 00237CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00237D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00237D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00237D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0021B7AD,00000000), ref: 00237D6B

Part of subcall function 001B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 001B9BB2

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 414243a102f3acd9a689809acd440681a9d1e15cce2a7870cf69751bac485aa5
Instruction ID: bd914bbe258b8f2ce36fe857d2e0a4d0e3a6130eee9f9d55b1677c85dcfea933
Opcode Fuzzy Hash: 414243a102f3acd9a689809acd440681a9d1e15cce2a7870cf69751bac485aa5
Instruction Fuzzy Hash: 8211D2B1224659AFCF209F28DC08EA63BA4AF45361F218724F939D72F0D7308971DB40

Function 00235660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 002356BB
_wcslen.LIBCMT ref: 002356CD
_wcslen.LIBCMT ref: 002356D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00235816

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: a9f3cc2e8c606e75df4b42cbb4e4afb1decbc8d0320acfa629e4aeb2bbd170b2
Instruction ID: cf728a5199ecb65c68ecf7a1380d3670676de3f5405e0e35d27b340e0714b5b2
Opcode Fuzzy Hash: a9f3cc2e8c606e75df4b42cbb4e4afb1decbc8d0320acfa629e4aeb2bbd170b2
Instruction Fuzzy Hash: 9E1106B162062596DF20DF65DC85AEE77BCFF15764F10402AF909D6081E7B0CAA0CF60

Function 001D1D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ca198a0b55bac97a11c2405f258573c62f6786046470bebd759a191049948d4
Instruction ID: 37db8c0d2eb59fa95e6f912c15d6ba514b948b1fc484fa7a2557e30560b1d5a4
Opcode Fuzzy Hash: 8ca198a0b55bac97a11c2405f258573c62f6786046470bebd759a191049948d4
Instruction Fuzzy Hash: E8016DB2209A567EFA2126B87CC9F67661EDF517B8B350327F536A13D2DB708C409170

Function 00201A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00201A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00201A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00201A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00201A8A

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5af8b672318b9da5b9a488745000a29c3439099c75700ca603b2c3bcb01ad90d
Instruction ID: 22a0d43d6f9f29da9a49029a86d926715ebe83f278fa958701178722b64e781c
Opcode Fuzzy Hash: 5af8b672318b9da5b9a488745000a29c3439099c75700ca603b2c3bcb01ad90d
Instruction Fuzzy Hash: 3511F73AA01219FFEB119BA5CD85FADBB78EB08750F200091EA04B7295D6716E60DB94

Function 0020E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0020E1FD
MessageBoxW.USER32(?,?,?,?), ref: 0020E230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 0020E246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0020E24D

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 2aa766b199b5485c2b48aaa4b1370d90f89ff4763ff8195da6a797ce5bfd5bb8
Instruction ID: c6bbcdd37024315def9afd3b0e24a7292894fdafb2b651424d4476b2a3da1ff3
Opcode Fuzzy Hash: 2aa766b199b5485c2b48aaa4b1370d90f89ff4763ff8195da6a797ce5bfd5bb8
Instruction Fuzzy Hash: 7611E172904314BFCB019FA8BC0DA9A7BACAB45324F104669FC28E3291D2B0CD6087A0

Function 001CD1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,001CCFF9,00000000,00000004,00000000), ref: 001CD218
GetLastError.KERNEL32 ref: 001CD224
__dosmaperr.LIBCMT ref: 001CD22B
ResumeThread.KERNEL32(00000000), ref: 001CD249

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 7600a6a4cb4779b8973521acb7ff1bfe657f9926968587643de42bb0ef6e586d
Instruction ID: 665b86a62571d2d0fd1923c2ba986f61cf1de3218df20ad771107189fcd8ec01
Opcode Fuzzy Hash: 7600a6a4cb4779b8973521acb7ff1bfe657f9926968587643de42bb0ef6e586d
Instruction Fuzzy Hash: 6001D276805204BBCB216BA5EC09FAE7A6DDFB1730F20026DF925921D0CF70C901D7A0

Function 001A600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 001A604C
GetStockObject.GDI32(00000011), ref: 001A6060
SendMessageW.USER32(00000000,00000030,00000000), ref: 001A606A

