Edit tour

Windows Analysis Report
chica-pc-shield-1-75-0-1300-en-win.exe

Overview

General Information

Sample name:	chica-pc-shield-1-75-0-1300-en-win.exe
Analysis ID:	1545541
MD5:	1870fbe03e739325c142eacbe1667ff3
SHA1:	7b86308efbcde9175b405445179bbceb196d0f73
SHA256:	fba0337b65c15b029ee4f87b3db5fcfc6ce61a29289d9e6c58d0bcebee995ce0
Tags:	exeuser-MaxMax66
Infos:

Detection

GhostRat, KillMBR, Xtreme RAT

Score:	54
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Yara detected AntiVM3

Yara detected GhostRat

Yara detected KillMBR

Yara detected Xtreme RAT

Contains functionality to automate explorer (e.g. start an application)

Contains functionality to hide user accounts

Creates a FSFilter Anti-Virus service

Creates an undocumented autostart registry key

Found PHP interpreter

May modify the system service descriptor table (often done to hook functions)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for available system drives (often done to infect USB drives)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Creates files inside the driver directory

Creates files inside the system directory

Creates or modifies windows services

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Registers a DLL

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Classes Autorun Keys Modification

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Uses the system / local time for branch decision (may execute only at specific dates)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

chica-pc-shield-1-75-0-1300-en-win.exe (PID: 2704 cmdline: "C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe" MD5: 1870FBE03E739325C142EACBE1667FF3)

chica-pc-shield-1-75-0-1300-en-win.tmp (PID: 6460 cmdline: "C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp" /SL5="$20430,8630815,54272,C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe" MD5: C2BE7988C8762E314534B2908C4D6E49)

regsvr32.exe (PID: 5452 cmdline: "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\mbamext.dll" MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

regsvr32.exe (PID: 4276 cmdline: "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\ssubtmr6.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

regsvr32.exe (PID: 5972 cmdline: "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\vbalsgrid6.ocx" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

cpcs.exe (PID: 2412 cmdline: "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe" /starttrial MD5: 064E37783673E0094DAE704513F29393)

regsvr32.exe (PID: 3652 cmdline: regsvr32.exe /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\ssubtmr6.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

regsvr32.exe (PID: 5792 cmdline: regsvr32.exe /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\vbalsgrid6.ocx" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

cpcs.exe (PID: 5440 cmdline: "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe" /update MD5: 064E37783673E0094DAE704513F29393)

regsvr32.exe (PID: 6292 cmdline: regsvr32.exe /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\ssubtmr6.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

regsvr32.exe (PID: 5652 cmdline: regsvr32.exe /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\vbalsgrid6.ocx" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

cpcs.exe (PID: 3472 cmdline: "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe" MD5: 064E37783673E0094DAE704513F29393)

regsvr32.exe (PID: 2452 cmdline: regsvr32.exe /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\ssubtmr6.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

regsvr32.exe (PID: 7088 cmdline: regsvr32.exe /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\vbalsgrid6.ocx" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

cpcsgui.exe (PID: 6780 cmdline: "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe" /install /silent MD5: 9CC7642A4825E87C9EACB29391279F43)

svchost.exe (PID: 1408 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cpcsscheduler.exe (PID: 5660 cmdline: "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe" MD5: C56F757EB2A6D9B850FAD5F075008A57)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000012.00000003.2839561000.000000000CFD9000.00000004.00000020.00020000.00000000.sdmp	xtremrat	Xtrem RAT v3.5	Jean-Philippe Teissier / @Jipe_	0x2cee0:$a: XTREME 0x2d04a:$a: XTREME 0x3b4fe:$a: XTREME 0x3c040:$a: XTREME 0x3b4fe:$h: XTREME RAT 0x3c040:$h: XTREME RAT
00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	thequickbrow_APT1	unknown	AlienVault Labs	0x7b834:$s1: thequickbrownfxjmpsvalzydg
00000009.00000003.2546777163.000000000C828000.00000004.00000020.00020000.00000000.sdmp	xtremrat	Xtrem RAT v3.5	Jean-Philippe Teissier / @Jipe_	0x2b53a:$a: XTREME 0x32c52:$a: XTREME 0x3dda0:$a: XTREME 0x3dda0:$h: XTREME RAT
00000009.00000003.2545861202.000000000D4FA000.00000004.00000020.00020000.00000000.sdmp	xtremrat	Xtrem RAT v3.5	Jean-Philippe Teissier / @Jipe_	0x30a76:$a: XTREME 0x30f12:$a: XTREME 0x30a76:$h: XTREME RAT 0x30f12:$h: XTREME RAT
00000012.00000003.2839681114.000000000D42B000.00000004.00000020.00020000.00000000.sdmp	xtremrat	Xtrem RAT v3.5	Jean-Philippe Teissier / @Jipe_	0x30d0e:$a: XTREME 0x31102:$a: XTREME 0x37b52:$a: XTREME 0x387c6:$a: XTREME 0x30d0e:$h: XTREME RAT 0x31102:$h: XTREME RAT 0x37b52:$h: XTREME RAT 0x387c6:$h: XTREME RAT
0000000F.00000003.2652428311.0000000004663000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0000000F.00000003.2652428311.0000000004663000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0000000F.00000003.2652428311.0000000004663000.00000004.00000020.00020000.00000000.sdmp	APT9002Strings	9002 Identifying Strings	Seth Hardy	0x4ef6d6:$: \FlashUpdate.exe 0x613919:$: \FlashUpdate.exe
00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	clearlog	Detects Fireball malware - file clearlog.dll	Florian Roth	0x131706:$s3: hhhhh.exe 0x10758c:$s4: ttttt.exe
00000012.00000003.2843530652.000000000847A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000012.00000003.2843530652.000000000847A000.00000004.00000020.00020000.00000000.sdmp	clearlog	Detects Fireball malware - file clearlog.dll	Florian Roth	0x131706:$s3: hhhhh.exe 0x10758c:$s4: ttttt.exe
0000000F.00000003.2648389472.0000000008271000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0000000F.00000003.2648389472.0000000008271000.00000004.00000020.00020000.00000000.sdmp	clearlog	Detects Fireball malware - file clearlog.dll	Florian Roth	0x131706:$s3: hhhhh.exe 0x10758c:$s4: ttttt.exe
Process Memory Space: cpcs.exe PID: 2412	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
Process Memory Space: cpcs.exe PID: 2412	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: cpcs.exe PID: 2412	JoeSecurity_xtremerat_1	Yara detected Xtreme RAT	Joe Security
Process Memory Space: cpcs.exe PID: 2412	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: cpcs.exe PID: 2412	JoeSecurity_KillMBR	Yara detected KillMBR	Joe Security
Process Memory Space: cpcs.exe PID: 2412	thequickbrow_APT1	unknown	AlienVault Labs	0x13801c2:$s1: thequickbrownfxjmpsvalzydg 0x13801de:$s1: thequickbrownfxjmpsvalzydg
Process Memory Space: cpcs.exe PID: 2412	APT9002Strings	9002 Identifying Strings	Seth Hardy	0x186f11:$: \FlashUpdate.exe
Click to see the 16 entries

Sigma Signatures

System Summary

Sigma detected: Classes Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: {57CE581A-0CB6-4266-9CA0-19364C90A0B3}, EventID: 13, EventType: SetValue, Image: C:\Windows\System32\regsvr32.exe, ProcessId: 5452, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\MBAMShlExt\(Default)

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe /install /silent, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp, ProcessId: 6460, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ChicaPC-Shield

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1408, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005E02A0 CryptAcquireContextW,	12_2_005E02A0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005E0410 CryptCreateHash,CryptHashData,CryptDestroyHash,CryptDeriveKey,CryptDecrypt,CryptDestroyKey,CryptDestroyHash,	12_2_005E0410
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6BB6FFD0 CryptAcquireContextW,	12_2_6BB6FFD0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6BB54B60 _memset,SHGetValueW,lstrlenA,CryptUnprotectData,std::exception::exception,GetLastError,__CxxThrowException@8,LocalFree,	12_2_6BB54B60
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6BB70240 CryptCreateHash,CryptHashData,CryptDestroyHash,CryptGetHashParam,CryptDestroyHash,CryptDestroyHash,	12_2_6BB70240
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6BB70140 CryptCreateHash,CryptHashData,CryptDestroyHash,CryptDeriveKey,CryptEncrypt,CryptDecrypt,CryptDestroyKey,CryptDestroyHash,	12_2_6BB70140
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F85E570 CryptCreateHash,CryptHashData,CryptDestroyHash,CryptDeriveKey,CryptEncrypt,CryptDecrypt,CryptDestroyKey,CryptDestroyHash,	12_2_6F85E570
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F85E400 CryptAcquireContextW,	12_2_6F85E400
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F852FB9 _wcstoul,CryptGenRandom,CryptGenRandom,	12_2_6F852FB9
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F852ED0 CryptGenRandom,_wcstoul,CryptGenRandom,CryptGenRandom,	12_2_6F852ED0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F85E670 CryptCreateHash,CryptHashData,CryptDestroyHash,CryptGetHashParam,CryptDestroyHash,CryptDestroyHash,	12_2_6F85E670
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F869C00 CryptGenRandom,	12_2_6F869C00
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F853130 CryptGenRandom,	12_2_6F853130
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_008E71F0 CryptAcquireContextW,	14_2_008E71F0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_008E71C0 CryptGenRandom,	14_2_008E71C0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6BB6FFD0 CryptAcquireContextW,	14_2_6BB6FFD0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6BB54B60 _memset,SHGetValueW,lstrlenA,CryptUnprotectData,std::exception::exception,GetLastError,__CxxThrowException@8,LocalFree,	14_2_6BB54B60
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6BB70240 CryptCreateHash,CryptHashData,CryptDestroyHash,CryptGetHashParam,CryptDestroyHash,CryptDestroyHash,	14_2_6BB70240
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6BB70140 CryptCreateHash,CryptHashData,CryptDestroyHash,CryptDeriveKey,CryptEncrypt,CryptDecrypt,CryptDestroyKey,CryptDestroyHash,	14_2_6BB70140
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F85E570 CryptCreateHash,CryptHashData,CryptDestroyHash,CryptDeriveKey,CryptEncrypt,CryptDecrypt,CryptDestroyKey,CryptDestroyHash,	14_2_6F85E570
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F85E400 CryptAcquireContextW,	14_2_6F85E400
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F852FB9 _wcstoul,CryptGenRandom,CryptGenRandom,	14_2_6F852FB9
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F852ED0 CryptGenRandom,_wcstoul,CryptGenRandom,CryptGenRandom,	14_2_6F852ED0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F85E670 CryptCreateHash,CryptHashData,CryptDestroyHash,CryptGetHashParam,CryptDestroyHash,CryptDestroyHash,	14_2_6F85E670
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F869C00 CryptGenRandom,	14_2_6F869C00
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F853130 CryptGenRandom,	14_2_6F853130

Source: chica-pc-shield-1-75-0-1300-en-win.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown	HTTPS traffic detected: 65.9.66.84:443 -> 192.168.2.5:49921 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 65.9.66.84:443 -> 192.168.2.5:49933 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 65.9.66.84:443 -> 192.168.2.5:49945 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 65.9.66.84:443 -> 192.168.2.5:49957 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 65.9.66.107:443 -> 192.168.2.5:49995 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 65.9.66.107:443 -> 192.168.2.5:49997 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 65.9.66.107:443 -> 192.168.2.5:49999 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 65.9.66.107:443 -> 192.168.2.5:50001 version: TLS 1.0