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 3ee0f847bbc1e9d51586a75a10c372e231211d51d448149c7479ad290ab64b01
Instruction ID: 3037f904e9d79aad46ca5210dce4db11595f3d722140c48678b7624457ed8606
Opcode Fuzzy Hash: 3ee0f847bbc1e9d51586a75a10c372e231211d51d448149c7479ad290ab64b01
Instruction Fuzzy Hash: C011AD72101908BFEF164FA49D48EEABB6DEF093A4F190201FA1462010C736DCA0EBA0

Function 001C3B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 001C3B56

Part of subcall function 001C3AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 001C3AD2
Part of subcall function 001C3AA3: ___AdjustPointer.LIBCMT ref: 001C3AED

_UnwindNestedFrames.LIBCMT ref: 001C3B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 001C3B7C
CallCatchBlock.LIBVCRUNTIME ref: 001C3BA4

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: 53f51f5c647c4a1ab081e3aa64f3998eb5cf9d67e4624089086b76bb4c417f70
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: 6601E932100149BBDF125E95CC46FEB7B7DEF68754F048018FE5896121C732E961EBA0

Function 001D3073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,001A13C6,00000000,00000000,?,001D301A,001A13C6,00000000,00000000,00000000,?,001D328B,00000006,FlsSetValue), ref: 001D30A5
GetLastError.KERNEL32(?,001D301A,001A13C6,00000000,00000000,00000000,?,001D328B,00000006,FlsSetValue,00242290,FlsSetValue,00000000,00000364,?,001D2E46), ref: 001D30B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,001D301A,001A13C6,00000000,00000000,00000000,?,001D328B,00000006,FlsSetValue,00242290,FlsSetValue,00000000), ref: 001D30BF

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 06250be129061a07569bd8e629003f76a54bd4d234d0bdb4b9a80fcbc586dad9
Instruction ID: 8211aeb3be4b16f641c1052034947436bab78968f6521bc88b39e6779a449194
Opcode Fuzzy Hash: 06250be129061a07569bd8e629003f76a54bd4d234d0bdb4b9a80fcbc586dad9
Instruction Fuzzy Hash: F601DB36741322ABCB314B79BC8C9577B98AF45B61B250621FD26F7340D721D941C7E1

Function 00207464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 0020747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00207497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 002074AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 002074CA

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: cab25654a7accf98233c5fda481053d2f01d58be4418570a2bf36bb35e1ba9d2
Instruction ID: b66808df0d12f1390c20c2a242afda6458ffb18ea4dfaf920e27ed93bbaec051
Opcode Fuzzy Hash: cab25654a7accf98233c5fda481053d2f01d58be4418570a2bf36bb35e1ba9d2
Instruction Fuzzy Hash: A5116DB5A25315ABF7208F14EC09B937BFCEB00B04F208569A656E6192D7B0F914DB60

Function 0020B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0020ACD3,?,00008000), ref: 0020B0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0020ACD3,?,00008000), ref: 0020B0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,0020ACD3,?,00008000), ref: 0020B0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,0020ACD3,?,00008000), ref: 0020B126

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: a7b8d0006c810e25affcc26e2db2cc909ff0d42894b47bc84c210a5c3ea6fe2c
Instruction ID: f21fec7c78ff7dc5995c0c10d69ee9e6af385393014b4937e459f5f7641f5092
Opcode Fuzzy Hash: a7b8d0006c810e25affcc26e2db2cc909ff0d42894b47bc84c210a5c3ea6fe2c
Instruction Fuzzy Hash: AE116D31C2162DE7CF21AFE4E958AEEFB78FF09711F104095D985B2182CB7056609B91

Function 00237E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00237E33
ScreenToClient.USER32(?,?), ref: 00237E4B
ScreenToClient.USER32(?,?), ref: 00237E6F
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00237E8A

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: ca7b92730c8a2b1e8c9d952662303caebdddb271f5dcf55683efcc6ef06934ef
Instruction ID: fe5c11eaed574f91ed43e1acaf11a74eaac78be1a102eb37b73cfac271af8cbc
Opcode Fuzzy Hash: ca7b92730c8a2b1e8c9d952662303caebdddb271f5dcf55683efcc6ef06934ef
Instruction Fuzzy Hash: 041143B9D0020AAFDB51DF98D8849EEBBF9FB08310F505056E915E2210D735AA64CF50

Function 00202DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00202DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00202DD6
GetCurrentThreadId.KERNEL32 ref: 00202DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00202DE4

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: c22826b627b033787347ae3e30f9f7bfebb2ca0eeeb0e36837b79b7643f646eb
Instruction ID: 9ac2390e176f80dad295265fa1b0c63c865978cb9272bb41adc7d5df8774ccf7
Opcode Fuzzy Hash: c22826b627b033787347ae3e30f9f7bfebb2ca0eeeb0e36837b79b7643f646eb
Instruction Fuzzy Hash: 95E09271111324BBDB202F72AC0EFEB3E6CEF83BA1F100016F105E10819AA0C844CBB0

Function 00238863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 001B9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 001B9693
Part of subcall function 001B9639: SelectObject.GDI32(?,00000000), ref: 001B96A2
Part of subcall function 001B9639: BeginPath.GDI32(?), ref: 001B96B9
Part of subcall function 001B9639: SelectObject.GDI32(?,00000000), ref: 001B96E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00238887
LineTo.GDI32(?,?,?), ref: 00238894
EndPath.GDI32(?), ref: 002388A4
StrokePath.GDI32(?), ref: 002388B2

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 08b78f28874c17f7bf368e277cbe902dc9ae83c9c7b7c7d54312e37f00518d31
Instruction ID: 418e12f07b903b1f7d0d938f9577591b741142db7aefe42415eb8d479126e8f6
Opcode Fuzzy Hash: 08b78f28874c17f7bf368e277cbe902dc9ae83c9c7b7c7d54312e37f00518d31
Instruction Fuzzy Hash: 44F03A36055699FADB125F98AC0DFCA3B69AF06710F148000FB12750E2C7755562DBA5

Function 001B98B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 001B98CC
SetTextColor.GDI32(?,?), ref: 001B98D6
SetBkMode.GDI32(?,00000001), ref: 001B98E9
GetStockObject.GDI32(00000005), ref: 001B98F1

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: e5a94974029ad726918ef27b250e38f6dcf436c00b4312fcbf9df14fb15d1e83
Instruction ID: 0e8d50e406c5d4b13272c94900c171f46051e71a575f8c5052682ca0ac862ad4
Opcode Fuzzy Hash: e5a94974029ad726918ef27b250e38f6dcf436c00b4312fcbf9df14fb15d1e83
Instruction Fuzzy Hash: A9E06531244244AADF215B74BC0DBE83F10AB11335F148219F7F9640E1C37146419F10

Function 0020162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00201634
OpenThreadToken.ADVAPI32(00000000,?,?,?,002011D9), ref: 0020163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,002011D9), ref: 00201648
OpenProcessToken.ADVAPI32(00000000,?,?,?,002011D9), ref: 0020164F

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 3b31d8b2ac6644b43f544bda15ad6556a306e0eb211a0e779f79683f342ad558
Instruction ID: f0b0f4540e2284a212ec361aec6a6df35762fef0fc4df28e36beabd1b8eb4b38
Opcode Fuzzy Hash: 3b31d8b2ac6644b43f544bda15ad6556a306e0eb211a0e779f79683f342ad558
Instruction Fuzzy Hash: 68E08C32602312EBD7202FA0BE0DB873B7CAF44792F248808F745E9080E7348454CB60

Function 001FD858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 001FD858
GetDC.USER32(00000000), ref: 001FD862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 001FD882
ReleaseDC.USER32(?), ref: 001FD8A3

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: cb8fd5c56c2c142d277ca696be2eaf44290aa5ae206666f1f647b58683399098
Instruction ID: 156b5b5f25c00900ca3bd064470d244a6a5f3bcae617950a55d815b01e427bda
Opcode Fuzzy Hash: cb8fd5c56c2c142d277ca696be2eaf44290aa5ae206666f1f647b58683399098
Instruction Fuzzy Hash: 16E012B5800204EFCB45AFA0E80DA6DBBBAFB48310F218009F956F7260CB398901AF40

Function 001FD86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 001FD86C
GetDC.USER32(00000000), ref: 001FD876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 001FD882
ReleaseDC.USER32(?), ref: 001FD8A3

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: f334cc184a7e9e7766dfad707e5ab2f34b8c21d6d1cb87edcd24a0568b5ef906
Instruction ID: 96e24f596903e389fad2fbb782586d3b99fc44082606cc36678e331ea1ba8483
Opcode Fuzzy Hash: f334cc184a7e9e7766dfad707e5ab2f34b8c21d6d1cb87edcd24a0568b5ef906
Instruction Fuzzy Hash: 17E012B5800200EFCB44AFA0E80D66DBBB9BB48310F208009F95AF7260CB389901AF40