Source: chica-pc-shield-1-75-0-1300-en-win.exe

Static PE information: certificate valid

Source:	Binary string: \ResBegleiter\obj\x86\Release\Devi.pdbb source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: :\XRoot_Build\XC\Vm\Release\x86\StubExe.pdb source: cpcs.exe, 00000009.00000003.2533389394.000000000A5B5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Server.pdb source: cpcs.exe, 00000009.00000003.2535416200.000000000A6BE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \obj\Release\Welp.pdb source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \obj\Release\Welp.pdbY{ source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: miniloader-patchdate-stub.pdb source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: DarkShell\Server\svchost\Debug\Serverz.pdb source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: w:\Project\!lego2new\lego_2011.xx.xx_2.xx\release\NSP.pdb source: cpcs.exe, 00000009.00000003.2533842656.000000000A4B5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: se\NSP.pdb source: cpcs.exe, 00000009.00000003.2529369405.0000000009D87000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\USERS\DEFAULT\APPDATA\LOCAL\TEMP\FACEBOOK\FACEBOOK STEALER.PDB source: cpcs.exe, 00000009.00000003.2545034326.000000000E01A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \sw_modem\HSF_HWICH\i386\HSFHWICH.pdb source: cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cryptnet.pdb source: cpcs.exe, 00000009.00000003.2532883037.000000000A55F000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529734518.000000000A248000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\key\sar\Debug\sar.pdbre source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\SVN\mbam\dll\mbam.dll\build\mbam.pdb source: cpcsgui.exe, 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: Intel Corporationse\NSP.pdb source: cpcs.exe, 00000009.00000003.2529369405.0000000009D87000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: vpamjon.pdb source: cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: NB10??????N????:\??????????\??W????????\????????????????????????????????????????G????\????????????\??????\????????????.pdbj source: cpcs.exe, 00000009.00000003.2532883037.000000000A55F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: hnetmon.pdb source: cpcs.exe, 00000009.00000003.2533389394.000000000A54E000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529734518.000000000A217000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2532883037.000000000A53D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sass.pdb source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Cryptor\stub6\Release\stub6.pdb source: cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: !lego2new\lego_2011.xx.xx_2.xx\release\NSP.pdb source: cpcs.exe, 00000009.00000003.2533389394.000000000A5B5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: :\UMPk.pdb source: cpcs.exe, 00000009.00000003.2535304844.0000000009F2B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\SVN\mbam\exe\mbampt.exe\build\mbampt.pdb%0A source: chica-pc-shield-1-75-0-1300-en-win.tmp, 00000001.00000003.2789847670.0000000004F26000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\WINDOWS\SERVICEPROFILES\NETWORKSERVICE\APPDATA\LOCAL\TEMP\FACEBOOK\FACEBOOK STEALER.PDB source: cpcs.exe, 00000009.00000003.2545306895.000000000E06C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \Release\AvG.pdb source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \Release\AvG.pdb>M source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\TranceCo.pdb source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\WFD\Tools\Server\_Downloader\Share\SFX Package\Pack\obj\x86\Debug\Pack.pdbE source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\USERS\user\APPDATA\LOCAL\TEMP\FACEBOOK\FACEBOOK STEALER.PDB source: cpcs.exe, 00000009.00000003.2545034326.000000000E01A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: fukmp.pdb source: cpcs.exe, 00000009.00000003.2535475306.000000000B056000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: NB10??????N????:\??????????\??W????????\????????????????????????????????????????G????\????????????\??????\????????????.pdb source: cpcs.exe, 00000009.00000003.2529734518.000000000A248000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ????????????????.pdb source: cpcs.exe, 00000009.00000003.2533389394.000000000A5B5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: aspergillus.pdb source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bk22\kloader\Release\i386\kloader.pdb source: cpcs.exe, 00000009.00000003.2529369405.0000000009D87000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Dell\Desktop\SOMA.pdb source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: fukmp.pdb% source: cpcs.exe, 00000009.00000003.2535475306.000000000B056000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: p:\vc5\x64\release\resident.pdb source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: F:\NTDDK\DEMO\_DarkTest\i386\DarkTest.pdb source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\SVN\mbam\dll\mbam.dll\build\mbam.pdb` source: cpcsgui.exe, 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\dev\stuk_rar\release\setup.pdb source: cpcs.exe, 00000009.00000003.2533161271.000000000A44A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\SVN\mbam\exe\mbamscheduler.exe\build\mbamscheduler.pdb source: chica-pc-shield-1-75-0-1300-en-win.tmp, 00000001.00000003.2789847670.0000000004EC9000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\WINDOWS\TEMP\FACEBOOK\FACEBOOK STEALER.PDB source: cpcs.exe, 00000009.00000003.2545034326.000000000DF4E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\PROGRAM FILES (X86)\FACEHACK\FACEHACK.PDB%vz$ source: cpcs.exe, 00000009.00000003.2546311082.000000000D10C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sfxrar32\Release\sfxrar.pdb source: cpcs.exe, 00000009.00000003.2532883037.000000000A55F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Socksbuilder\stub\release\stub.pdbeb source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ent.pdb0?0A source: cpcs.exe, 00000009.00000003.2533784758.000000000A13A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sxtyy.pdb source: cpcs.exe, 00000009.00000003.2535475306.000000000B056000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ?????.pdbr source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: EXTRA=Adware.Agent, %PROGRAMFILES%\Isilo\iSiloDisplaySample.pdb, DP source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: db.pdb source: cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2534960911.000000000A69B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Nuova cartella\myform\myform\obj\Release\myform.pdb source: cpcs.exe, 00000009.00000003.2533842656.000000000A4B5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: $:\tmp\test.pdb source: cpcs.exe, 00000009.00000003.2529734518.000000000A248000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529941329.000000000A2A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: :\??????????????????????????????????????.pdb source: cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z(1)\stub\Release\stub.pdbtor source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ??:\??????????\??W????????\????????????????????????????????????????G????\????????????\??????\????????????.pdb source: cpcs.exe, 00000009.00000003.2532883037.000000000A55F000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529734518.000000000A248000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: x:\werdon.pdb source: cpcs.exe, 00000009.00000003.2535304844.0000000009F2B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\d\objfre_wxp_x86\i386\HG.pdb source: cpcs.exe, 00000009.00000003.2528855901.000000000A101000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z(1)\stub\Release\stub.pdb source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: p:\vc5\x64\release\resident.pdbO6 source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ent.pdb source: cpcs.exe, 00000009.00000003.2533784758.000000000A13A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\work_temp\utf8\test2\Release\test2.pdb source: cpcs.exe, 00000009.00000003.2533161271.000000000A44A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e:\job\gh0st1.0\Release\Loader.pdb source: cpcs.exe, 00000009.00000003.2533161271.000000000A44A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: URGABPW.pdb source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: TDIMUED.pdb source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: hnetmon.pdbU source: cpcs.exe, 00000009.00000003.2533389394.000000000A54E000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2532883037.000000000A53D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: vpamjon.pdbd9 source: cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \accs\accs\accs\obj\Release\accs.pdb source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: REAPER\Stub\stub rc\obj\Release\stub rc.pdb source: cpcs.exe, 00000009.00000003.2529369405.0000000009D87000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: w:\Project\!lego2new\lego_2011.xx.xx_2.xx\release\NSP.pdb/ source: cpcs.exe, 00000009.00000003.2533842656.000000000A4B5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\key\sar\Debug\sar.pdb source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ryptnet.pdb source: cpcs.exe, 00000009.00000003.2532883037.000000000A55F000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529734518.000000000A248000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529941329.000000000A2A1000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2533526590.000000000A5A4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \Projects\reg\reg\obj\Debug\reg.pdbn source: cpcs.exe, 00000009.00000003.2529369405.0000000009D87000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sxtyy.pdb source: cpcs.exe, 00000009.00000003.2535475306.000000000B056000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WWMWCMGV.pdb source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cryptnet.pdbB source: cpcs.exe, 00000009.00000003.2529734518.000000000A248000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \Projects\reg\reg\obj\Debug\reg.pdb source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529369405.0000000009D87000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: HookDllDriver\objfre\i386\hookdll.pdb source: cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: NGPCorp\DLL\Release\DLL.pdb source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sfxrar32\Release\sfxrar.pdbPY source: cpcs.exe, 00000009.00000003.2532883037.000000000A55F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Prevazatorul.pdb[ source: cpcs.exe, 00000009.00000003.2533526590.000000000A5C7000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2533704715.000000000A5CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\TP\AppData\Local\Temp\zy3gqjbl.pdb source: cpcs.exe, 00000009.00000003.2528855901.000000000A101000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \AccountCreator.pdbk source: cpcs.exe, 00000009.00000003.2533389394.000000000A54E000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2532883037.000000000A53D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: F:\NTDDK\DEMO\_DarkTest\i386\DarkTest.pdbem source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Bacipy.pdb source: cpcs.exe, 00000009.00000003.2529369405.0000000009D87000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2533630438.000000000A445000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: IEXPLORE\Debug\wibvusd.pdb source: cpcs.exe, 00000009.00000003.2533161271.000000000A493000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2528855901.000000000A14E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 8$W:\w\Loader.pdb source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: vCrypt Stub.pdb source: cpcs.exe, 00000009.00000003.2533526590.000000000A5C7000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2533704715.000000000A5CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Prevazatorul.pdb source: cpcs.exe, 00000009.00000003.2533526590.000000000A5C7000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2533704715.000000000A5CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: &:\UMPk.pdb source: cpcs.exe, 00000009.00000003.2535304844.0000000009F2B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ?????.pdb source: cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \ResBegleiter\obj\x86\Release\Devi.pdb source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: :\tmp\test.pdb source: cpcs.exe, 00000009.00000003.2529734518.000000000A248000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529941329.000000000A2A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ld.pdb source: cpcs.exe, 00000009.00000003.2529734518.000000000A248000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529941329.000000000A2A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\work\utf8\test2\Release\test2.pdb source: cpcs.exe, 00000009.00000003.2533161271.000000000A44A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \AccountCreator.pdb source: cpcs.exe, 00000009.00000003.2533389394.000000000A54E000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529734518.000000000A217000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2532883037.000000000A53D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: XC\Vm\Release\x86\StubExe.pdb source: cpcs.exe, 00000009.00000003.2533389394.000000000A54E000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529734518.000000000A217000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2532883037.000000000A53D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Z:\xampp\htdocs\project-727,Permutation\stable\tmp\PDBSIG.pdb source: cpcs.exe, 00000009.00000003.2533842656.000000000A4B5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: :\Fecira.pdb source: cpcs.exe, 00000009.00000003.2535304844.0000000009F2B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\local0\asf\release\build-2.2.14\support\Release\ab.pdb)] source: cpcs.exe, 00000009.00000003.2528855901.000000000A101000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \Project1\Project1\obj\Release\Project1.pdb<. source: cpcs.exe, 00000009.00000003.2533389394.000000000A5B5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: W:\w\Loader.pdb source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bk22\kloader\Release\i386\kloader.pdbt,n source: cpcs.exe, 00000009.00000003.2529369405.0000000009D87000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\work\test\test2\Release\test2.pdb< source: cpcs.exe, 00000009.00000003.2529454596.000000000A126000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \Projects\War Crypter\Release\Stub.pdb source: cpcs.exe, 00000009.00000003.2533389394.000000000A5B5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\SVN Control Code\app_client\Loader\Release\Loader.pdb?_ source: cpcs.exe, 00000009.00000003.2528855901.000000000A101000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \Project1\Project1\obj\Release\Project1.pdb source: cpcs.exe, 00000009.00000003.2533389394.000000000A5B5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WWMWCMGV.pdb=; source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ??@RSDS??????????????????????????????????o.pdb source: cpcs.exe, 00000009.00000003.2533842656.000000000A4B5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \w.a.t.c.h\w.a.t.c.h\obj\Release\w.a.t.c.h.pdb source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529369405.0000000009D87000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e:\job\gh0st1.0\Release\Loader.pdb\ source: cpcs.exe, 00000009.00000003.2533161271.000000000A44A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\WINDOWS\SERVICEPROFILES\LOCALSERVICE\APPDATA\LOCAL\TEMP\FACEBOOK\FACEBOOK STEALER.PDB source: cpcs.exe, 00000009.00000003.2545306895.000000000E06C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\XRoot_Build\XC\Vm\Release\x86\StubExe.pdb source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\work\test\test2\Release\test2.pdb source: cpcs.exe, 00000009.00000003.2533161271.000000000A44A000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529454596.000000000A126000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \x86\Debug\Balle2.pdb source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\WFD\Tools\Server\_Downloader\Share\SFX Package\Pack\obj\x86\Debug\Pack.pdb source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \Emuhucuqih.pdb source: cpcs.exe, 00000009.00000003.2535475306.000000000B056000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: IEXPLORE\Debug\wibvusd.pdbR source: cpcs.exe, 00000009.00000003.2528855901.000000000A14E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: XC\Vm\Release\x86\StubExe.pdbX source: cpcs.exe, 00000009.00000003.2533389394.000000000A54E000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2532883037.000000000A53D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\work\test\test2\Release\test2.pdbd source: cpcs.exe, 00000009.00000003.2533161271.000000000A44A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Tr0gdor\Rxbot 7.6\Debug\rBot.pdbz source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: o.pdb source: cpcs.exe, 00000009.00000003.2533842656.000000000A4B5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: note.pdb source: cpcs.exe, 00000009.00000003.2535475306.000000000B056000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\dtcser\sys\i386\killvv.pdb source: cpcs.exe, 00000009.00000003.2533161271.000000000A493000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2528855901.000000000A14E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: EXTRA=Password.Stealer, %TEMP%\Facebook\Facebook Stealer.pdb, DP source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\key\lasass\Debug\lasass.pdb source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: vCrypt Stub.pdb7 source: cpcs.exe, 00000009.00000003.2533526590.000000000A5C7000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2533704715.000000000A5CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\local0\asf\release\build-2.2.14\support\Release\ab.pdb source: cpcs.exe, 00000009.00000003.2528855901.000000000A101000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\SVN Control Code\app_client\Loader\Release\Loader.pdb source: cpcs.exe, 00000009.00000003.2528855901.000000000A101000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: x:\werdon.pdb source: cpcs.exe, 00000009.00000003.2535304844.0000000009F2B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \MyProjects\eMule\Debug\eMule.pdb source: cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\SVN\mbam\exe\mbampt.exe\build\mbampt.pdb source: chica-pc-shield-1-75-0-1300-en-win.tmp, 00000001.00000003.2789847670.0000000004F26000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Socksbuilder\stub\release\stub.pdb source: cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Tr0gdor\Rxbot 7.6\Debug\rBot.pdb source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cm_acl.pdb source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\dtcser\sys\i386\killvv.pdb+ source: cpcs.exe, 00000009.00000003.2533161271.000000000A493000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Double Onesass.pdbx7 source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	File opened: z:
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	File opened: x:
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	File opened: v:
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	File opened: t:
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	File opened: r:
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	File opened: p:
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	File opened: n:
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	File opened: l:
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	File opened: j:
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	File opened: h:
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	File opened: f:
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	File opened: b:
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	File opened: y:
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	File opened: w:
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	File opened: u:
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	File opened: s:
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	File opened: q:
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	File opened: o:
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	File opened: m:
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	File opened: k:
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	File opened: i:
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	File opened: g:
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	File opened: e:
Source: C:\Windows\System32\svchost.exe	File opened: c:
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	File opened: a:

Source: cpcs.exe, 00000009.00000003.2545034326.000000000DF4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\OUTLOOK EXPRESS\AUTORUN.INF
Source: cpcs.exe, 00000009.00000003.2545034326.000000000DFD6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES (X86)\OUTLOOK EXPRESS\AUTORUN.INFq
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Worm.AutoRun, %USERROOT%\Documentsautorun.inf
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Malware.Trace, %PROGRAMFILES%\Outlook Express\autorun.inf
Source: cpcs.exe, 00000009.00000003.2529734518.000000000A248000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Autorun.inf
Source: cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [AUTORUN]
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: cpcs.exe, 00000009.00000003.2543791751.000000000DC90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\DOCUMENTSAUTORUN.INF@
Source: cpcs.exe, 00000009.00000003.2543791751.000000000DC90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\SERVICEPROFILES\LOCALSERVICE\DOCUMENTSAUTORUN.INF
Source: cpcs.exe, 00000009.00000003.2543791751.000000000DC90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\SERVICEPROFILES\NETWORKSERVICE\DOCUMENTSAUTORUN.INFc
Source: cpcs.exe, 00000009.00000003.2533842656.000000000A4B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \autorun.inf
Source: cpcs.exe, 00000009.00000003.2533842656.000000000A4B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Autorun.infc

Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_00452A60 FindFirstFileA,GetLastError,	1_2_00452A60
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_00474E64 FindFirstFileA,FindNextFileA,FindClose,	1_2_00474E64
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_00464030 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_00464030
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_00462628 FindFirstFileA,FindNextFileA,FindClose,	1_2_00462628
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_00463BB4 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_00463BB4
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_00497C84 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	1_2_00497C84
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005BBAD0 FindFirstFileW,FindNextFileW,FindClose,	12_2_005BBAD0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6BB592B0 FindFirstFileW,FindNextFileW,FindClose,	12_2_6BB592B0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F8625E0 FindFirstFileW,FindNextFileW,FindClose,	12_2_6F8625E0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6BB592B0 FindFirstFileW,FindNextFileW,FindClose,	14_2_6BB592B0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F8625E0 FindFirstFileW,FindNextFileW,FindClose,	14_2_6F8625E0

Source: Joe Sandbox View

IP Address: 65.9.66.107 65.9.66.107

Source: unknown	HTTPS traffic detected: 65.9.66.84:443 -> 192.168.2.5:49921 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 65.9.66.84:443 -> 192.168.2.5:49933 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 65.9.66.84:443 -> 192.168.2.5:49945 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 65.9.66.84:443 -> 192.168.2.5:49957 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 65.9.66.107:443 -> 192.168.2.5:49995 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 65.9.66.107:443 -> 192.168.2.5:49997 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 65.9.66.107:443 -> 192.168.2.5:49999 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 65.9.66.107:443 -> 192.168.2.5:50001 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /v1/config/chicalogic/version.chk HTTP/1.1Accept-Encoding: gzipConnection: CloseHost: data-cdn.mbamupdates.comUser-Agent: mbam - chicalogic_trial (scanner) - base:1.75.0.1300 - rules:v2013.04.04.07
Source: global traffic	HTTP traffic detected: GET /v1/news/chicalogic/version.chk HTTP/1.1Accept-Encoding: gzipConnection: CloseHost: data-cdn.mbamupdates.comUser-Agent: mbam - chicalogic_trial (scanner) - base:1.75.0.1300 - rules:v2013.04.04.07
Source: global traffic	HTTP traffic detected: GET /v1/custom/chicalogic/version.chk HTTP/1.1Accept-Encoding: gzipConnection: CloseHost: data-cdn.mbamupdates.comUser-Agent: mbam - chicalogic_trial (scanner) - base:1.75.0.1300 - rules:v2013.04.04.07
Source: global traffic	HTTP traffic detected: GET /v0/clients/chicalogic/mbam.check.program HTTP/1.1Accept-Encoding: gzipConnection: CloseHost: data-cdn.mbamupdates.comUser-Agent: mbam - chicalogic_trial (scanner) - base:1.75.0.1300 - rules:v2013.04.04.07
Source: global traffic	HTTP traffic detected: GET /v1/config/chicalogic/version.chk HTTP/1.1Accept-Encoding: gzipConnection: CloseHost: data-cdn.mbamupdates.comUser-Agent: mbam - chicalogic_trial (scanner) - base:1.75.0.1300 - rules:v2013.04.04.07
Source: global traffic	HTTP traffic detected: GET /v1/news/chicalogic/version.chk HTTP/1.1Accept-Encoding: gzipConnection: CloseHost: data-cdn.mbamupdates.comUser-Agent: mbam - chicalogic_trial (scanner) - base:1.75.0.1300 - rules:v2013.04.04.07
Source: global traffic	HTTP traffic detected: GET /v1/custom/chicalogic/version.chk HTTP/1.1Accept-Encoding: gzipConnection: CloseHost: data-cdn.mbamupdates.comUser-Agent: mbam - chicalogic_trial (scanner) - base:1.75.0.1300 - rules:v2013.04.04.07
Source: global traffic	HTTP traffic detected: GET /v0/clients/chicalogic/mbam.check.program HTTP/1.1Accept-Encoding: gzipConnection: CloseHost: data-cdn.mbamupdates.comUser-Agent: mbam - chicalogic_trial (scanner) - base:1.75.0.1300 - rules:v2013.04.04.07

Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: *\IM#####.JPG-WWW.MYSPACE.COM.EXE equals www.myspace.com (Myspace)
Source: cpcs.exe, 00000009.00000003.2529734518.000000000A248000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: *\IMAGE-WWW.FACEBOOK.COM-####-.JPG.EXEDC4E equals www.facebook.com (Facebook)
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: *\PIC####-JPG-WWW.FACEBOOK.COM.EXEt equals www.facebook.com (Facebook)
Source: cpcs.exe, 00000012.00000003.2840443937.000000000E02A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\USERS\user\APPDATA\LOCAL\TEMP\I_AM_EMO.GIF---WWW.FACEBOOK.COM equals www.facebook.com (Facebook)
Source: cpcs.exe, 00000012.00000003.2840443937.000000000E02A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\USERS\DEFAULT\APPDATA\LOCAL\TEMP\I_AM_EMO.GIF---WWW.FACEBOOK.COM equals www.facebook.com (Facebook)
Source: cpcs.exe, 00000009.00000003.2544897121.000000000DD58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\WINDOWS\SERVICEPROFILES\LOCALSERVICE\APPDATA\LOCAL\TEMP\I_AM_EMO.GIF---WWW.FACEBOOK.COM equals www.facebook.com (Facebook)
Source: cpcs.exe, 00000009.00000003.2544897121.000000000DD58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\WINDOWS\SERVICEPROFILES\NETWORKSERVICE\APPDATA\LOCAL\TEMP\I_AM_EMO.GIF---WWW.FACEBOOK.COM equals www.facebook.com (Facebook)
Source: cpcs.exe, 00000009.00000003.2543791751.000000000DC0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\WINDOWS\SYSTEM32\TASKMDE.YOUTUBE.SUPERPOP.HTTP.WWW.YOUTUBE.COM equals www.youtube.com (Youtube)
Source: cpcs.exe, 00000009.00000003.2543791751.000000000DC0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\WINDOWS\SYSWOW64\TASKMDE.YOUTUBE.SUPERPOP.HTTP.WWW.YOUTUBE.COM equals www.youtube.com (Youtube)
Source: cpcs.exe, 00000009.00000003.2544105021.000000000DEC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\WINDOWS\TEMP\I_AM_EMO.GIF---WWW.FACEBOOK.COM equals www.facebook.com (Facebook)
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: EXTRA=Trojan.Agent, %SYSDIR%\taskmde.youtube.superpop.http.www.youtube.com equals www.youtube.com (Youtube)
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: EXTRA=Trojan.Agent, HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\|*www.facebook.scr equals www.facebook.com (Facebook)
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: EXTRA=Trojan.Backdoor, HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\|Firewall Administrating=www.myspace.com equals www.myspace.com (Myspace)
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: EXTRA=Trojan.Backdoor, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run\|Firewall Administrating=www.myspace.com equals www.myspace.com (Myspace)
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: EXTRA=Trojan.Backdoor, HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\|Firewall Administrating=www.myspace.com equals www.myspace.com (Myspace)
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: EXTRA=Trojan.Downloader, %TEMP%\I_AM_EMO.gif---www.facebook.com equals www.facebook.com (Facebook)
Source: cpcs.exe, 00000009.00000003.2556561426.0000000006534000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: POLY=Backdoor.Bot.Gen && PATTERN=*\.JPG-www.facebook.com.exe && VERSION=FALSE && STRINGS=0, 4D5A equals www.facebook.com (Facebook)
Source: cpcs.exe, 00000009.00000003.2556561426.0000000006534000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: POLY=IM.Worm && PATTERN=*\IMAGE-www.facebook.com-####-.JPG.exe && STRINGS=992, 55505821 equals www.facebook.com (Facebook)
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: POLY=PasswordStealer.Kurit && VERSION=1, %NULL% && VERSION=2, www.hotmail.com && VERSION=3, 1?0?0?0 && VERSION=5, Microsoft Corporation equals www.hotmail.com (Hotmail)
Source: cpcs.exe, 00000009.00000003.2556561426.0000000006534000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: POLY=Trojan.Agent && PATTERN=*\PIC####-JPG-www.facebook.com.exe && VERSION=FALSE && STRINGS=0, 4D5A equals www.facebook.com (Facebook)
Source: cpcs.exe, 00000009.00000003.2556561426.0000000006534000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: POLY=Trojan.Agent && VERSION=1, Www.Yahoo-i.Com && VERSION=2, %NULL% && VERSION=3, 1.00 && VERSION=5, %NULL% && VERSION=7, Yahoo.exe equals www.yahoo.com (Yahoo)
Source: cpcs.exe, 00000009.00000003.2556561426.0000000006534000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: POLY=Trojan.Agent.Gen && PATTERN=**\IM#####?JPG-www.myspace.com.exe && STRINGS=0, 4D5A equals www.myspace.com (Myspace)
Source: cpcs.exe, 00000009.00000003.2556561426.0000000006534000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: POLY=Trojan.Agent.Gen && PATTERN=*\IM.JPG?www.myspace.com.exe && VERSION=FALSE && STRINGS=78, 546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F6465 equals www.myspace.com (Myspace)
Source: cpcs.exe, 00000009.00000003.2556561426.0000000006534000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: POLY=Trojan.Agent.Gen && PATTERN=**\PIC##########-JPG-www.facebook.com && VERSION=FALSE && STRINGS=0, 4D5A equals www.facebook.com (Facebook)
Source: cpcs.exe, 00000009.00000003.2556561426.0000000006534000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: POLY=Trojan.AgentBypass && PATTERN=*.JPG-www.myspace.com.exe && VERSION=FALSE && STRINGS=0, 4D5A90 equals www.myspace.com (Myspace)
Source: cpcs.exe, 00000009.00000003.2556561426.0000000006534000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: POLY=Trojan.Downloader && PATTERN=*\www.facebook.com.exe && STRINGS=0, 4D5A equals www.facebook.com (Facebook)
Source: cpcs.exe, 00000009.00000003.2556561426.0000000006534000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: POLY=Trojan.Email.Gen && PATTERN=*\IM######?JPG#?www.myspace.com.exe && STRINGS=0, 4D5A equals www.myspace.com (Myspace)
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: POLY=Trojan.MSIL && VERSION=1, www.facebook.com && VERSION=7, facebook tools.exe equals www.facebook.com (Facebook)
Source: cpcs.exe, 00000009.00000003.2556561426.0000000006534000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: POLY=Trojan.MSIL && VERSION=1, www.facebook.com && VERSION=7, facebook_hack.exe equals www.facebook.com (Facebook)
Source: cpcs.exe, 00000009.00000003.2556561426.0000000006534000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: POLY=Worm.Palevo && PATTERN=*\.JPG-www.facebook.exe && VERSION=FALSE equals www.facebook.com (Facebook)
Source: cpcs.exe, 00000009.00000003.2556561426.0000000006534000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: POLY=Worm.Palevo && PATTERN=*\IM#####.JPG-www.myspace.com.exe && VERSION=FALSE && STRINGS=1082, 000083F801746C85C0742AC7042408000000FFD0BBFFFFFFFF89D88B75FC8B5DF889EC5DC204003D930000C074BD3D940000C074BB89D88B75FC8B5DF889EC5DC204008D76003D050000C075E8C704240B00000031F689742404E8 equals www.myspace.com (Myspace)
Source: cpcs.exe, 00000009.00000003.2556561426.0000000006534000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: POLY=Worm.Palevo.Gen && PATTERN=*www.facebook.com.scr && VERSION=FALSE && STRINGS=1568, 5589E583EC08C7042401000000FF1508414200 && STRINGS=496, 2E62737300000000??????????????000000000000000000000000000000000000000000??0000?? equals www.facebook.com (Facebook)
Source: cpcs.exe, 00000009.00000003.2556561426.0000000006534000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: POLY=Worm.Palevo.Gen && SIZE=24000, 100000 && PATTERN=**\n########_##.JPG-www.facebook.exe && STRINGS=0, 4D5A equals www.facebook.com (Facebook)
Source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.facebook.comn equals www.facebook.com (Facebook)
Source: cpcs.exe, 00000009.00000003.2533526590.000000000A5C7000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2533704715.000000000A5CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.hotmail.com6 equals www.hotmail.com (Hotmail)

Source: global traffic	DNS traffic detected: DNS query: stats.mbamupdates.com
Source: global traffic	DNS traffic detected: DNS query: data-cdn.mbamupdates.com
Source: global traffic	DNS traffic detected: DNS query: edge.data-cdn.mbamupdates.com
Source: global traffic	DNS traffic detected: DNS query: hw.data-cdn.mbamupdates.com
Source: global traffic	DNS traffic detected: DNS query: llnw.data-cdn.mbamupdates.com

Source: cpcs.exe, 00000009.00000003.2546029145.000000000D31E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: HTTP://WWW.WW-XXOOXX-CH.NET
Source: cpcs.exe, 00000009.00000003.2556561426.0000000006534000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Http://WwW.YlmF.CoM
Source: cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://1002.03r.info:338/13.jpg
Source: cpcs.exe, 00000009.00000003.2528855901.000000000A101000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://182.237.1.106:333/32.exe
Source: cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://77.78.240.87/ebb.php
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2533389394.000000000A5B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Photos.MSN.com
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2533842656.000000000A4B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://anthneic.blogspot.com/
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://as.starware.com
Source: cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://b.ez173.com/
Source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://best-pc.co.kr
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bsalsa.com/
Source: cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c.ez173.com/
Source: cpcs.exe, 00000009.00000003.2510009992.0000000003565000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2510085331.000000000355F000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509982383.000000000355F000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509409389.0000000003565000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509325799.000000000355F000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509920343.000000000354D000.00000004.00000020.00020000.00000000.sdmp, cpcsgui.exe	String found in binary or memory: http://cdn.stat
Source: cpcs.exe, 00000009.00000003.2509521137.0000000003556000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cdn.static.mal
Source: cpcsgui.exe	String found in binary or memory: http://cdn.static.malwa
Source: cpcs.exe, 00000009.00000003.2509409389.0000000003565000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509325799.000000000355F000.00000004.00000020.00020000.00000000.sdmp, cpcsgui.exe	String found in binary or memory: http://cdn.static.malwareb
Source: cpcs.exe, 00000009.00000003.2509521137.0000000003553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cdn.static.malwareb-
Source: cpcsgui.exe	String found in binary or memory: http://cdn.static.malwareby
Source: cpcsgui.exe	String found in binary or memory: http://cdn.static.malwarebytes
Source: cpcsgui.exe	String found in binary or memory: http://cdn.static.malwarebytes.org/clie
Source: cpcsgui.exe	String found in binary or memory: http://cdn.static.malwarebytes.org/client_r
Source: cpcs.exe, 00000009.00000003.2509409389.0000000003565000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cdn.static.malwarebytes.org/client_resources/1.7/images/Chameleon_64x64.png
Source: cpcsgui.exe	String found in binary or memory: http://cdn.static.malwarebytes.org/client_resources/1.7/images/FileAssassin_64x64.png
Source: cpcs.exe, 00000009.00000003.2510041575.000000000354D000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2510085331.000000000355F000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509409389.0000000003565000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509521137.0000000003556000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cdn.static.malwarebytes.org/client_resources/1.7/images/StartupLite_64x64.png
Source: cpcsgui.exe	String found in binary or memory: http://cdn.static.malwarebytes.org/client_resources/1.7/images/anti_rootkit_64x64.png
Source: cpcs.exe, 00000009.00000003.2509521137.0000000003556000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cdn.stb
Source: cpcs.exe, 00000009.00000003.2528855901.000000000A101000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cha.91mt.com/asp/xg.asp
Source: cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://d1.kuai8.com
Source: cpcs.exe, 00000009.00000003.2509920343.000000000354D000.00000004.00000020.00020000.00000000.sdmp, cpcsgui.exe	String found in binary or memory: http://downloads.malwarebytes.org/mbam-download.php
Source: cpcs.exe, 00000009.00000003.2510085331.000000000355F000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509982383.000000000355F000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509920343.000000000354D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://downloads.malwarebytes.org/mbam-download.phpon
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edits.mywebsearch.com
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geral.gratixhost.com.br/publicidade/publicidade.js
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://http.proxy.icq.com/hello
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://knock-knock-knock.info/export/code2.php?c=
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://knock-knock-knock.info/export/code2.php?c=0000000
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://knock-knock-knock.info/export/code2.php?c=1000000
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://koxp.alcazer.com
Source: cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://link0125baixa2010.fromru.com/arroxa.exe
Source: cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://link0125baixa2010.fromru.com/arroxa.exeC:
Source: cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://redirecionamentosb.com/sw4.pac
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://redirecionamentosb.com/sw4.packer
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://saskentbbq.com/sasmate
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sms911.ru
Source: cpcs.exe, 00000009.00000003.2556561426.0000000006534000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://snake.gnuchina.org
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://topagacilaboratuari.com/topagaci.com
Source: cpcs.exe, 00000009.00000003.2556561426.0000000006534000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2556561426.0000000007934000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://upx.sf.net
Source: cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://w.clic
Source: cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wara6.homeftp.org/c
Source: cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wfef5.mine.nu/config.asp
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2533842656.000000000A4B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wsy539.myrice.com
Source: cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.6071.com/
Source: cpcs.exe, 00000009.00000003.2533161271.000000000A44A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.8es.cn/code/adview_pic.php
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.GoCasino.com
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.GoCasino.com11
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.Parodieront.com
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.a0?a.co0
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529369405.0000000009D87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.abyssmedia.com
Source: cpcs.exe, 00000009.00000003.2529369405.0000000009D87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.abyssmedia.comion
Source: cpcs.exe, 00000009.00000003.2529369405.0000000009D87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.abyssmedia.comz
Source: cpcs.exe, 00000009.00000003.2556561426.0000000006534000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.aimp.ru
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529734518.000000000A248000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ankord.com/)
Source: cpcsscheduler.exe, 0000000E.00000002.3285698951.000000006BCC3000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://www.appinf.com/features/enable-partial-reads
Source: cpcsscheduler.exe, 0000000E.00000002.3285698951.000000006BCC3000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://www.appinf.com/features/no-whitespace-in-element-content
Source: cpcsscheduler.exe, 0000000E.00000002.3285698951.000000006BCC3000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://www.appinf.com/features/no-whitespace-in-element-contenthttp://xml.org/sax/features/validatio
Source: cpcs.exe, 00000009.00000003.2533161271.000000000A493000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2528855901.000000000A14E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.baidu.com
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.best-pc.co.kr
Source: chica-pc-shield-1-75-0-1300-en-win.exe, 00000000.00000003.2032168361.00000000023F0000.00000004.00001000.00020000.00000000.sdmp, chica-pc-shield-1-75-0-1300-en-win.exe, 00000000.00000003.2795341385.0000000002100000.00000004.00001000.00020000.00000000.sdmp, chica-pc-shield-1-75-0-1300-en-win.exe, 00000000.00000003.2032244303.00000000020F4000.00000004.00001000.00020000.00000000.sdmp, chica-pc-shield-1-75-0-1300-en-win.tmp, chica-pc-shield-1-75-0-1300-en-win.tmp, 00000001.00000003.2034370148.000000000213C000.00000004.00001000.00020000.00000000.sdmp, chica-pc-shield-1-75-0-1300-en-win.tmp, 00000001.00000003.2034264033.0000000003110000.00000004.00001000.00020000.00000000.sdmp, chica-pc-shield-1-75-0-1300-en-win.tmp, 00000001.00000003.2791392614.0000000002140000.00000004.00001000.00020000.00000000.sdmp, chica-pc-shield-1-75-0-1300-en-win.tmp, 00000001.00000003.2792550502.0000000002144000.00000004.00001000.00020000.00000000.sdmp, chica-pc-shield-1-75-0-1300-en-win.tmp, 00000001.00000003.2791262908.000000000213C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.chicalogic.com
Source: cpcsgui.exe	String found in binary or memory: http://www.chicalogic.com/pc-shield-re
Source: cpcs.exe, 00000009.00000003.2510085331.000000000355F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.chicalogic.com/pc-shield-re9
Source: cpcs.exe, 00000009.00000003.2510009992.0000000003565000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2510085331.000000000355F000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509982383.000000000355F000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509920343.000000000354D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.chicalogic.com/pc-shield-reJ
Source: cpcs.exe, 00000009.00000003.2500648179.0000000002B4E000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2500622555.0000000002B48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.chicalogic.com/pc-shield-rei
Source: cpcs.exe, 00000009.00000003.2510009992.0000000003565000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2510085331.000000000355F000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509982383.000000000355F000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509920343.000000000354D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.chicalogic.com/pc-shield-rel
Source: cpcs.exe, 00000009.00000003.2510009992.0000000003565000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509982383.000000000355F000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509920343.000000000354D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.chicalogic.com/pc-shield-rew
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.chukotka.kz/cache/msn.php?id=0
Source: cpcs.exe, 00000009.00000003.2534960911.000000000A69B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.contoso.com/PostAccepter.aspxQ5
Source: cpcs.exe, 00000009.00000003.2533161271.000000000A44A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cookst.com/sentry/api/20110306.exe
Source: cpcs.exe, 00000009.00000003.2533161271.000000000A44A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cookst.com/sentry/api/20110306.exeW
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.czsoft.go1.icpcn.com/
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.desksave.de
Source: cpcs.exe, 00000009.00000003.2556561426.0000000007934000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.emule-project.net
Source: cpcs.exe, 00000009.00000003.2556561426.0000000007934000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.eyuyan.com)
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.go2000.cn
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.go2000.cn.&
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com0
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com039~$
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.grandesgans.com/Vista.com
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.grandesgans.com/Vista.comr.
Source: cpcs.exe, 00000009.00000003.2556561426.0000000006534000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2533630438.000000000A445000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.heaventools.com)
Source: chica-pc-shield-1-75-0-1300-en-win.tmp, chica-pc-shield-1-75-0-1300-en-win.tmp, 00000001.00000000.2033381655.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.innosetup.com/
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jetswap.comD
Source: cpcs.exe, 00000009.00000003.2509521137.0000000003556000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.malwarebytes.o
Source: cpcs.exe, 00000009.00000003.2509521137.0000000003553000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.malwarebytes.oY
Source: cpcsgui.exe	String found in binary or memory: http://www.malwarebytes.or
Source: cpcs.exe, 00000009.00000003.2510009992.0000000003565000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2510085331.000000000355F000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509982383.000000000355F000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509409389.0000000003565000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509325799.000000000355F000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509920343.000000000354D000.00000004.00000020.00020000.00000000.sdmp, cpcsgui.exe	String found in binary or memory: http://www.malwarebytes.org
Source: cpcsgui.exe	String found in binary or memory: http://www.malwarebytes.org/products
Source: cpcsgui.exe	String found in binary or memory: http://www.malwarebytes.org/products/
Source: cpcsgui.exe	String found in binary or memory: http://www.malwarebytes.org/products/chameleon
Source: cpcsgui.exe	String found in binary or memory: http://www.malwarebytes.org/products/fil
Source: cpcsgui.exe	String found in binary or memory: http://www.malwarebytes.org/products/file
Source: cpcsgui.exe	String found in binary or memory: http://www.malwarebytes.org/products/fileass
Source: cpcsgui.exe	String found in binary or memory: http://www.malwarebytes.org/products/fileassassin
Source: cpcsgui.exe	String found in binary or memory: http://www.malwarebytes.org/products/mbar
Source: cpcsgui.exe	String found in binary or memory: http://www.malwarebytes.org/products/startuplite
Source: cpcs.exe, 00000009.00000003.2528855901.000000000A101000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.niudoudou.com/web/download/
Source: cpcs.exe, 00000009.00000003.2528855901.000000000A101000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.niudoudou.com/web/download/=H
Source: cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ntkrnl.com
Source: cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ntkrnl.comy
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pdfforge.org/
Source: cpcs.exe, 00000009.00000003.2556561426.0000000006534000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.qqceo.net
Source: chica-pc-shield-1-75-0-1300-en-win.exe, 00000000.00000003.2032976073.0000000002128000.00000004.00001000.00020000.00000000.sdmp, chica-pc-shield-1-75-0-1300-en-win.exe, 00000000.00000003.2032819935.00000000023F0000.00000004.00001000.00020000.00000000.sdmp, chica-pc-shield-1-75-0-1300-en-win.tmp, chica-pc-shield-1-75-0-1300-en-win.tmp, 00000001.00000000.2033381655.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.remobjects.com/ps
Source: chica-pc-shield-1-75-0-1300-en-win.exe, 00000000.00000003.2032976073.0000000002128000.00000004.00001000.00020000.00000000.sdmp, chica-pc-shield-1-75-0-1300-en-win.exe, 00000000.00000003.2032819935.00000000023F0000.00000004.00001000.00020000.00000000.sdmp, chica-pc-shield-1-75-0-1300-en-win.tmp, 00000001.00000000.2033381655.0000000000401000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.remobjects.com/psU
Source: cpcs.exe, 00000009.00000003.2529369405.0000000009D87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.rivalgaming.com/ClientPrivacyPolicy.rg0
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2533842656.000000000A4B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.skrsoftware.com/
Source: cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.super-ec.cnhttp://wghai.com/echttp://qsyou.com
Source: cpcs.exe, 00000009.00000003.2509409389.0000000003565000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509325799.000000000355F000.00000004.00000020.00020000.00000000.sdmp, cpcsgui.exe	String found in binary or memory: http://www.w3.
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ww-xxooxx-ch.net
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.zippay.ru/robo-pay.php?lang=
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xdinheirox.rememberit.com.au/
Source: cpcsscheduler.exe, 0000000E.00000002.3285698951.000000006BCC3000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://xml.org/sax/features/external-general-entities
Source: cpcsscheduler.exe, 0000000E.00000002.3285698951.000000006BCC3000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://xml.org/sax/features/external-parameter-entities
Source: cpcsscheduler.exe, 0000000E.00000002.3285698951.000000006BCC3000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://xml.org/sax/features/namespace-prefixes
Source: cpcsscheduler.exe, 0000000E.00000002.3285698951.000000006BCC3000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://xml.org/sax/features/namespaces
Source: cpcsscheduler.exe, 0000000E.00000002.3285698951.000000006BCC3000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://xml.org/sax/features/string-interning
Source: cpcsscheduler.exe, 0000000E.00000002.3285698951.000000006BCC3000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://xml.org/sax/features/validation
Source: cpcsscheduler.exe, 0000000E.00000002.3285698951.000000006BCC3000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://xml.org/sax/properties/declaration-handler
Source: cpcsscheduler.exe, 0000000E.00000002.3285698951.000000006BCC3000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://xml.org/sax/properties/lexical-handler

Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921

Spam, unwanted Advertisements and Ransom Demands

Yara detected KillMBR

Source: Yara match

File source: Process Memory Space: cpcs.exe PID: 2412, type: MEMORYSTR

Operating System Destruction

Yara detected KillMBR

Source: Yara match

File source: Process Memory Space: cpcs.exe PID: 2412, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000012.00000003.2839561000.000000000CFD9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Xtrem RAT v3.5 Author: Jean-Philippe Teissier / @Jipe_
Source: 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: thequickbrow_APT1 Author: AlienVault Labs
Source: 00000009.00000003.2546777163.000000000C828000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Xtrem RAT v3.5 Author: Jean-Philippe Teissier / @Jipe_
Source: 00000009.00000003.2545861202.000000000D4FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Xtrem RAT v3.5 Author: Jean-Philippe Teissier / @Jipe_
Source: 00000012.00000003.2839681114.000000000D42B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Xtrem RAT v3.5 Author: Jean-Philippe Teissier / @Jipe_
Source: 0000000F.00000003.2652428311.0000000004663000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: 9002 Identifying Strings Author: Seth Hardy
Source: 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Fireball malware - file clearlog.dll Author: Florian Roth
Source: 00000012.00000003.2843530652.000000000847A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Fireball malware - file clearlog.dll Author: Florian Roth
Source: 0000000F.00000003.2648389472.0000000008271000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Fireball malware - file clearlog.dll Author: Florian Roth
Source: Process Memory Space: cpcs.exe PID: 2412, type: MEMORYSTR	Matched rule: thequickbrow_APT1 Author: AlienVault Labs
Source: Process Memory Space: cpcs.exe PID: 2412, type: MEMORYSTR	Matched rule: 9002 Identifying Strings Author: Seth Hardy

Yara detected Xtreme RAT

Source: Yara match

File source: Process Memory Space: cpcs.exe PID: 2412, type: MEMORYSTR

Found PHP interpreter

Source: cpcs.exe, 00000009.00000003.2556561426.0000000006534000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: POLY=Backdoor.Tidserv && VERSION=1, The PHP Group && VERSION=7, php.exe && STRINGS=590, 00405F77696E6F63
Source: cpcs.exe, 00000009.00000003.2556561426.0000000006534000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: POLY=Rootkit.TDSS && VERSION=1, The PHP Group && VERSION=7, php.exe && STRINGS=23973, 616669735C7300637264725C256F3F2E62007664655B726C5C735D7C6D63765C67003F645D0000005A006F72747325
Source: cpcs.exe, 00000009.00000003.2556561426.0000000006534000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: POLY=Rootkit.TDSS.Gen && SIZE=70000, 1500000 && VERSION=1, The PHP Group && VERSION=3, 5.2.11.11 && VERSION=7, php.exe
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: POLY=Backdoor.Tidserv && VERSION=1, The PHP Group && VERSION=7, php.exe && STRINGS=590, 00405F77696E6F63
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: POLY=Rootkit.TDSS && VERSION=1, The PHP Group && VERSION=7, php.exe && STRINGS=23973, 616669735C7300637264725C256F3F2E62007664655B726C5C735D7C6D63765C67003F645D0000005A006F72747325
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: POLY=Rootkit.TDSS.Gen && SIZE=70000, 1500000 && VERSION=1, The PHP Group && VERSION=3, 5.2.11.11 && VERSION=7, php.exe
Source: cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: The PHP Group

Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_0042F520 NtdllDefWindowProc_A,	1_2_0042F520
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_00423B84 NtdllDefWindowProc_A,	1_2_00423B84
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_004125D8 NtdllDefWindowProc_A,	1_2_004125D8
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_00478648 NtdllDefWindowProc_A,	1_2_00478648
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_0045746C PostMessageA,PostMessageA,SetForegroundWindow,NtdllDefWindowProc_A,	1_2_0045746C

Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp

Code function: 1_2_0042E934: CreateFileA,DeviceIoControl,GetLastError,CloseHandle,SetLastError,

1_2_0042E934

Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe

Code function: 12_2_6F872930 CloseServiceHandle,ControlService,DeleteService,CloseServiceHandle,Sleep,CloseServiceHandle,CloseServiceHandle,

12_2_6F872930

Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe

Code function: 14_2_008E5DD0 DuplicateTokenEx,CloseHandle,CloseHandle,CloseHandle,CreateEnvironmentBlock,CloseHandle,_memset,CreateProcessAsUserW,DestroyEnvironmentBlock,CloseHandle,DestroyEnvironmentBlock,CloseHandle,CloseHandle,CloseHandle,

14_2_008E5DD0

Source: C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe	Code function: 0_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		0_2_00409448
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_004555E4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		1_2_004555E4

Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp

File created: C:\Windows\system32\drivers\is-VCK25.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\Windows\system32\drivers\is-VCK25.tmp			Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe	Code function: 0_2_0040840C	0_2_0040840C
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_0048053F	1_2_0048053F
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_00470584	1_2_00470584
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_0046727C	1_2_0046727C
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_004352C8	1_2_004352C8
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_0048DA5C	1_2_0048DA5C
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_0043035C	1_2_0043035C
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_004444C8	1_2_004444C8
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_004345C4	1_2_004345C4
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_00486720	1_2_00486720
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_00444A70	1_2_00444A70
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_00430EE8	1_2_00430EE8
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_0045EF9C	1_2_0045EF9C
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_0045B04C	1_2_0045B04C
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_00445168	1_2_00445168
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_004692DC	1_2_004692DC
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_00445574	1_2_00445574
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_00487680	1_2_00487680
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_004519BC	1_2_004519BC
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_0043DD50	1_2_0043DD50
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005DA210	12_2_005DA210
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005F22DD	12_2_005F22DD
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005EE281	12_2_005EE281
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005BC3C0	12_2_005BC3C0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005E8410	12_2_005E8410
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005FC4E4	12_2_005FC4E4
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005F267B	12_2_005F267B
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005FA62E	12_2_005FA62E
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005DE6F0	12_2_005DE6F0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005E47F0	12_2_005E47F0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005C4790	12_2_005C4790
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005F2A4D	12_2_005F2A4D
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005FAB7F	12_2_005FAB7F
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005B4CD0	12_2_005B4CD0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005F8D90	12_2_005F8D90
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005F2E35	12_2_005F2E35
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005FB0D0	12_2_005FB0D0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005E5110	12_2_005E5110
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005DF3B0	12_2_005DF3B0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005B1410	12_2_005B1410
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005B5560	12_2_005B5560
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005FB7AC	12_2_005FB7AC
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005B5860	12_2_005B5860
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005D9930	12_2_005D9930
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005B79E0	12_2_005B79E0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005DBB30	12_2_005DBB30
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005B5D40	12_2_005B5D40
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005F1E48	12_2_005F1E48
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005C3E40	12_2_005C3E40
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005B1EF0	12_2_005B1EF0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6BB950F0	12_2_6BB950F0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6BB57020	12_2_6BB57020
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6BB76B10	12_2_6BB76B10
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6BB5BB50	12_2_6BB5BB50
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6BB51AE0	12_2_6BB51AE0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6BB53900	12_2_6BB53900
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6BB5E8D0	12_2_6BB5E8D0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6BB68F97	12_2_6BB68F97
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6BB9EFF4	12_2_6BB9EFF4
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6BB76F20	12_2_6BB76F20
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6BB9BF20	12_2_6BB9BF20
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6BBAEF44	12_2_6BBAEF44
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6BB95DB0	12_2_6BB95DB0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6BB90CD0	12_2_6BB90CD0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6BB903E0	12_2_6BB903E0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6BB53240	12_2_6BB53240
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6BB671A0	12_2_6BB671A0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6BB54133	12_2_6BB54133
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6BB66080	12_2_6BB66080
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6BB5F000	12_2_6BB5F000
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6BB68045	12_2_6BB68045
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6BB5F7CC	12_2_6BB5F7CC
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6BB6376C	12_2_6BB6376C
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6BB925C0	12_2_6BB925C0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6BB5C480	12_2_6BB5C480
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6BB52400	12_2_6BB52400
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6BB62450	12_2_6BB62450
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F88CDF0	12_2_6F88CDF0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F85B9E0	12_2_6F85B9E0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F852ED0	12_2_6F852ED0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F896C84	12_2_6F896C84
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F854C50	12_2_6F854C50
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F888C70	12_2_6F888C70
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F8A4BD0	12_2_6F8A4BD0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F864AE0	12_2_6F864AE0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F8A2890	12_2_6F8A2890
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F86A7D0	12_2_6F86A7D0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F85C7E0	12_2_6F85C7E0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F86E690	12_2_6F86E690
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F8A467F	12_2_6F8A467F
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F88A590	12_2_6F88A590
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F89C4D5	12_2_6F89C4D5
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F852420	12_2_6F852420
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F888390	12_2_6F888390
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F892310	12_2_6F892310
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F86A1F0	12_2_6F86A1F0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F8A412E	12_2_6F8A412E
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F8700A0	12_2_6F8700A0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F89C0ED	12_2_6F89C0ED
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F8A5FE4	12_2_6F8A5FE4
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F89BD1B	12_2_6F89BD1B
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F86BD60	12_2_6F86BD60
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F869C00	12_2_6F869C00
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F86FAA0	12_2_6F86FAA0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F88DAB0	12_2_6F88DAB0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F8739F0	12_2_6F8739F0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F89B97D	12_2_6F89B97D
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F861720	12_2_6F861720
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F873720	12_2_6F873720
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F89B4E8	12_2_6F89B4E8
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F86B370	12_2_6F86B370
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F8A52AC	12_2_6F8A52AC
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F86F260	12_2_6F86F260
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F8511E0	12_2_6F8511E0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_3_033C236A	12_3_033C236A
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_008EC0D0	14_2_008EC0D0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_0091B027	14_2_0091B027
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_009091D0	14_2_009091D0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_009211DF	14_2_009211DF
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_008EE140	14_2_008EE140
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_0091D3F0	14_2_0091D3F0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_0091F3F0	14_2_0091F3F0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_009103F0	14_2_009103F0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_0091B3F9	14_2_0091B3F9
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_008E3520	14_2_008E3520
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_0091A7F4	14_2_0091A7F4
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_0091B7E1	14_2_0091B7E1
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_00921730	14_2_00921730
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_0090C740	14_2_0090C740
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_00907870	14_2_00907870
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_00922B44	14_2_00922B44
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_0091AC89	14_2_0091AC89
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_00920C8E	14_2_00920C8E
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_00921E0C	14_2_00921E0C
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_00906F90	14_2_00906F90
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6BB950F0	14_2_6BB950F0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6BB57020	14_2_6BB57020
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6BB76B10	14_2_6BB76B10
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6BB5BB50	14_2_6BB5BB50
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6BB51AE0	14_2_6BB51AE0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6BB53900	14_2_6BB53900
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6BB5E8D0	14_2_6BB5E8D0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6BB68F97	14_2_6BB68F97
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6BB9EFF4	14_2_6BB9EFF4
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6BB76F20	14_2_6BB76F20
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6BB9BF20	14_2_6BB9BF20
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6BBAEF44	14_2_6BBAEF44
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6BB95DB0	14_2_6BB95DB0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6BB90CD0	14_2_6BB90CD0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6BB903E0	14_2_6BB903E0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6BB53240	14_2_6BB53240
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6BB671A0	14_2_6BB671A0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6BB54133	14_2_6BB54133
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6BB66080	14_2_6BB66080
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6BB5F000	14_2_6BB5F000
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6BB68045	14_2_6BB68045
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6BB5F7CC	14_2_6BB5F7CC
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6BB6376C	14_2_6BB6376C
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6BB925C0	14_2_6BB925C0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6BB5C480	14_2_6BB5C480
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6BB52400	14_2_6BB52400
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6BB62450	14_2_6BB62450
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F88CDF0	14_2_6F88CDF0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F85B9E0	14_2_6F85B9E0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F852ED0	14_2_6F852ED0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F896C84	14_2_6F896C84
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F854C50	14_2_6F854C50
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F888C70	14_2_6F888C70
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F8A4BD0	14_2_6F8A4BD0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F864AE0	14_2_6F864AE0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F8A2890	14_2_6F8A2890
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F86A7D0	14_2_6F86A7D0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F85C7E0	14_2_6F85C7E0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F86E690	14_2_6F86E690
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F8A467F	14_2_6F8A467F
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F88A590	14_2_6F88A590
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F89C4D5	14_2_6F89C4D5
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F852420	14_2_6F852420
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F888390	14_2_6F888390
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F892310	14_2_6F892310
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F86A1F0	14_2_6F86A1F0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F8A412E	14_2_6F8A412E
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F8700A0	14_2_6F8700A0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F89C0ED	14_2_6F89C0ED
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F8A5FE4	14_2_6F8A5FE4
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F89BD1B	14_2_6F89BD1B
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F86BD60	14_2_6F86BD60
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F869C00	14_2_6F869C00
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F86FAA0	14_2_6F86FAA0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F88DAB0	14_2_6F88DAB0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F8739F0	14_2_6F8739F0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F89B97D	14_2_6F89B97D
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F861720	14_2_6F861720
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F873720	14_2_6F873720
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F89B4E8	14_2_6F89B4E8
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F86B370	14_2_6F86B370
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F8A52AC	14_2_6F8A52AC
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F86F260	14_2_6F86F260
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F8511E0	14_2_6F8511E0

Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: String function: 00408C0C appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: String function: 00406AC4 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: String function: 0040595C appears 117 times
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: String function: 00403400 appears 60 times
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: String function: 00445DD4 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: String function: 004344DC appears 32 times
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: String function: 004078F4 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: String function: 00403494 appears 82 times
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: String function: 00457DF4 appears 73 times
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: String function: 00457BE8 appears 94 times
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: String function: 00403684 appears 224 times
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: String function: 00453344 appears 94 times
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: String function: 004460A4 appears 59 times
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: String function: 6F895C50 appears 36 times
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: String function: 6BBB1303 appears 78 times
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: String function: 6F853910 appears 41 times
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: String function: 0090D53A appears 64 times
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: String function: 0090EF60 appears 33 times
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: String function: 008E1450 appears 138 times
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: String function: 6F856530 appears 139 times
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: String function: 6F88F635 appears 79 times
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: String function: 005ECC60 appears 34 times
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: String function: 6F895C50 appears 36 times
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: String function: 6BBB1303 appears 78 times
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: String function: 6F853910 appears 41 times
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: String function: 005E6ABC appears 70 times
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: String function: 6F88F635 appears 79 times

Source: chica-pc-shield-1-75-0-1300-en-win.exe	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: chica-pc-shield-1-75-0-1300-en-win.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: chica-pc-shield-1-75-0-1300-en-win.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: chica-pc-shield-1-75-0-1300-en-win.tmp.0.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: is-L12IJ.tmp.1.dr	Static PE information: Resource name: DRIVERTYPE type: PE32 executable (native) Intel 80386, for MS Windows
Source: is-L12IJ.tmp.1.dr	Static PE information: Resource name: DRIVERTYPE type: PE32 executable (native) Intel 80386, for MS Windows
Source: is-DB4G5.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-DB4G5.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-DB4G5.tmp.1.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped

Source: chica-pc-shield-1-75-0-1300-en-win.exe, 00000000.00000003.2032976073.0000000002128000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs chica-pc-shield-1-75-0-1300-en-win.exe
Source: chica-pc-shield-1-75-0-1300-en-win.exe, 00000000.00000003.2032819935.00000000023F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs chica-pc-shield-1-75-0-1300-en-win.exe

Source: chica-pc-shield-1-75-0-1300-en-win.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: 00000012.00000003.2839561000.000000000CFD9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: xtremrat date = 2012-07-12, filetype = memory, author = Jean-Philippe Teissier / @Jipe_, description = Xtrem RAT v3.5, version = 1.0
Source: 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: thequickbrow_APT1 author = AlienVault Labs, info = CommentCrew-threat-apt1
Source: 00000009.00000003.2546777163.000000000C828000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: xtremrat date = 2012-07-12, filetype = memory, author = Jean-Philippe Teissier / @Jipe_, description = Xtrem RAT v3.5, version = 1.0
Source: 00000009.00000003.2545861202.000000000D4FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: xtremrat date = 2012-07-12, filetype = memory, author = Jean-Philippe Teissier / @Jipe_, description = Xtrem RAT v3.5, version = 1.0
Source: 00000012.00000003.2839681114.000000000D42B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: xtremrat date = 2012-07-12, filetype = memory, author = Jean-Philippe Teissier / @Jipe_, description = Xtrem RAT v3.5, version = 1.0
Source: 0000000F.00000003.2652428311.0000000004663000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: APT9002Strings author = Seth Hardy, description = 9002 Identifying Strings, last_modified = 2014-06-25
Source: 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: clearlog date = 2017-06-02, hash1 = 14093ce6d0fe8ab60963771f48937c669103842a0400b8d97f829b33c420f7e3, author = Florian Roth, description = Detects Fireball malware - file clearlog.dll, reference = https://goo.gl/4pTkGQ, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000012.00000003.2843530652.000000000847A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: clearlog date = 2017-06-02, hash1 = 14093ce6d0fe8ab60963771f48937c669103842a0400b8d97f829b33c420f7e3, author = Florian Roth, description = Detects Fireball malware - file clearlog.dll, reference = https://goo.gl/4pTkGQ, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000F.00000003.2648389472.0000000008271000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: clearlog date = 2017-06-02, hash1 = 14093ce6d0fe8ab60963771f48937c669103842a0400b8d97f829b33c420f7e3, author = Florian Roth, description = Detects Fireball malware - file clearlog.dll, reference = https://goo.gl/4pTkGQ, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Process Memory Space: cpcs.exe PID: 2412, type: MEMORYSTR	Matched rule: thequickbrow_APT1 author = AlienVault Labs, info = CommentCrew-threat-apt1
Source: Process Memory Space: cpcs.exe PID: 2412, type: MEMORYSTR	Matched rule: APT9002Strings author = Seth Hardy, description = 9002 Identifying Strings, last_modified = 2014-06-25

Source: cpcs.exe, 00000009.00000003.2533389394.000000000A5B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: V2\custom\Project1.vbpQ
Source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 3)\Project1.vbp
Source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: +tub.vbp
Source: cpcs.exe, 00000009.00000003.2533842656.000000000A4B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Basic\nLoader\Projekt1.vbp3
Source: cpcs.exe, 00000009.00000003.2533842656.000000000A4B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 20 Prof Updater\Project1.vbpo
Source: cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\????????????.vbp
Source: cpcs.exe, 00000009.00000003.2533842656.000000000A4B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ouveau dossier (3)\Project1.vbp
Source: cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AD:\??????.vbpyc
Source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v5\Server\Project1.vbp
Source: cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AC:\????????.vbp>d
Source: cpcs.exe, 00000009.00000003.2532883037.000000000A55F000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529734518.000000000A248000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows.vbp
Source: cpcs.exe, 00000009.00000003.2533842656.000000000A4B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Logoff.vbp
Source: cpcs.exe, 00000009.00000003.2533630438.000000000A445000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Documents and Settings\Administrador\Desktop\new project\New_Project1.vbp?
Source: cpcs.exe, 00000009.00000003.2529369405.0000000009D87000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: N\IEAdBlocker.vbp%
Source: cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\????????????.vbpOc
Source: cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: *\AC:\??????.vbp
Source: cpcs.exe, 00000009.00000003.2533842656.000000000A4B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AJ:\Jhocko\Loader\Loader.vbpw
Source: chica-pc-shield-1-75-0-1300-en-win.tmp, 00000001.00000003.2789847670.0000000004E63000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: (*\AC:\SteveMac\VB6\Controls\S-Grid5\pVBALGrid6.vbpH\
Source: cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\??????.vbp?c
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ????.vbp
Source: cpcs.exe, 00000009.00000003.2533842656.000000000A4B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: uveau dossier (3)\Project1.vbp
Source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \calculator.vbp
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\GroundPlayer.vbpen#
Source: cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\DZYA.vbp
Source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: z1.vbpY
Source: cpcs.exe, 00000009.00000003.2556561426.0000000006534000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=Trojan.VBPacked && SIZE=240000, 265000 && RESOURCE=RT_ICON, 1403, AAD517AAD504CBEE04CBEE04CBEE04CBEE3ABEDA32AA6492454D92454DA6666A2D3ECC4E77D72B42D42831CA2D3ECC2D3ECC2F9059 && PESECTION=1, * && VOFFSET=424, 8, 15, 504543
Source: cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\pzFBNe.vbp
Source: cpcs.exe, 00000009.00000003.2533842656.000000000A4B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: _Generated-3\Project1.vbp
Source: cpcs.exe, 00000009.00000003.2533389394.000000000A5B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Server\winlog.vbp
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\????????????????????.vbpe1WH4
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: *\AC:\????????????????\Modif\ica\??????????????\Computer ???? ??????ica d orp\???????????? ???????????? ??r EMINEMOr????????a.vbp
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mmmm?.vbp
Source: cpcs.exe, 00000009.00000003.2533389394.000000000A5B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \M3\Desktop\CR\ST\S.vbp
Source: cpcs.exe, 00000009.00000003.2533842656.000000000A4B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Santos\Desktop\Stub\stub.vbp
Source: cpcs.exe, 00000009.00000003.2529734518.000000000A248000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2532883037.000000000A53D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: *\AF:\untitled01\new\7\tools\backup\Project1.vbp
Source: cpcs.exe, 00000009.00000003.2533389394.000000000A5B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: itc\it_inst\Project1.vbp=,
Source: cpcs.exe, 00000009.00000003.2528855901.000000000A101000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AZ:\q\q.vbp
Source: cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\??????.vbp
Source: cpcs.exe, 00000009.00000003.2533161271.000000000A44A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AC:\sethc.vbpu
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Mdx 0\Osigsnad drsydcao1.vbp0000
Source: cpcs.exe, 00000009.00000003.2533389394.000000000A5B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: oGachi to Gachito.vbpC.
Source: cpcs.exe, 00000009.00000003.2533842656.000000000A4B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: M3\Desktop\Machine\Setup.vbpZ
Source: cpcs.exe, 00000009.00000003.2529734518.000000000A248000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @*\AC:\Project1.vbpown65
Source: cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\??????????.vbp^c
Source: cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\??????.vbpEc
Source: cpcs.exe, 00000009.00000003.2528855901.000000000A101000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win11\DirtyBusinessNewMod.vbp
Source: cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\dTtI.vbpbp
Source: cpcs.exe, 00000009.00000003.2533389394.000000000A5B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \EXE\Project1.vbp
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AH:\V1.0\Project1.vbp
Source: cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: D:\????????.vbp!
Source: cpcs.exe, 00000009.00000003.2529734518.000000000A248000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Bureau\Copie de Nouveau dossier (3)\Project1.vbp
Source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CommonDialog_Class.vbp
Source: cpcs.exe, 00000009.00000003.2533526590.000000000A5DD000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2534960911.000000000A5DD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Bureau\Copie de Nouveau dossier (3)\Project1.vbpQ
Source: cpcs.exe, 00000009.00000003.2533842656.000000000A4B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: john\Desktop\Stub\stub.vbpN
Source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NYHOMv.vbpN~
Source: cpcs.exe, 00000009.00000003.2533389394.000000000A5B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Priv8\Project1.vbp
Source: cpcs.exe, 00000009.00000003.2529369405.0000000009D87000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \GoogleGroupsBHO.vbpW
Source: cpcs.exe, 00000009.00000003.2533389394.000000000A5B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: *\AD:\Projekt1.vbp
Source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \GoogleGroupsBHO.vbp
Source: cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\????????????.vbpcc
Source: cpcs.exe, 00000009.00000003.2533389394.000000000A5B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: New Folder\Project1.vbp
Source: chica-pc-shield-1-75-0-1300-en-win.tmp, 00000001.00000003.2789847670.0000000004E5C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: .*\AC:\SteveMac\VB6\XHELPE~1\SSubTmr\SubTimer6.vbp
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0zcyfqrkkdgt opgz\|kxrcbpWqe\|oml6.vbp
Source: cpcs.exe, 00000009.00000003.2533389394.000000000A5B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: fgf.vbp
Source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \newwish\uniedit.vbp
Source: cpcs.exe, 00000009.00000003.2533389394.000000000A5B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \serv\Project1.vbp
Source: cpcs.exe, 00000009.00000003.2529369405.0000000009D87000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\??????????????.vbp?A
Source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \JKMobile.vbp
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: z1.vbper
Source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Simple\Stub\stub.vbp8
Source: cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AC:\????????.vbp"c
Source: cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\????????.vbpHc
Source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: io\deho\deho.vbp
Source: cpcs.exe, 00000009.00000003.2529369405.0000000009D87000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\??????????????????.vbp
Source: cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AC:\??????.vbp,c
Source: cpcs.exe, 00000009.00000003.2533842656.000000000A4B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: *\AC:\Stub3\GqtM3.vbp
Source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Nero.vbp
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \newwish\uniedit.vbpxe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000007934000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=Trojan.VBPassSteal && STRINGS=1169, 62737465616C65725F6C6F6164 && STRINGS=128, B71207DBF3736988F3736988F3736988 && STRINGS=987, 332E30300055505821
Source: cpcs.exe, 00000009.00000003.2533389394.000000000A5B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \puxa vb\viks.vbp7
Source: cpcs.exe, 00000009.00000003.2529369405.0000000009D87000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Server\winlog.vbpn
Source: cpcs.exe, 00000009.00000003.2528855901.000000000A101000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Tool Febrero\Proyecto1.vbp
Source: cpcs.exe, 00000009.00000003.2533161271.000000000A44A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sax 0\Pdoaeatsd.vbpq
Source: cpcs.exe, 00000009.00000003.2528855901.000000000A101000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\????????????????????????????.vbpTY
Source: cpcs.exe, 00000009.00000003.2533389394.000000000A5B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PCsig2\stub\STUB.vbp'
Source: cpcs.exe, 00000009.00000003.2533842656.000000000A4B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: *\AE:\Projekt1.vbp9
Source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \Santa\Project1.vbpU
Source: cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\??????.vbprc
Source: cpcs.exe, 00000009.00000003.2528855901.000000000A101000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Mdx 0\Osigsnad drsydcao1.vbpsL
Source: cpcs.exe, 00000009.00000003.2533842656.000000000A4B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \_new3_test_006\project1.vbp
Source: cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\????????.vbp
Source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \IMPORTANT.vbp>s
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: X\Server\Project1.vbpn
Source: cpcs.exe, 00000009.00000003.2528855901.000000000A101000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Y:\code\prog\my\mycall.vbp
Source: cpcs.exe, 00000009.00000003.2533161271.000000000A44A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: free\leader\driver.vbp
Source: cpcs.exe, 00000009.00000003.2533842656.000000000A4D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Generated-1\Project1.vbp^
Source: cpcs.exe, 00000009.00000003.2533161271.000000000A44A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\ssss\VEhvdQTbQ.vbp
Source: cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AC:\??????????.vbp

Source: classification engine

Classification label: mal54.rans.troj.evad.winEXE@30/92@19/3

Source: C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe	Code function: 0_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	0_2_00409448
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_004555E4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,	1_2_004555E4
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F85FAE0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,CloseHandle,AdjustTokenPrivileges,CloseHandle,CloseHandle,	12_2_6F85FAE0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F85FAE0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,CloseHandle,AdjustTokenPrivileges,CloseHandle,CloseHandle,	14_2_6F85FAE0

Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp

Code function: 1_2_00455E0C GetModuleHandleA,GetProcAddress,GetDiskFreeSpaceExA,GetDiskFreeSpaceA,

1_2_00455E0C

Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: CloseServiceHandle,CreateServiceW,GetLastError,OpenServiceW,		12_2_6F88EBA0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: CloseServiceHandle,CreateServiceW,GetLastError,OpenServiceW,		14_2_6F88EBA0

Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe

Code function: 12_2_005BB070 CharUpperW,CreateToolhelp32Snapshot,Process32FirstW,CharUpperW,Process32NextW,CloseHandle,

12_2_005BB070

Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp

Code function: 1_2_00456574 CoCreateInstance,CoCreateInstance,SysFreeString,SysFreeString,

1_2_00456574

Source: C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe

Code function: 0_2_00409BEC FindResourceA,SizeofResource,LoadResource,LockResource,

0_2_00409BEC

Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe

Code function: 12_2_6F872F00 CloseServiceHandle,ChangeServiceConfigW,CloseServiceHandle,CloseServiceHandle,

12_2_6F872F00

Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe

Code function: 14_2_008E1E80 StartServiceCtrlDispatcherW,

14_2_008E1E80

Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp

File created: C:\Program Files (x86)\ChicaLogic

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	Mutant created: NULL
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Mutant created: \Sessions\1\BaseNamedObjects\CPCSScannerMutex

Source: C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe

File created: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp

Jump to behavior

Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Command line argument: kernel32.dll	12_2_005B3D10
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Command line argument: /silent	12_2_005B3D10
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Command line argument: /install	12_2_005B3D10
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Command line argument: /uninstall	12_2_005B3D10
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Command line argument: /stop	12_2_005B3D10
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Command line argument: /starttray	12_2_005B3D10
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Command line argument: /startalways	12_2_005B3D10
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Command line argument: PK_	12_2_005F4AA0

Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: cpcsgui.exe	String found in binary or memory: /stop
Source: cpcsgui.exe	String found in binary or memory: /stop
Source: cpcsgui.exe	String found in binary or memory: /install

Source: C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe

File read: C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe "C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe"
Source: C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe	Process created: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp "C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp" /SL5="$20430,8630815,54272,C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe"
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\mbamext.dll"
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\ssubtmr6.dll"
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\vbalsgrid6.ocx"
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Process created: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe" /starttrial
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\ssubtmr6.dll"
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\vbalsgrid6.ocx"
Source: unknown	Process created: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe" /install /silent
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe"
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Process created: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe" /update
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\ssubtmr6.dll"
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\vbalsgrid6.ocx"
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Process created: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe"
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\ssubtmr6.dll"
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\vbalsgrid6.ocx"
Source: C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe	Process created: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp "C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp" /SL5="$20430,8630815,54272,C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\mbamext.dll"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\ssubtmr6.dll"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\vbalsgrid6.ocx"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Process created: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe" /starttrial	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Process created: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe" /update	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Process created: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe"	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\ssubtmr6.dll"	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\vbalsgrid6.ocx"	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\ssubtmr6.dll"
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\vbalsgrid6.ocx"
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\ssubtmr6.dll"
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\vbalsgrid6.ocx"

Source: C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: msvbvm60.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: msvbvm60.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: msvbvm60.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: vb6zz.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: mbam.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: advpack.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: asycfilt.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: mbamcore.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: mbamnet.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: msvbvm60.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: msvbvm60.dll	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Section loaded: mbam.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Section loaded: mbamnet.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Section loaded: mbam.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Section loaded: mbamnet.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: msvbvm60.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: vb6zz.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: sxs.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: mbam.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: advpack.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: asycfilt.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: mbamcore.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: mpr.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: dataexchange.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: d3d11.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: dcomp.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: dxgi.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: twinapi.appcore.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: textshaping.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: ieframe.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: wkscli.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: msiso.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: mshtml.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: srpapi.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: textinputframework.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: coremessaging.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: coremessaging.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: mbamnet.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: msimtf.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: msls31.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: d2d1.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: dwrite.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: d3d10warp.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: dxcore.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: mlang.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: msvbvm60.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: msvbvm60.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: msvbvm60.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: vb6zz.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: sxs.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: mbam.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: advpack.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: olepro32.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: asycfilt.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: mbamcore.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: mpr.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: dataexchange.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: d3d11.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: dcomp.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: dxgi.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: twinapi.appcore.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: textshaping.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: ieframe.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: iertutil.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: netapi32.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: winhttp.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: wkscli.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: netutils.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: urlmon.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: srvcli.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: msiso.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: mshtml.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: powrprof.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: umpdc.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: textinputframework.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: coremessaging.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: coremessaging.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: srpapi.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: mbamnet.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: msimtf.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: msls31.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: d2d1.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: dwrite.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: d3d10warp.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: dxcore.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: secur32.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: mlang.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: msvbvm60.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: msvbvm60.dll

Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: ChicaPC-Shield Notifications.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe
Source: Uninstall ChicaPC-Shield.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\Program Files (x86)\ChicaLogic\ChicaPC-Shield\unins000.exe
Source: ChicaPC-Shield.lnk.1.dr	LNK file: ..\..\..\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe
Source: ChicaPC-Shield.lnk0.1.dr	LNK file: ..\..\..\..\..\..\..\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe

Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp

Window found: window name: TSelectLanguageForm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Automated click: I accept the agreement
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Automated click: OK
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: chica-pc-shield-1-75-0-1300-en-win.exe