Function 00214D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 001A7620: _wcslen.LIBCMT ref: 001A7625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00214ED4

Strings

LPT, xrefs: 00214DFB
*, xrefs: 00214E10

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: a921a51026400a94e56f69b1a894de2aa9ec2f555c1b0bf2af2ee6e64fae2318
Instruction ID: 5178a37a77c354cd9932f94864ec6520456e31ae5877dda66500bcf1dd627953
Opcode Fuzzy Hash: a921a51026400a94e56f69b1a894de2aa9ec2f555c1b0bf2af2ee6e64fae2318
Instruction Fuzzy Hash: 08918375A102059FCB14EF58C484EE9BBF1BF59304F198099E40A9F7A2C771EE96CB90

Function 001CE27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 001CE30D

Strings

pow, xrefs: 001CE2E5, 001CE302

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: aa66bd10f75608c2a2c7cc4d47e2c795c8b7ec4b96a194222a381f080903eccb
Instruction ID: 9c9a9b71136e7c10f9856e7d2d0bd99d2fc7f0e86ad445112a140b01507f1b19
Opcode Fuzzy Hash: aa66bd10f75608c2a2c7cc4d47e2c795c8b7ec4b96a194222a381f080903eccb
Instruction Fuzzy Hash: 98515B61A0C60296CB157718D905B7E3BE4AF60740F704D9EF0D6823E9FB34CC959A46

Function 00227771 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(001F569E,00000000,?,0023CC08,?,00000000,00000000), ref: 002278DD

Part of subcall function 001A6B57: _wcslen.LIBCMT ref: 001A6B6A

CharUpperBuffW.USER32(001F569E,00000000,?,0023CC08,00000000,?,00000000,00000000), ref: 0022783B

Strings

<s&, xrefs: 002277C8

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: BuffCharUpper$_wcslen
String ID: <s&
API String ID: 3544283678-70216238
Opcode ID: b71f5df9d4e33f7a9eb54b540f84e9228cdc7ffa8a80635427c969296f5ef637
Instruction ID: 3100df62cacdd060b23e71c85485ccb5c1972ec85e82235127ca22e741debe54
Opcode Fuzzy Hash: b71f5df9d4e33f7a9eb54b540f84e9228cdc7ffa8a80635427c969296f5ef637
Instruction Fuzzy Hash: 23616C3A928229ABCF04EFE4EC91DFDB378BF25300B444125F542A7091EF745A59DBA0

Function 001BE187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 001BE1B1

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 7c4adbff086ed8e7abb0c6354a301f250788623e45ae7a301f9c86912f0ec506
Instruction ID: 1673effe38fa71506ebe88024a08d0b11f6e5ab8eff0f42f89af94672708b3cc
Opcode Fuzzy Hash: 7c4adbff086ed8e7abb0c6354a301f250788623e45ae7a301f9c86912f0ec506
Instruction Fuzzy Hash: 5951373950424ADFDB19EF68C481AFA7BE4EF65310F2441A5FD519B2E0D7349D42CB90

Function 001BF291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 001BF2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 001BF2BB

Strings

@, xrefs: 001BF2AF

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 6c902aea5269dab2d88c5f0b4a981f0e37db0c1dcd16728d4b73e26c85044fe5
Instruction ID: c429563eeb7118e5e4856ab64c79053606283e308d1294a211e0ea5ba3f81d4e
Opcode Fuzzy Hash: 6c902aea5269dab2d88c5f0b4a981f0e37db0c1dcd16728d4b73e26c85044fe5
Instruction Fuzzy Hash: E75135714087449FD320AF14EC86BABBBF8FF96300F81885DF1D9411A5EB708529CB66

Function 00225745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 002257E0
_wcslen.LIBCMT ref: 002257EC

Strings

CALLARGARRAY, xrefs: 002257E6, 002257EB

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: b27b3f04a57288d6d6eb02aa2c596979dbe921c6de743415dfce042e475aee4b
Instruction ID: 1f8f0deaf5c8de54a3be5cf00f989ee39d3c64694e97d768848ef11794fc3bd6
Opcode Fuzzy Hash: b27b3f04a57288d6d6eb02aa2c596979dbe921c6de743415dfce042e475aee4b
Instruction Fuzzy Hash: FD41B035E10229AFCB04DFA8D8858FEBBB5FF59320F108029E505AB291D7B49D91CB91

Function 0021D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0021D130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 0021D13A

Strings

|, xrefs: 0021D10B

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: 1fdc9b224ae7cdd0dcfc38d0ec8bc9a4ce6ed6d4e4936f20f443f32605fac7f0
Instruction ID: bfa06acd0e91e9ed6a18baca2103c8ad95e7a1442d2b4990714258d31b78d7e5
Opcode Fuzzy Hash: 1fdc9b224ae7cdd0dcfc38d0ec8bc9a4ce6ed6d4e4936f20f443f32605fac7f0
Instruction Fuzzy Hash: 0A314C75D10219EBCF15EFA4CC85AEEBFB9FF29300F100019F819A6162D735AA56CB50

Function 0023356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00233621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 0023365C

Strings

static, xrefs: 002335BC

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: ad4bdf50c697786419a8238a9dbc685bfe18aea20134b22755aa924dab29cbc5
Instruction ID: 12f395a417854d746ccfde389588b29ea991611a90c9d34b30a71ef38ef0c829
Opcode Fuzzy Hash: ad4bdf50c697786419a8238a9dbc685bfe18aea20134b22755aa924dab29cbc5
Instruction Fuzzy Hash: 9E318EB1120205AEDB10DF28DC41ABB73ADFF98724F109619F8A5D7290DB30ADA18B64

Function 00234537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 0023461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00234634

Strings

', xrefs: 0023458E

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 1d80595bd30c3c24395bb61cf55619b5871efb47fa3bc6847332264fea9bd199
Instruction ID: 64888165e32bc2f050894fbf068bedc4ec9221b864d319483a28f5c631f9c875
Opcode Fuzzy Hash: 1d80595bd30c3c24395bb61cf55619b5871efb47fa3bc6847332264fea9bd199
Instruction Fuzzy Hash: F63138B4E1030A9FDB14DFA9C981BDABBB9FF59300F5040AAE904AB341D770A951CF90

Function 002331EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0023327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00233287

Strings

Combobox, xrefs: 00233249

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 5ff997331d28ac886688c7f996de1ee7dead792fd06bd73227fa119678988a03
Instruction ID: 807f6fb7cb1ae7a927cebec230b8950a5efa76527baea2924913848bf55b844d
Opcode Fuzzy Hash: 5ff997331d28ac886688c7f996de1ee7dead792fd06bd73227fa119678988a03
Instruction Fuzzy Hash: 8711B2B13202097FFF25DE54DC85EBB376AEB94364F104228F9189B290D6719E718B60

Function 00233710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 001A600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 001A604C
Part of subcall function 001A600E: GetStockObject.GDI32(00000011), ref: 001A6060
Part of subcall function 001A600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 001A606A

GetWindowRect.USER32(00000000,?), ref: 0023377A
GetSysColor.USER32(00000012), ref: 00233794

Strings

static, xrefs: 00233757

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 7b50135d18279086594535a3e0d22aa6ebf7a9b07c85080dd945e1d2750efd54
Instruction ID: e8e651532ede15b6ef5a6f9fd98d0492bc63405daebcf37b47dc237d711e8b06
Opcode Fuzzy Hash: 7b50135d18279086594535a3e0d22aa6ebf7a9b07c85080dd945e1d2750efd54
Instruction Fuzzy Hash: EA113AB262020AAFDF00DFA8DC46EFA7BB8FF09314F104514F955E2250D775E9619B50

Function 0021CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0021CD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 0021CDA6

Strings

<local>, xrefs: 0021CD66

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 419964214cca7cc8eb0d44180b33283ba7450acfd807e380b24efec326753819
Instruction ID: 0a1f0be4c2d6efaf88c2e6b8f511582b39f59573db82ce67ca891c4ad424f5ae
Opcode Fuzzy Hash: 419964214cca7cc8eb0d44180b33283ba7450acfd807e380b24efec326753819
Instruction Fuzzy Hash: 8111CA7516563279D7384F66AC49FE7BEECEF227A4F204235B50993080D7709890D6F0

Function 00233429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 002334AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 002334BA

Strings

edit, xrefs: 0023348F

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: f5707817ccaa30c72e2426d0990cfdc1980fc05bd5d984abb88edfc2efb5d5f5
Instruction ID: 9d6f025a3bb4cc097cb52cdb551887db22510e3a2d4382fd55bd926b8fdde32b
Opcode Fuzzy Hash: f5707817ccaa30c72e2426d0990cfdc1980fc05bd5d984abb88edfc2efb5d5f5
Instruction Fuzzy Hash: F71191B1120209AFEB118F64EC44AFB376AEF15374F604324FA65A71E0C771DEA19B50