Static PE information: certificate valid

Source: chica-pc-shield-1-75-0-1300-en-win.exe

Static file information: File size 8967808 > 1048576

Source:	Binary string: \ResBegleiter\obj\x86\Release\Devi.pdbb source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: :\XRoot_Build\XC\Vm\Release\x86\StubExe.pdb source: cpcs.exe, 00000009.00000003.2533389394.000000000A5B5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Server.pdb source: cpcs.exe, 00000009.00000003.2535416200.000000000A6BE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \obj\Release\Welp.pdb source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \obj\Release\Welp.pdbY{ source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: miniloader-patchdate-stub.pdb source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: DarkShell\Server\svchost\Debug\Serverz.pdb source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: w:\Project\!lego2new\lego_2011.xx.xx_2.xx\release\NSP.pdb source: cpcs.exe, 00000009.00000003.2533842656.000000000A4B5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: se\NSP.pdb source: cpcs.exe, 00000009.00000003.2529369405.0000000009D87000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\USERS\DEFAULT\APPDATA\LOCAL\TEMP\FACEBOOK\FACEBOOK STEALER.PDB source: cpcs.exe, 00000009.00000003.2545034326.000000000E01A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \sw_modem\HSF_HWICH\i386\HSFHWICH.pdb source: cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cryptnet.pdb source: cpcs.exe, 00000009.00000003.2532883037.000000000A55F000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529734518.000000000A248000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\key\sar\Debug\sar.pdbre source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\SVN\mbam\dll\mbam.dll\build\mbam.pdb source: cpcsgui.exe, 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: Intel Corporationse\NSP.pdb source: cpcs.exe, 00000009.00000003.2529369405.0000000009D87000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: vpamjon.pdb source: cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: NB10??????N????:\??????????\??W????????\????????????????????????????????????????G????\????????????\??????\????????????.pdbj source: cpcs.exe, 00000009.00000003.2532883037.000000000A55F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: hnetmon.pdb source: cpcs.exe, 00000009.00000003.2533389394.000000000A54E000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529734518.000000000A217000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2532883037.000000000A53D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sass.pdb source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Cryptor\stub6\Release\stub6.pdb source: cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: !lego2new\lego_2011.xx.xx_2.xx\release\NSP.pdb source: cpcs.exe, 00000009.00000003.2533389394.000000000A5B5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: :\UMPk.pdb source: cpcs.exe, 00000009.00000003.2535304844.0000000009F2B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\SVN\mbam\exe\mbampt.exe\build\mbampt.pdb%0A source: chica-pc-shield-1-75-0-1300-en-win.tmp, 00000001.00000003.2789847670.0000000004F26000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\WINDOWS\SERVICEPROFILES\NETWORKSERVICE\APPDATA\LOCAL\TEMP\FACEBOOK\FACEBOOK STEALER.PDB source: cpcs.exe, 00000009.00000003.2545306895.000000000E06C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \Release\AvG.pdb source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \Release\AvG.pdb>M source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\TranceCo.pdb source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\WFD\Tools\Server\_Downloader\Share\SFX Package\Pack\obj\x86\Debug\Pack.pdbE source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\USERS\user\APPDATA\LOCAL\TEMP\FACEBOOK\FACEBOOK STEALER.PDB source: cpcs.exe, 00000009.00000003.2545034326.000000000E01A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: fukmp.pdb source: cpcs.exe, 00000009.00000003.2535475306.000000000B056000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: NB10??????N????:\??????????\??W????????\????????????????????????????????????????G????\????????????\??????\????????????.pdb source: cpcs.exe, 00000009.00000003.2529734518.000000000A248000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ????????????????.pdb source: cpcs.exe, 00000009.00000003.2533389394.000000000A5B5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: aspergillus.pdb source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bk22\kloader\Release\i386\kloader.pdb source: cpcs.exe, 00000009.00000003.2529369405.0000000009D87000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Dell\Desktop\SOMA.pdb source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: fukmp.pdb% source: cpcs.exe, 00000009.00000003.2535475306.000000000B056000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: p:\vc5\x64\release\resident.pdb source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: F:\NTDDK\DEMO\_DarkTest\i386\DarkTest.pdb source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\SVN\mbam\dll\mbam.dll\build\mbam.pdb` source: cpcsgui.exe, 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\dev\stuk_rar\release\setup.pdb source: cpcs.exe, 00000009.00000003.2533161271.000000000A44A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\SVN\mbam\exe\mbamscheduler.exe\build\mbamscheduler.pdb source: chica-pc-shield-1-75-0-1300-en-win.tmp, 00000001.00000003.2789847670.0000000004EC9000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\WINDOWS\TEMP\FACEBOOK\FACEBOOK STEALER.PDB source: cpcs.exe, 00000009.00000003.2545034326.000000000DF4E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\PROGRAM FILES (X86)\FACEHACK\FACEHACK.PDB%vz$ source: cpcs.exe, 00000009.00000003.2546311082.000000000D10C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sfxrar32\Release\sfxrar.pdb source: cpcs.exe, 00000009.00000003.2532883037.000000000A55F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Socksbuilder\stub\release\stub.pdbeb source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ent.pdb0?0A source: cpcs.exe, 00000009.00000003.2533784758.000000000A13A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sxtyy.pdb source: cpcs.exe, 00000009.00000003.2535475306.000000000B056000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ?????.pdbr source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: EXTRA=Adware.Agent, %PROGRAMFILES%\Isilo\iSiloDisplaySample.pdb, DP source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: db.pdb source: cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2534960911.000000000A69B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Nuova cartella\myform\myform\obj\Release\myform.pdb source: cpcs.exe, 00000009.00000003.2533842656.000000000A4B5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: $:\tmp\test.pdb source: cpcs.exe, 00000009.00000003.2529734518.000000000A248000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529941329.000000000A2A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: :\??????????????????????????????????????.pdb source: cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z(1)\stub\Release\stub.pdbtor source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ??:\??????????\??W????????\????????????????????????????????????????G????\????????????\??????\????????????.pdb source: cpcs.exe, 00000009.00000003.2532883037.000000000A55F000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529734518.000000000A248000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: x:\werdon.pdb source: cpcs.exe, 00000009.00000003.2535304844.0000000009F2B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\d\objfre_wxp_x86\i386\HG.pdb source: cpcs.exe, 00000009.00000003.2528855901.000000000A101000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z(1)\stub\Release\stub.pdb source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: p:\vc5\x64\release\resident.pdbO6 source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ent.pdb source: cpcs.exe, 00000009.00000003.2533784758.000000000A13A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\work_temp\utf8\test2\Release\test2.pdb source: cpcs.exe, 00000009.00000003.2533161271.000000000A44A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e:\job\gh0st1.0\Release\Loader.pdb source: cpcs.exe, 00000009.00000003.2533161271.000000000A44A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: URGABPW.pdb source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: TDIMUED.pdb source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: hnetmon.pdbU source: cpcs.exe, 00000009.00000003.2533389394.000000000A54E000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2532883037.000000000A53D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: vpamjon.pdbd9 source: cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \accs\accs\accs\obj\Release\accs.pdb source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: REAPER\Stub\stub rc\obj\Release\stub rc.pdb source: cpcs.exe, 00000009.00000003.2529369405.0000000009D87000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: w:\Project\!lego2new\lego_2011.xx.xx_2.xx\release\NSP.pdb/ source: cpcs.exe, 00000009.00000003.2533842656.000000000A4B5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\key\sar\Debug\sar.pdb source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ryptnet.pdb source: cpcs.exe, 00000009.00000003.2532883037.000000000A55F000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529734518.000000000A248000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529941329.000000000A2A1000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2533526590.000000000A5A4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \Projects\reg\reg\obj\Debug\reg.pdbn source: cpcs.exe, 00000009.00000003.2529369405.0000000009D87000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sxtyy.pdb source: cpcs.exe, 00000009.00000003.2535475306.000000000B056000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WWMWCMGV.pdb source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cryptnet.pdbB source: cpcs.exe, 00000009.00000003.2529734518.000000000A248000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \Projects\reg\reg\obj\Debug\reg.pdb source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529369405.0000000009D87000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: HookDllDriver\objfre\i386\hookdll.pdb source: cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: NGPCorp\DLL\Release\DLL.pdb source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sfxrar32\Release\sfxrar.pdbPY source: cpcs.exe, 00000009.00000003.2532883037.000000000A55F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Prevazatorul.pdb[ source: cpcs.exe, 00000009.00000003.2533526590.000000000A5C7000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2533704715.000000000A5CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\TP\AppData\Local\Temp\zy3gqjbl.pdb source: cpcs.exe, 00000009.00000003.2528855901.000000000A101000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \AccountCreator.pdbk source: cpcs.exe, 00000009.00000003.2533389394.000000000A54E000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2532883037.000000000A53D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: F:\NTDDK\DEMO\_DarkTest\i386\DarkTest.pdbem source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Bacipy.pdb source: cpcs.exe, 00000009.00000003.2529369405.0000000009D87000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2533630438.000000000A445000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: IEXPLORE\Debug\wibvusd.pdb source: cpcs.exe, 00000009.00000003.2533161271.000000000A493000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2528855901.000000000A14E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 8$W:\w\Loader.pdb source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: vCrypt Stub.pdb source: cpcs.exe, 00000009.00000003.2533526590.000000000A5C7000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2533704715.000000000A5CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Prevazatorul.pdb source: cpcs.exe, 00000009.00000003.2533526590.000000000A5C7000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2533704715.000000000A5CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: &:\UMPk.pdb source: cpcs.exe, 00000009.00000003.2535304844.0000000009F2B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ?????.pdb source: cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \ResBegleiter\obj\x86\Release\Devi.pdb source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: :\tmp\test.pdb source: cpcs.exe, 00000009.00000003.2529734518.000000000A248000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529941329.000000000A2A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ld.pdb source: cpcs.exe, 00000009.00000003.2529734518.000000000A248000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529941329.000000000A2A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\work\utf8\test2\Release\test2.pdb source: cpcs.exe, 00000009.00000003.2533161271.000000000A44A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \AccountCreator.pdb source: cpcs.exe, 00000009.00000003.2533389394.000000000A54E000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529734518.000000000A217000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2532883037.000000000A53D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: XC\Vm\Release\x86\StubExe.pdb source: cpcs.exe, 00000009.00000003.2533389394.000000000A54E000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529734518.000000000A217000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2532883037.000000000A53D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Z:\xampp\htdocs\project-727,Permutation\stable\tmp\PDBSIG.pdb source: cpcs.exe, 00000009.00000003.2533842656.000000000A4B5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: :\Fecira.pdb source: cpcs.exe, 00000009.00000003.2535304844.0000000009F2B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\local0\asf\release\build-2.2.14\support\Release\ab.pdb)] source: cpcs.exe, 00000009.00000003.2528855901.000000000A101000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \Project1\Project1\obj\Release\Project1.pdb<. source: cpcs.exe, 00000009.00000003.2533389394.000000000A5B5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: W:\w\Loader.pdb source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bk22\kloader\Release\i386\kloader.pdbt,n source: cpcs.exe, 00000009.00000003.2529369405.0000000009D87000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\work\test\test2\Release\test2.pdb< source: cpcs.exe, 00000009.00000003.2529454596.000000000A126000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \Projects\War Crypter\Release\Stub.pdb source: cpcs.exe, 00000009.00000003.2533389394.000000000A5B5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\SVN Control Code\app_client\Loader\Release\Loader.pdb?_ source: cpcs.exe, 00000009.00000003.2528855901.000000000A101000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \Project1\Project1\obj\Release\Project1.pdb source: cpcs.exe, 00000009.00000003.2533389394.000000000A5B5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WWMWCMGV.pdb=; source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ??@RSDS??????????????????????????????????o.pdb source: cpcs.exe, 00000009.00000003.2533842656.000000000A4B5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \w.a.t.c.h\w.a.t.c.h\obj\Release\w.a.t.c.h.pdb source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529369405.0000000009D87000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e:\job\gh0st1.0\Release\Loader.pdb\ source: cpcs.exe, 00000009.00000003.2533161271.000000000A44A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\WINDOWS\SERVICEPROFILES\LOCALSERVICE\APPDATA\LOCAL\TEMP\FACEBOOK\FACEBOOK STEALER.PDB source: cpcs.exe, 00000009.00000003.2545306895.000000000E06C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\XRoot_Build\XC\Vm\Release\x86\StubExe.pdb source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\work\test\test2\Release\test2.pdb source: cpcs.exe, 00000009.00000003.2533161271.000000000A44A000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529454596.000000000A126000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \x86\Debug\Balle2.pdb source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\WFD\Tools\Server\_Downloader\Share\SFX Package\Pack\obj\x86\Debug\Pack.pdb source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \Emuhucuqih.pdb source: cpcs.exe, 00000009.00000003.2535475306.000000000B056000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: IEXPLORE\Debug\wibvusd.pdbR source: cpcs.exe, 00000009.00000003.2528855901.000000000A14E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: XC\Vm\Release\x86\StubExe.pdbX source: cpcs.exe, 00000009.00000003.2533389394.000000000A54E000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2532883037.000000000A53D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\work\test\test2\Release\test2.pdbd source: cpcs.exe, 00000009.00000003.2533161271.000000000A44A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Tr0gdor\Rxbot 7.6\Debug\rBot.pdbz source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: o.pdb source: cpcs.exe, 00000009.00000003.2533842656.000000000A4B5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: note.pdb source: cpcs.exe, 00000009.00000003.2535475306.000000000B056000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\dtcser\sys\i386\killvv.pdb source: cpcs.exe, 00000009.00000003.2533161271.000000000A493000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2528855901.000000000A14E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: EXTRA=Password.Stealer, %TEMP%\Facebook\Facebook Stealer.pdb, DP source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\key\lasass\Debug\lasass.pdb source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: vCrypt Stub.pdb7 source: cpcs.exe, 00000009.00000003.2533526590.000000000A5C7000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2533704715.000000000A5CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\local0\asf\release\build-2.2.14\support\Release\ab.pdb source: cpcs.exe, 00000009.00000003.2528855901.000000000A101000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\SVN Control Code\app_client\Loader\Release\Loader.pdb source: cpcs.exe, 00000009.00000003.2528855901.000000000A101000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: x:\werdon.pdb source: cpcs.exe, 00000009.00000003.2535304844.0000000009F2B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \MyProjects\eMule\Debug\eMule.pdb source: cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\SVN\mbam\exe\mbampt.exe\build\mbampt.pdb source: chica-pc-shield-1-75-0-1300-en-win.tmp, 00000001.00000003.2789847670.0000000004F26000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Socksbuilder\stub\release\stub.pdb source: cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Tr0gdor\Rxbot 7.6\Debug\rBot.pdb source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cm_acl.pdb source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\dtcser\sys\i386\killvv.pdb+ source: cpcs.exe, 00000009.00000003.2533161271.000000000A493000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Double Onesass.pdbx7 source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp

Code function: 1_2_0044852C LoadLibraryExA,LoadLibraryA,GetProcAddress,

1_2_0044852C

Source: is-6PN99.tmp.1.dr

Static PE information: section name: .sxdata

Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp

Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\mbamext.dll"

Source: C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe	Code function: 0_2_004065C8 push 00406605h; ret	0_2_004065FD
Source: C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe	Code function: 0_2_004040B5 push eax; ret	0_2_004040F1
Source: C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe	Code function: 0_2_00408104 push ecx; mov dword ptr [esp], eax	0_2_00408109
Source: C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe	Code function: 0_2_00404185 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe	Code function: 0_2_00404206 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe	Code function: 0_2_0040C218 push eax; ret	0_2_0040C219
Source: C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe	Code function: 0_2_004042E8 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe	Code function: 0_2_00404283 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe	Code function: 0_2_00408F38 push 00408F6Bh; ret	0_2_00408F63
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_3_021A3ED7 push 4002145Eh; ret	1_3_021A4005
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_3_021A3ED7 push 4002145Eh; ret	1_3_021A4005
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_3_02142704 pushad ; retn 0046h	1_3_02142705
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_3_021A3ED7 push 4002145Eh; ret	1_3_021A4005
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_3_021A3ED7 push 4002145Eh; ret	1_3_021A4005
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_3_021A3ED7 push 4002145Eh; ret	1_3_021A4005
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_3_021A3ED7 push 4002145Eh; ret	1_3_021A4005
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_3_021A4000 push 4002145Eh; ret	1_3_021A4005
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_0040994C push 00409989h; ret	1_2_00409981
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_00483AD8 push 00483BE6h; ret	1_2_00483BDE
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_004062B4 push ecx; mov dword ptr [esp], eax	1_2_004062B5
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_004104E0 push ecx; mov dword ptr [esp], edx	1_2_004104E5
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_00494888 push ecx; mov dword ptr [esp], ecx	1_2_0049488D
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_00412928 push 0041298Bh; ret	1_2_00412983
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_0040CE38 push ecx; mov dword ptr [esp], edx	1_2_0040CE3A
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_004851C8 push ecx; mov dword ptr [esp], ecx	1_2_004851CD
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_004591A8 push 004591ECh; ret	1_2_004591E4
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_0040F398 push ecx; mov dword ptr [esp], edx	1_2_0040F39A
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_00443440 push ecx; mov dword ptr [esp], ecx	1_2_00443444
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_0040546D push eax; ret	1_2_004054A9
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_0040553D push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_004055BE push 00405749h; ret	1_2_00405741

Persistence and Installation Behavior

Creates a FSFilter Anti-Virus service

Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe

Registry value created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\CPCSProtector\Instances\CPCSProtector Instance Altitude

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-L12IJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\mbamtoast.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\mbam.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\ssubtmr6.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\7z.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\mbamcore.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsservice.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-6PN99.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\Users\user\AppData\Local\Temp\is-93AED.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\vbalsgrid6.ocx (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-SJQ69.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-6H2TN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcspt.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-K9CAE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-9INTD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-KP3IJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\Users\user\AppData\Local\Temp\is-93AED.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-UQ1R3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-CI4PM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\Windows\System32\drivers\is-VCK25.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-0DUR6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\mbamext.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\Users\user\AppData\Local\Temp\is-93AED.tmp\mbam.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe	File created: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\Windows\system32\drivers\cpcs.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\mbamnet.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-DB4G5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-J2CDD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-S0PAI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-CU77C.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\Windows\System32\drivers\is-VCK25.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\Windows\system32\drivers\cpcs.sys (copy)			Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Windows\System32\regsvr32.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\MBAMShlExt NULL			Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\MBAMShlExt NULL			Jump to behavior

Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\CPCSProtector\Instances

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ChicaLogic	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ChicaLogic\ChicaPC-Shield	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ChicaLogic\ChicaPC-Shield\ChicaPC-Shield.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ChicaLogic\ChicaPC-Shield\ChicaPC-Shield Notifications.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ChicaLogic\ChicaPC-Shield\Uninstall ChicaPC-Shield.lnk	Jump to behavior

Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe

Code function: 12_2_6F88F120 ChangeServiceConfig2W,StartServiceW,GetLastError,

12_2_6F88F120

Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ChicaPC-Shield	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ChicaPC-Shield	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ChicaPC-Shield	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ChicaPC-Shield	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Contains functionality to hide user accounts

Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: EXTRA=Trojan.Backdoor, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList|NT_AUTORITY

May modify the system service descriptor table (often done to hook functions)

Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: KeServiceDescriptorTable

Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_0042285C SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,	1_2_0042285C
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_00423C0C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	1_2_00423C0C
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_00423C0C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	1_2_00423C0C
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_004241DC IsIconic,SetActiveWindow,SetFocus,	1_2_004241DC
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_00424194 IsIconic,SetActiveWindow,	1_2_00424194
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_00418384 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,	1_2_00418384
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_0048348C IsIconic,GetWindowLongA,ShowWindow,ShowWindow,	1_2_0048348C
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_00417598 IsIconic,GetCapture,	1_2_00417598
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_00417CCE IsIconic,SetWindowPos,	1_2_00417CCE
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_00417CD0 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,	1_2_00417CD0

Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp

Code function: 1_2_0041F118 GetVersion,SetErrorMode,LoadLibraryA,SetErrorMode,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

1_2_0041F118

Source: C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 0000000F.00000003.2652428311.0000000004663000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2843530652.000000000847A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2648389472.0000000008271000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cpcs.exe PID: 2412, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: cpcs.exe, 00000009.00000003.2556561426.0000000006534000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=TROJAN.AGENT && SIZE=96304, 123880 && VERSION=1, HEX-RAYS SA && VERSION=3, 5.5.0.925 && VERSION=7, IDAG.EXE && RESOURCE=RT_GROUP_ICON, 0, 000001000100??????000100??00????00000100
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=TROJAN.SPYEYES && SIZE=80000, 420000 && VERSION=1, DATARESCUE SA/NV && VERSION=3, 5.2.0.908 && VERSION=7, IDAG.EXE && VERSION=8, THE INTERACTIVE DISASSEMBLER && STRINGS=456, 504543327A4F
Source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2533389394.000000000A54E000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529734518.000000000A217000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2532883037.000000000A53D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IDAG.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=SECURITY.HIJACK, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\OLLYDBG.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=WORM.NEERIS, %TEMP%\WINDUMP.EXE, NV
Source: cpcs.exe, 00000009.00000003.2556561426.0000000006534000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=TROJAN.AGENT && SIZE=1000, 1000000 && VERSION=1, DANIEL PISTELLI && VERSION=3, 7.9.0.0 && VERSION=7, CFF EXPLORER.EXE
Source: cpcs.exe, 00000009.00000003.2533389394.000000000A54E000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2532883037.000000000A53D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: COBSERVER.EXE"
Source: cpcs.exe, 00000009.00000003.2533389394.000000000A5B5000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529369405.0000000009D87000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: API_LOG.DLL
Source: cpcs.exe, 00000009.00000003.2545740501.000000000E112000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\USERS\DEFAULT\APPDATA\LOCAL\TEMP\PROCMON.EXE
Source: cpcs.exe, 00000009.00000003.2546029145.000000000D31E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\MICROSOFT\SBIESVC.EXE
Source: cpcs.exe, 00000009.00000003.2544105021.000000000DEC8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\USERS\DEFAULT\APPDATA\LOCAL\TEMP\WINDUMP.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=SECURITY.HIJACK, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\REGMON.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=TROJAN.AGENT, %PROGRAMFILES%\MICROSOFT\SBIESVC.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=SECURITY.HIJACK, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\IDAG.EXE\|DEBUGGER, DP
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=SECURITY.HIJACK, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\ABREGMON.EXE.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000006534000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=TROJAN.DOWNLOADER.MDN && VERSION=1, HEX-RAYS SA && VERSION=7, IDAG.EXE && RESOURCE=RT_VERSION, 134, 30003400310039 && STRINGS=%PE3% + 952, 637279707465642E657865
Source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\FILE.EXESBIEDLL.DLL3;
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=SECURITY.HIJACK, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SUPERANTISPYWARE.EXE
Source: cpcs.exe, 00000009.00000003.2544105021.000000000DEC8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\USERS\user\APPDATA\LOCAL\TEMP\WINDUMP.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=HIJACK.DISALLOWRUN, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\DISALLOWRUN\|FOLDERSNIFFER=FOLDERSNIFFER.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=SECURITY.HIJACK, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\FILEMON.EXE
Source: cpcs.exe, 00000009.00000003.2545306895.000000000E06C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\SERVICEPROFILES\NETWORKSERVICE\APPDATA\LOCAL\TEMP\PROCMON.EXETDH6N
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=TROJAN.SPYEYES && VERSION=1, UNDERGROUND INFORMATION CENTER && VERSION=3, 1.5.800.2006 RC7 && VERSION=4, PE TOOLS V1.5 RC7 && VERSION=7, PETOOLS.EXE && STRINGS=%PE2% + 306, 50004D00560059004B0055004A0046004C0037 && STRINGS=472, 50454332774F
Source: cpcs.exe, 00000009.00000003.2556561426.0000000006534000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=TROJAN.AGENT && VERSION=5, JIQKZMOK && VERSION=7, COBSERVER.EXE
Source: cpcs.exe, 00000009.00000003.2545740501.000000000E112000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\USERS\user\APPDATA\LOCAL\TEMP\PROCMON.EXE
Source: cpcs.exe, 00000009.00000003.2545034326.000000000E01A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\SERVICEPROFILES\LOCALSERVICE\APPDATA\LOCAL\TEMP\PROCMON.EXE
Source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2533389394.000000000A5B5000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529369405.0000000009D87000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: cpcs.exe, 00000009.00000003.2533161271.000000000A44A000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529454596.000000000A126000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SANDBOXIERPCSS.EXE
Source: cpcs.exe, 00000009.00000003.2533161271.000000000A44A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CFF EXPLORER.EXE2
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=TROJAN.FRAUDLOAD, %SYSDIR%\WINDUMP.EXE, NV
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=TROJAN.AGENT, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\|SBIESVC.EXE=\MICROSOFT\SBIESVC.EXE
Source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLLDBGHELP
Source: cpcs.exe, 00000009.00000003.2533526590.000000000A5C7000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2533704715.000000000A5CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PETOOLS.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=TROJAN.AGENT, %APPDATA%\WINDBG\WINDBG.EXE
Source: cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VNETSNIFFER.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000006534000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=TROJAN.FAKEALERT && VERSION=7, VNETSNIFFER.EXE && STRINGS=128, 136F6768570E093B570E093B570E093B5202563B730E093B5202063B5C0E093B4406543B550E093BD406543B500E093B570E083B230E093B5202693B540E093BBB05573B560E093B5202533B560E093B
Source: cpcs.exe, 00000009.00000003.2529369405.0000000009D87000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: API_LOG.DLLSBIEDLL.DLLCURRENTUSERANDY
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=SECURITY.HIJACK, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\PROCMON.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=SECURITY.HIJACK, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WINDBG.EXE
Source: cpcs.exe, 00000009.00000003.2529734518.000000000A217000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: COBSERVER.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=TROJAN.AGENT, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\AUTORUNS.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=SECURITY.HIJACK, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\AUTORUNSC.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=TROJAN.DOWNLOADER, %TEMP%\PROCMON.EXE, NV
Source: cpcs.exe, 00000012.00000003.2840443937.000000000E02A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\SERVICEPROFILES\LOCALSERVICE\APPDATA\LOCAL\TEMP\WINDUMP.EXE

Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Memory allocated: 5EA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Memory allocated: 45B0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Memory allocated: 4830000 memory reserve \| memory write watch

Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: GetAdaptersInfo,GetAdaptersInfo,GetAdaptersInfo,inet_addr,	12_2_6BB55B90
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: GetAdaptersInfo,GetAdaptersInfo,	12_2_6BBB2620
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: GetAdaptersInfo,GetAdaptersInfo,GetAdaptersInfo,inet_addr,	14_2_6BB55B90
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: GetAdaptersInfo,GetAdaptersInfo,	14_2_6BBB2620

Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Dropped PE file which has not been started: C:\Windows\System32\drivers\is-VCK25.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-CI4PM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-L12IJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\mbamext.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\mbamtoast.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\ssubtmr6.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\7z.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsservice.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-6PN99.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Dropped PE file which has not been started: C:\Windows\system32\drivers\cpcs.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-93AED.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\vbalsgrid6.ocx (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-SJQ69.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-6H2TN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-J2CDD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcspt.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-K9CAE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-UQ1R3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-9INTD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-93AED.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-CU77C.tmp	Jump to dropped file

Source: C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe

Evasive API call chain: GetSystemTime,DecisionNodes

graph_0-5539

Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_12-110001

Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	API coverage: 6.5 %
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	API coverage: 8.9 %

Source: C:\Windows\System32\svchost.exe TID: 5800

Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe

Last function: Thread delayed

Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F856A20 GetSystemTimeAsFileTime followed by cmp: cmp dword ptr [esp+3ch], 08h and CTI: jc 6F856C16h		12_2_6F856A20
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F856A20 GetSystemTimeAsFileTime followed by cmp: cmp dword ptr [esp+3ch], 08h and CTI: jc 6F856C16h		14_2_6F856A20

Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_00452A60 FindFirstFileA,GetLastError,	1_2_00452A60
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_00474E64 FindFirstFileA,FindNextFileA,FindClose,	1_2_00474E64
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_00464030 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_00464030
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_00462628 FindFirstFileA,FindNextFileA,FindClose,	1_2_00462628
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_00463BB4 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_00463BB4
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: 1_2_00497C84 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	1_2_00497C84
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005BBAD0 FindFirstFileW,FindNextFileW,FindClose,	12_2_005BBAD0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6BB592B0 FindFirstFileW,FindNextFileW,FindClose,	12_2_6BB592B0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F8625E0 FindFirstFileW,FindNextFileW,FindClose,	12_2_6F8625E0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6BB592B0 FindFirstFileW,FindNextFileW,FindClose,	14_2_6BB592B0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F8625E0 FindFirstFileW,FindNextFileW,FindClose,	14_2_6F8625E0

Source: C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe

Code function: 0_2_00409B30 GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery,

0_2_00409B30

Source: cpcs.exe, 00000009.00000003.2532883037.000000000A53D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareUser.exe
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=Trojan.Agent && SIZE=10000000, 15000000 && VERSION=1, VMware? Inc. && VERSION=3, 6.0.2 build-59824 && VERSION=7, vmware.exe
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=Trojan.Agent && SIZE=20000, 150000 && VERSION=1, VMware? Inc. && VERSION=3, 8.4.5.14951 && VERSION=7, VMwareTray.exe && STRINGS=464, 50454332764F
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=Trojan.Agent && VERSION=7, VMwareUser.exe && STRINGS=6592, 5045436F6D7061637432
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.FakeAlert, HKCR\VMwareApp.VMware*
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Backdoor.Bot, HKLM\System\CurrentControlSet\Services\VMwareService
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=Trojan.Agent && SIZE=25000, 300000 && VERSION=1, VMware? Inc. && VERSION=3, 6.0.2 build-59824 && VERSION=7, vmware.exe
Source: cpcs.exe, 00000009.00000003.2533704715.000000000A5CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000007934000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=Backdoor.Bot && DIGISIG=FALSE && VERSION=1, %NULL% && VERSION=4, vmnethcp.exe && STRINGS=%PE2% - 1276, 420069006F004300720065006400500072006F0076002E006500780065 && STRINGS=128, 504500004C010300 && STRINGS=216, 00000000
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Agent, HKLM\SYSTEM\CurrentControlSet\Services\NetDDEVMTools
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Agent, HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\|VMware process Tool=\help.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Agent, %USERROOT%\Local Settings\VMwareDnD\QTTask.exe
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=Worm.KoobFace && VERSION=1, VMware? Inc.* && STRINGS=48, 000000000000000000000000D80000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A2400000000000000????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????52696368????????0000000000000000504500004C010400????????0000000000000000E0000F010B01????00??000000??000000????00????00000010000000??00000000400000100000000200000400000005000100040000000000000000????0000040000????0100020000800000??0000??00000000??0000??000000000000100000000000000000000000????0000????000000????00????0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000????0000??000000??????00??000000000000000000000000??0000??0000000000000000000000000000000000000000000000000000002E636F6465000000????00000010000000??000000040000000000000000000000000000200000602E64617461000000????000000??000000??000000??0000000000000000000000000000400000C02E72646174610000????000000????0000??000000??000000000000000000000000000040000040??????????????????????0000????0000????0000??0000000000000000000000000000C0000040
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=Spyware.Zbot && VERSION=2, VMware Tools Core Service && STRINGS=128, AB5FE84BEF3E8618EF3E8618EF3E86186C228818EE3E861886218F18F33E861806218B18EE3E861852696368EF3E8618 && STRINGS=432, 2E7465787400000000F0040000100000008A02000002000050454332774F000000000000600000E02E72737263000000
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=Trojan.Spybot && VERSION=1, VMware? Inc. && VERSION=3, 8.4.6.16648 && VERSION=7, VMUpgradeHelper.exe && PESECTION=2, .rsrc
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Backdoor, %PROGRAMFILES%\VMware NAT\kav.dll
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Agent.VM, HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\|VMWARE=\read.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Backdoor.Agent, HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\|hgfsg
Source: cpcs.exe, 00000009.00000003.2533389394.000000000A5B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware WorkstationrL=
Source: cpcs.exe, 00000009.00000003.2528855901.000000000A101000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareUser.exeSd
Source: cpcs.exe, 00000009.00000003.2529734518.000000000A217000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware? Inc.um
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=Backdoor.PcClient && SIZE=1605590, 1665590 && VERSION=7, Copyright 1998-2010 VMware?Inc.
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Backdoor.SpyNet, %SYSDIR%\Resource\VMware.exe
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=Worm.KoobFace && VERSION=7, VMwareUser.exe && VOFFSET=448, 8, 4, 504543 && STRINGS=128, 98BCE83BDCDD8668DCDD8668DCDD86685FC18868DDDD866893FF8F68C1DD8668EAFB8B68DDDD866852696368DCDD8668
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=Trojan.ServStart && VERSION=1, ? && VERSION=4, VMware Workstationr && VERSION=8, VMware Workstationd
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=Backdoor.Messa && VERSION=1, %NULL% && VERSION=7, /VMWare Machine/Desktop/ && VERSION=8, %NULL%
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Agent, HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\|VMware * process=\kernel##.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000009734000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WHITE=\VMware\VMware Server\vmapplib.dll
Source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMSrvc.exeY&
Source: cpcs.exe, 00000009.00000003.2532883037.000000000A53D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware? Inc.
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=Backdoor.Agent && VERSION=1, VMware? Inc. && VERSION=2, %NULL% && VERSION=3, 22.01.#### && VERSION=5, %NULL% && VERSION=7, #.exe && PESECTION=1, UPX0
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=Trojan.FakeMS && VERSION=1, Microsoft Corporation && VERSION=7, VMSrvc.exe && PESECTION=1, .code_01 && VOFFSET=230, 8, 3, 0221
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=Trojan.Agent && VERSION=7, VMwareUser.exe && STRINGS=7820, 5045436F6D7061637432
Source: cpcs.exe, 00000009.00000003.2545034326.000000000DFB4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\SYSTEM\VMWARESERVICE.EXE C"n
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Zlob, HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\|VMware hptray
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Agent, %PROGRAMFILES%\VMware\Windows Messenger\tao.ico, DP
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=Trojan.Agent && PATTERN=**\go.exe && VERSION=1, VMware? Inc. && VERSION=7, usbRun.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Backdoor.Bot, %WINDIR%\System\VMwareService.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Backdoor.Agent, HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\|VMware? Inc.
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Worm.AutoRun, HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\|MwareUser=\VMware Tools\MwareUser.exe
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=Trojan.VB && SIZE=1000, 600000 && VERSION=1, VMware? Inc. && VERSION=3, 6.5.2 build-156735 && VERSION=7, ace_upgrade.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Backdoor.Bot, %WINDIR%\vmware-tray.exe
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=Trojan.Agent && SIZE=400000, 600000 && VERSION=3, 8.4.5.14951 && VERSION=7, VMwareUser.exe
Source: cpcs.exe, 00000009.00000003.2529734518.000000000A217000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware? Inc.&
Source: cpcs.exe, 00000009.00000003.2532883037.000000000A53D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware? Inc.,
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Backdoor, HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\|vmware remotemks=System32\vmremotems.exe
Source: cpcs.exe, 00000009.00000003.2533704715.000000000A5CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VBoxService.exek
Source: cpcs.exe, 00000009.00000003.2528855901.000000000A101000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware? Inc.0
Source: cpcs.exe, 00000009.00000003.2533842656.000000000A4B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /VMWare Machine/Desktop/$
Source: cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmware.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Backdoor.Agent, HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\|VMware? Inc.
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=Trojan.Agent && VERSION=1, VMware? Inc. && VERSION=4, VMwareUser && STRINGS=11632, 5045436F6D7061637432
Source: cpcs.exe, 00000009.00000003.2533704715.000000000A5CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VIRTUALVMWAREQEMU
Source: chica-pc-shield-1-75-0-1300-en-win.tmp, 00000001.00000003.2792960995.00000000006B2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\d
Source: cpcs.exe, 00000009.00000003.2529369405.0000000009D87000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Workstationdn
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Agent, HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\|VMware admin Tool=\Fonts##.exe
Source: cpcs.exe, 00000009.00000003.2533389394.000000000A5B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware WorkstationdP=
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Infostealer.Gampass, %SYSDIR%\VMware.dll, NV
Source: cpcs.exe, 00000009.00000003.2533704715.000000000A5CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmware-hosts
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=Worm.KoobFace && VERSION=7, VMwareTray.exe && VOFFSET=448, 8, 4, 504543 && STRINGS=128, D1187782957919D1957919D1957919D1166517D1947919D1DA5B10D19B7919D1A35F14D1947919D152696368957919D1
Source: cpcs.exe, 00000009.00000003.2528855901.000000000A101000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware? Inc.<
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Agent, HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\|Shell=vmnethcp.exe
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=Spyware.Password && VERSION=1, VMware? Inc. && STRINGS=456, 50454332
Source: cpcs.exe, 00000009.00000003.2544527727.000000000D6DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES (X86)\VMWARE FILES\VMNETDHCP.EXE
Source: cpcs.exe, 00000009.00000003.2533161271.000000000A44A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMWARE BEST VIRTUAL
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=Worm.KoobFace && VERSION=7, vmware-fullscreen.exe && STRINGS=128, 695EEBF12D3F85A22D3F85A2E16F95C222609AC2E36F95C22260CBC2A16E95C2
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=Trojan.Downloader && SIZE=10000, 400000 && VERSION=3, 7.0.1 build-227600 && VERSION=7, vmware.exe
Source: cpcs.exe, 00000009.00000003.2529369405.0000000009D87000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware WorkstationrGeno
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=Trojan.Agent && VERSION=1, Photoshop && VERSION=7, Simon Inc.exe && VERSION=8, VMWARE BEST VIRTUAL
Source: cpcs.exe, 00000009.00000003.2533842656.000000000A4B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Tools Core Service
Source: cpcs.exe, 00000009.00000003.2533704715.000000000A5CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VBoxService.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Downloader, HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\|hgfstikyc
Source: cpcs.exe, 00000009.00000003.2528855901.000000000A101000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareTray.exeZc
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=Trojan.Agent && VERSION=7, VMwareService.exe && STRINGS=128, C25247E5863329B6863329B6A27C95DF61739ADFA07C95DF785F89DFE27D95DF585F8CDFBF7C95DF61739ADFA37C95DF6173CADF807C95DF61739ADFAE7C95DF585F8CDFA37C95DF52696368863329B600000000000000005045
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=Trojan.Agent && VERSION=7, VMwareUser.exe && STRINGS=128, BD1FAAC9F97EC49AF97EC49AF97EC49A7A62CA9AF87EC49A9061CD9AD07EC49A1061C99AF87EC49A52696368F97EC49A && STRINGS=472, 50454332774F0000
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Agent, %USERROOT%\Templates\vmnethcp.exe
Source: cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware? Inc.=l
Source: cpcs.exe, 00000009.00000003.2546561141.000000000BF7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMWAREAPP.VMWARE*TE
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=Trojan.Zbot && VERSION=1, VMware? Inc. && STRINGS=584, 494E4954 && STRINGS=624, 2E7864617461
Source: cpcs.exe, 00000009.00000003.2545306895.000000000DFF8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\VMWARE-TRAY.EXE
Source: cpcs.exe, 00000009.00000003.2528855901.000000000A101000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareUser.exeDc
Source: cpcs.exe, 00000009.00000003.2528855901.000000000A101000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareUser
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Agent, HKLM\SYSTEM\CurrentControlSet\Services\ShellHWDetectionVMTools
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=Trojan.FakeAlert && VERSION=1, VMware? Inc. && VERSION=7, vmware.exe && PESECTION=1, UPX0 && STRINGS=%PE3% + 240, 426F6D65
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Agent, HKCU\Software\Microsoft\Windows\CurrentVersion\Run\|Microsoft Routing Utilities=\vmnethcp.exe
Source: cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=Trojan.VB && SIZE=80000, 900000 && VERSION=1, VMware? Inc. && VERSION=3, 6.5.2 build-156735 && VERSION=7, hqtray.exe
Source: cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmware.exe6l
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.JRQService, HKLM\SYSTEM\CurrentControlSet\SERVICES\VMWARE APPLICATIONSJRQ
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Agent, HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\|VMWARES=\spooles.exe

Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	API call chain: ExitProcess graph end node	graph_12-109818
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	API call chain: ExitProcess graph end node	graph_12-109444
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	API call chain: ExitProcess graph end node	graph_12-110002
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe

Code function: 12_2_005EC5A8 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

12_2_005EC5A8

Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp

Code function: 1_2_0044852C LoadLibraryExA,LoadLibraryA,GetProcAddress,

1_2_0044852C

Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process token adjusted: Debug

Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005EC5A8 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_005EC5A8
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005ED25A SetUnhandledExceptionFilter,	12_2_005ED25A
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_005E74E5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_005E74E5
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6BB9DAC1 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_6BB9DAC1
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6BB9AE8F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_6BB9AE8F
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F890061 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_6F890061
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F8957BE _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_6F8957BE
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_009100E5 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_009100E5
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_00911507 SetUnhandledExceptionFilter,	14_2_00911507
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_0090D600 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_0090D600
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6BB9DAC1 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_6BB9DAC1
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6BB9AE8F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_6BB9AE8F
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F890061 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_6F890061
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F8957BE _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_6F8957BE

HIPS / PFW / Operating System Protection Evasion

Contains functionality to automate explorer (e.g. start an application)

Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: 12_2_6F88F460 CloseServiceHandle,FindWindowExW,FindWindowExW,FindWindowExW,FindWindowExW,FindWindowExW,GetClientRect,SendMessageW,SendMessageW,		12_2_6F88F460
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: 14_2_6F88F460 CloseServiceHandle,FindWindowExW,FindWindowExW,FindWindowExW,FindWindowExW,FindWindowExW,GetClientRect,SendMessageW,SendMessageW,		14_2_6F88F460

Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe

Code function: OpenProcess,OpenProcessToken,CloseHandle, explorer.exe

14_2_008E60F0

Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp

Code function: 1_2_0047808C ShellExecuteEx,GetLastError,MsgWaitForMultipleObjects,GetExitCodeProcess,CloseHandle,

1_2_0047808C

Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\ssubtmr6.dll"	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\vbalsgrid6.ocx"	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\ssubtmr6.dll"
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\vbalsgrid6.ocx"
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\ssubtmr6.dll"
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\vbalsgrid6.ocx"

Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe

Code function: 12_2_005BB550 InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

12_2_005BB550

Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp

Code function: 1_2_0042E09C AllocateAndInitializeSid,GetVersion,GetModuleHandleA,GetProcAddress,CheckTokenMembership,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GetTokenInformation,EqualSid,CloseHandle,FreeSid,

1_2_0042E09C

Source: cpcsgui.exe, cpcsscheduler.exe	Binary or memory string: Shell_TrayWnd
Source: cpcsgui.exe, 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: oP&\InstancesHKLM\SYSTEM\CurrentControlSet\Services\ InstanceDefaultInstanceAltitudeFlags\\.\pipe\Notification AreaUser Promoted Notification AreaToolbarWindow32SysPagerTrayNotifyWndShell_TrayWndCouldn't load the library.Wow64DisableWow64FsRedirectionWow64RevertWow64FsRedirection
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Ransom, HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\|MailAgent=??\Progman.exe*
Source: cpcs.exe, 00000009.00000003.2556561426.0000000006534000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: POLY=Worm.Ambler && VERSION=1, Microsoft Corporation && VERSION=3, 9.32 && VERSION=8, Program manager

Source: C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe	Code function: GetLocaleInfoA,	0_2_0040520C
Source: C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe	Code function: GetLocaleInfoA,	0_2_00405258
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: GetLocaleInfoA,	1_2_00408568
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Code function: GetLocaleInfoA,	1_2_004085B4
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement,	12_2_005E860D
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free,	12_2_005F06F9
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	12_2_005F6897
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free,	12_2_005F09E7
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	12_2_005F4EFC
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	12_2_005F4FD6
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW,	12_2_005ED05D
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: GetLocaleInfoA,	12_2_005EB419
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	12_2_005F172C
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	12_2_005F1821
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	12_2_005F18C8
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	12_2_005F1923
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	12_2_005F1AF4
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	12_2_005EFA9D
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	12_2_005F1BB4
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	12_2_005F1C57
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	12_2_005F1C1B
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	12_2_6BBAEBF0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	12_2_6BBAEA1F
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	12_2_6BBAE9C4
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	12_2_6BBAE91D
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	12_2_6BBAE828
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	12_2_6BBB0F1E
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	12_2_6BBAED17
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	12_2_6BBAED53
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	12_2_6BBAECB0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: GetLocaleInfoA,	12_2_6BBB1053
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	12_2_6F89AFC3
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW,	12_2_6F89CF1A
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	12_2_6F89AF68
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	12_2_6F89AEC1
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	12_2_6F89ADCC
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	12_2_6F898D56
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: GetLocaleInfoA,	12_2_6F89462F
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement,	12_2_6F8925C7
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	12_2_6F8A0575
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	12_2_6F8A049B
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free,	12_2_6F899CA0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free,	12_2_6F8999B2
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	12_2_6F89F43F
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	12_2_6F89B2BB
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	12_2_6F89B2F7
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	12_2_6F89B254
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	12_2_6F89B194
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	14_2_0091A0D8
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free,	14_2_0091806B
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	14_2_0091A1CD
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	14_2_00917121
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	14_2_0091A2CF
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	14_2_0091A274
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	14_2_0091A4A0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW,	14_2_00912447
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	14_2_0091A5C7
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	14_2_0091A560
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	14_2_0091A603
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	14_2_0091C63D
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: GetLocaleInfoA,	14_2_0091C772
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	14_2_009168FE
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	14_2_00916824
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement,	14_2_009199CE
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free,	14_2_00917D7D
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	14_2_6BBAEBF0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	14_2_6BBAEA1F
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	14_2_6BBAE9C4
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	14_2_6BBAE91D
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	14_2_6BBAE828
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	14_2_6BBB0F1E
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	14_2_6BBAED17
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	14_2_6BBAED53
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	14_2_6BBAECB0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: GetLocaleInfoA,	14_2_6BBB1053
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	14_2_6F89AFC3
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW,	14_2_6F89CF1A
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	14_2_6F89AF68
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	14_2_6F89AEC1
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	14_2_6F89ADCC
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	14_2_6F898D56
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: GetLocaleInfoA,	14_2_6F89462F
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement,	14_2_6F8925C7
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	14_2_6F8A0575
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	14_2_6F8A049B
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free,	14_2_6F899CA0
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free,	14_2_6F8999B2
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	14_2_6F89F43F
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	14_2_6F89B2BB
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	14_2_6F89B2F7
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	14_2_6F89B254
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	14_2_6F89B194

Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp

Code function: 1_2_004584A0 GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeA,GetLastError,CreateFileA,SetNamedPipeHandleState,CreateProcessA,CloseHandle,CloseHandle,

1_2_004584A0

Source: C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe

Code function: 0_2_004026C4 GetSystemTime,

0_2_004026C4

Source: C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp

Code function: 1_2_0045559C GetUserNameA,

1_2_0045559C

Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe

Code function: 12_2_6BB6DF4B GetTimeZoneInformation,__strftime_l,__free_locale,

12_2_6BB6DF4B

Source: C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe

Code function: 0_2_00405CF4 GetVersionExA,

0_2_00405CF4

Source: C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: cpcs.exe, 00000009.00000003.2545034326.000000000DF4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\USERS\DEFAULT\TEMPLATES\AVG\MSASCUI.EXE
Source: cpcs.exe, 00000009.00000003.2546029145.000000000D30A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\WINRAR\FORMATS\KAVSTART.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\apvxdwin.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsaua.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AYAGENT.AYE
Source: cpcs.exe, 00000009.00000003.2533526590.000000000A5C7000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2532883037.000000000A55F000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529734518.000000000A248000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2533161271.000000000A493000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2528855901.000000000A14E000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2533704715.000000000A5CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avcenter.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVINSTALL.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\APORTS.EXE
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: LIVESRV.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tisspwiz.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrsx.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boxmod.exe
Source: cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sched.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\quhlpsvc.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Agent, %PROGRAMFILES%\Windows NT\kav.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Banker, %USERROOT%\Local Settings\Application Data\nod32.exe
Source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NOD32.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ATF-CLEANER.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CAVASM.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kwatch.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe
Source: cpcs.exe, 00000009.00000003.2543791751.000000000DC90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\USERS\DEFAULT\LOCAL SETTINGS\APPLICATION DATA\MSASCUI.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srengps.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CAFW.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\psimsvc.exe
Source: cpcs.exe, 00000009.00000003.2533526590.000000000A5C7000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2533704715.000000000A5CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: fast.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BUSCAREG.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fih32.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ahnsdsv.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fch32.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsaa.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\A2SCAN.EXE
Source: cpcs.exe, 00000009.00000003.2543791751.000000000DC0A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\SERVICEPROFILES\LOCALSERVICE\DOCUMENTS\SYSTEM\MSASCUI.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Backdoor.Agent, %WINDIR%\Resources\temas\Windows.exe\rundll32\avgnt.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav.exe
Source: cpcs.exe, 00000009.00000003.2544897121.000000000DD58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\SERVICEPROFILES\NETWORKSERVICE\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS DEFENDER\MSASCUI.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\drwebscd.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsmb32.exe
Source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529734518.000000000A248000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2528855901.000000000A14E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 360rpt.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanwscs.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spf.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDFix.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVIRARKD.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanmsg.exe
Source: cpcs.exe, 00000009.00000003.2528855901.000000000A101000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nod32krn.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pavfnsvr.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zlclient.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lordpe.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\virusutilities.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\psctrls.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hijackthis.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsma32.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavsvc.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfwsvc.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\processmonitor.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guard.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xcommsvr.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Worm.AutoRun, %WINDIR%\Virus.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKPROXY.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvmonxp.kxp
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcshield.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcagent.exe
Source: cpcs.exe, 00000009.00000003.2543791751.000000000DC90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\TEMPLATES\MSASCUI.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnsx.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Rogue.MultipleAV, %USERROOT%\Local Settings\Application Data\Microsoft\Windows Defender\MSASCui.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Backdoor.Agent, %ROOTDRIVE%\Nueva carpeta\install\virus.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\APM.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spiderui.exe
Source: cpcs.exe, 00000012.00000003.2840443937.000000000E02A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\SERVICEPROFILES\LOCALSERVICE\TEMPLATES\AVG\MSASCUI.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashwebsv.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav32.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav.exe
Source: cpcs.exe, 00000009.00000003.2529369405.0000000009D87000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ndows\CurrentVersion\App Paths\360safe.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASVIEWER.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\arcacheck.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsdfwd.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spiderml.exe
Source: cpcs.exe, 00000009.00000003.2544720380.000000000D6EC000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2544527727.000000000D6DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\USERS\DEFAULT\APPDATA\ROAMING\AVG\MSASCUI.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgemc.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Banker, %SYSDIR%\avgnt.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Rogue.MultipleAV, %USERROOT%\Local Settings\Application Data\MSASCui.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\acals.exe
Source: cpcs.exe, 00000009.00000003.2543791751.000000000DC0A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\SERVICEPROFILES\NETWORKSERVICE\DOCUMENTS\SYS\MSASCUI.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmdagent.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\A2GUARD.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\acaegmgr.exe
Source: cpcs.exe, 00000009.00000003.2546561141.000000000BF7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS DEFENDER\MSASCUI.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASWCLNR.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccprovsp.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvol.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav530stbyb.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pctsTray.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Agent, %APPDATA%\sched.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Agent, %APPDATA%\MsMpEng.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Procmon.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\acaas.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgscanx.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Backdoor.Agent.DC, %SYSDIR%\iExplorer\iefix.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\defwatch.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam-setup.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Backdoor.Messa, %APPDATA%\virus.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Backdoor.XTRat, %WINDIR%\avast\nod32.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgtray.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcvsrte.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Agent, %TEMP%\MsMpEng.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fp-win.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\f-prot.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Agent, %ROOTDRIVE%\windy\Nod32.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvsrvxp.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Agent, %SYSDIR%\wbem\360