Function 00206C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

CharUpperBuffW.USER32(?,?,?), ref: 00206CB6
_wcslen.LIBCMT ref: 00206CC2

Strings

STOP, xrefs: 00206CBC, 00206CC1

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: 8155c000be7bc40b7705ffc1c6dd2fa5431edaea183cffe7d0700077df093ecc
Instruction ID: 2e3ce15223835c5be5c5db297210d0eeb5c9fe175b16fd30df9a227d769e9ab1
Opcode Fuzzy Hash: 8155c000be7bc40b7705ffc1c6dd2fa5431edaea183cffe7d0700077df093ecc
Instruction Fuzzy Hash: 510104326206278BDB209FFDDC889BF33A4EA617107100529E852961D2EB31D870C650

Function 00201CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

Part of subcall function 00203CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00203CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00201D4C

Strings

ListBox, xrefs: 00201D16
ComboBox, xrefs: 00201CEB

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 21fef93d1f29e4b90c03cb31dd42be833766bf1a55993cf271289e79860002af
Instruction ID: f91b6fc2f7550856c47bfb4c5ec676d2533603855cf9eec8e55990b443eae72a
Opcode Fuzzy Hash: 21fef93d1f29e4b90c03cb31dd42be833766bf1a55993cf271289e79860002af
Instruction Fuzzy Hash: F001D875621329ABCB08EFA4CC55CFE7368FF57350B14051AF822672C2EB3059688760

Function 00201BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

Part of subcall function 00203CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00203CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00201C46

Strings

ListBox, xrefs: 00201C10
ComboBox, xrefs: 00201BE5

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: c4150c1af721725465aec94248da7b69316cd06c307e2dab313a3cd501bd56fc
Instruction ID: 8e89773cd7d317824a281c3243ccdc425dda57fb63e459c295689bfe0d586615
Opcode Fuzzy Hash: c4150c1af721725465aec94248da7b69316cd06c307e2dab313a3cd501bd56fc
Instruction Fuzzy Hash: CC01A7756A121967DB08EB90D9529FF77AC9F22340F14001AF406772C2EA64DEB896B2

Function 00201C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

Part of subcall function 00203CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00203CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00201CC8

Strings

ListBox, xrefs: 00201C94
ComboBox, xrefs: 00201C69

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 9110c3794641a2b593b9df72c90b2cf2f63beb94258e6ceccb29eaeda5679add
Instruction ID: 50a91dd1b3b45f13681fa6655aa8e3ad4cd60b728dccacba857aab9c1dd3a7e8
Opcode Fuzzy Hash: 9110c3794641a2b593b9df72c90b2cf2f63beb94258e6ceccb29eaeda5679add
Instruction Fuzzy Hash: FB01DB7565021967DB04EB90CA11AFE73AC9B22340F140016B801772C2EA60DF78D672

Function 00201D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001A9CB3: _wcslen.LIBCMT ref: 001A9CBD

Part of subcall function 00203CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00203CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00201DD3

Strings

ListBox, xrefs: 00201DA0
ComboBox, xrefs: 00201D75

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 51bf18270d64056dfe835a7f96a8929313a233f6aac6359643a2a1a9f39324bd
Instruction ID: b09294dd544ad7a27f52881e23eb290d6a15e8c19c9e3f9599877dad433f9f12
Opcode Fuzzy Hash: 51bf18270d64056dfe835a7f96a8929313a233f6aac6359643a2a1a9f39324bd
Instruction Fuzzy Hash: 3AF0F475A6072966DB08EBA4CC52AFE737CAB13354F040915F822A72C2DB6059288660

Function 00238172 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00273018,0027305C), ref: 002381BF
CloseHandle.KERNEL32 ref: 002381D1

Strings

\0', xrefs: 0023818A

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: \0'
API String ID: 3712363035-3769339230
Opcode ID: a9f4d4bbd627eeb484d93694e15f1b4318dca10dcdc2016d0c3cd68cc2a7b34e
Instruction ID: d91c9898265e96a89bdd38d729ad7b9ddb4f2966ea00217951a19b56aa6eb650
Opcode Fuzzy Hash: a9f4d4bbd627eeb484d93694e15f1b4318dca10dcdc2016d0c3cd68cc2a7b34e
Instruction Fuzzy Hash: C8F05EB2650310BBE320AB61BC49FB73A5CEB19750F004465FB0CE51A2D6798A50A3B9

Function 0022747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00227493
_wcslen.LIBCMT ref: 002274B9

Strings

3, 3, 16, 1, xrefs: 00227483

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: 2439d12f9c9ab53729e26bd9081cc94c477b7e2c3c6b676de7f19d616e912a1f
Instruction ID: cfe944c3541b4ce902293f1c64e3f187dac53fd55388b427ab9ebe28aa3530c5
Opcode Fuzzy Hash: 2439d12f9c9ab53729e26bd9081cc94c477b7e2c3c6b676de7f19d616e912a1f
Instruction Fuzzy Hash: 7CE02B0662C23171923136B9BCC1EBF5699DFEA754710182FF981C2266EBA4CDB1D3A0

Function 00200B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00200B23

Strings

Error allocating memory., xrefs: 00200B1C
AutoIt, xrefs: 00200B17

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: db996978746d84ad9f00081e107a295148b10ba450bde7259623c7285ba6d47d
Instruction ID: 0cbe9ffec44b0db75050cf8171562f78fc7f8daad0e2ade2ba5b7efaad928895
Opcode Fuzzy Hash: db996978746d84ad9f00081e107a295148b10ba450bde7259623c7285ba6d47d
Instruction Fuzzy Hash: 01E0D83125431826D21037947C03FD97B848F16B21F20042AFB58654C38BD1A4A007E9

Function 001C0D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 001BF7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,001C0D71,?,?,?,001A100A), ref: 001BF7CE

IsDebuggerPresent.KERNEL32(?,?,?,001A100A), ref: 001C0D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,001A100A), ref: 001C0D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 001C0D7F

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: 8a7255c974c4c33af36c3a2768772f265cf44f6b232d79d523d7895211d5d7d6
Instruction ID: 2d1181e1ca2e79b9a14f88844e4729407172d76559a13a35dfbd13a22303b0a6
Opcode Fuzzy Hash: 8a7255c974c4c33af36c3a2768772f265cf44f6b232d79d523d7895211d5d7d6
Instruction Fuzzy Hash: BBE092B42003518BD3719FBCF9087527BE0AF28740F00496DE887D6651DBB4E4448B91

Function 001BE398 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 001BE3D5

Strings

0%', xrefs: 001BE3B5
8%', xrefs: 001BE3CA

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: 0%'$8%'
API String ID: 1385522511-1499395184
Opcode ID: 61291ae20cf9a714aa371d4bf0a1c9a0fdc40ede354b8d6a430bfa36b7305f0a
Instruction ID: aac34d0abd49a777448d2187bef8bf9712b5d6a59b19c7b17d96ec7e81bd71d4
Opcode Fuzzy Hash: 61291ae20cf9a714aa371d4bf0a1c9a0fdc40ede354b8d6a430bfa36b7305f0a
Instruction Fuzzy Hash: 36E08631414910CBCA0D9728BA59ECC33D5FB29328B915169E11A871E39B35A8858755

Function 00213017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 0021302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00213044

Strings

aut, xrefs: 00213038

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: afe3590a80f85913c2ec292f253b0850c1b5e17a97d80fd6257902e22da2bc00
Instruction ID: ba8b9d313e0cee64a3b5bc57dbc0e3464b80e0cda9e1cb5ed75ab9af93f07fbe
Opcode Fuzzy Hash: afe3590a80f85913c2ec292f253b0850c1b5e17a97d80fd6257902e22da2bc00
Instruction Fuzzy Hash: 7DD05E7260032867DA20A7A4AC0EFCB3A6CDB05750F0002A1BA55E2091DAB09984CBD0

Function 001FD21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 001FD220

Strings

%.3d, xrefs: 001FD22B
X64, xrefs: 001FD2A8

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: 110b4c5ee548f302a830e91b498a003ceb7aed1f72770c778e1a67e5790ca36a
Instruction ID: 39176ba3a5c55f20c2b8ba93186dc9737781cba3c03130b2c2d3a4c4bc7dc611
Opcode Fuzzy Hash: 110b4c5ee548f302a830e91b498a003ceb7aed1f72770c778e1a67e5790ca36a
Instruction Fuzzy Hash: A5D0126180810CE9CB5897D0FC498FAB37DAB19341F618452FE06A1040E724C55867A2

Function 00232322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0023232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 0023233F

Part of subcall function 0020E97B: Sleep.KERNEL32 ref: 0020E9F3

Strings

Shell_TrayWnd, xrefs: 00232325

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: f706e29959806c6d095d6365620674baf0f60b24053d69e3a7609d74e5fc6662
Instruction ID: 5ffecf551b43f46cc33f006bfeeaa7339334202544e5b7edcd8108e8d3781b21
Opcode Fuzzy Hash: f706e29959806c6d095d6365620674baf0f60b24053d69e3a7609d74e5fc6662
Instruction Fuzzy Hash: EAD0C9763A4310B6E668A770AC4FFC6BA189B41B10F1149167645BA1D1C9A0A8518B54

Function 00232356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0023236C
PostMessageW.USER32(00000000), ref: 00232373

Part of subcall function 0020E97B: Sleep.KERNEL32 ref: 0020E9F3

Strings

Shell_TrayWnd, xrefs: 00232365

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 38c9079729bd742b26d3c73ed531af2c7226aa00cfe5a7aaed54799540a7525c
Instruction ID: e7ee247d6d5b6106ccc76ab62d0e1cea407576e0de81fa169514c7822a28be81
Opcode Fuzzy Hash: 38c9079729bd742b26d3c73ed531af2c7226aa00cfe5a7aaed54799540a7525c
Instruction Fuzzy Hash: B3D0C9723D13107AE668A770AC4FFC6B6189B45B10F5149167645BA1D1C9A0A8518B54

Function 001DBDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 001DBE93
GetLastError.KERNEL32 ref: 001DBEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 001DBEFC

Memory Dump Source

Source File: 00000000.00000002.2549321367.00000000001A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001A0000, based on PE: true

Associated: 00000000.00000002.2549254145.00000000001A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.000000000023C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549506941.0000000000262000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549643494.000000000026C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2549691754.0000000000274000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1a0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: a363d4faf45bfbe32c02bf5e9ddd273b54a94ca079bd89ca33d26de0f6fea4cd
Instruction ID: 74981f64dc07b36e26639c44b4e15711a21daed37db84c33db797a0f1749aed6
Opcode Fuzzy Hash: a363d4faf45bfbe32c02bf5e9ddd273b54a94ca079bd89ca33d26de0f6fea4cd
Instruction Fuzzy Hash: 5141E435608246EFCF258F65CCC4BBA7BA5AF51320F26416AF95A973A1DB309C01DB60

Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26

Source: global traffic	HTTP traffic detected: GET /account?=https://accounts.google.com/v3/signin/challenge/pwd HTTP/1.1Host: youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd HTTP/1.1Host: www.youtube.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-449021059&timestamp=1727429371112 HTTP/1.1Host: accounts.youtube.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-full-version: "117.0.5938.134"sec-ch-ua-arch: "x86"sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-model: ""sec-ch-ua-bitness: "64"sec-ch-ua-wow64: ?0sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: iframeReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.134"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.134", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.134"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=517=egIl5sEksGOZ4wW0Jc7B7W9HwkNpsYMHzKi6Fds3t8xsb4EZOyTzqVm3N9LRH5q5ynxZsi65W12J4bRnSFyQBs-6mfN9xX7BjLSWeZUrPRt2GUKgx2qyb-aL-b-tZpPm-pERDcXZl_9hTZAYfFL_rInxOOMGCZTRsQYBftPwWDu0oV23kIw
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ba7VRpcetUECb1w&MD=PAn2dUHx HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=ba7VRpcetUECb1w&MD=PAn2dUHx HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7484_659994726\LICENSE

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7484_659994726\_metadata\verified_contents.json

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7484_659994726\manifest.fingerprint

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7484_659994726\manifest.json

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7484_659994726\sets.json

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7484_821695454\Google.Widevine.CDM.dll

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7484_821695454\_metadata\verified_contents.json

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7484_821695454\manifest.fingerprint

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping7484_821695454\manifest.json

Chrome Cache Entry: 155

Chrome Cache Entry: 156

Chrome Cache Entry: 157

Chrome Cache Entry: 158

Chrome Cache Entry: 159

Chrome Cache Entry: 160

Chrome Cache Entry: 161

Chrome Cache Entry: 162

Chrome Cache Entry: 163

Windows Analysis Report
file.exe

Function 001A42DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Function 001A42A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Function 001E2BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Function 0020DBBE Relevance: 6.0, APIs: 4, Instructions: 29
filestringCOMMON

Function 001A2CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Function 001E065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Function 001A344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre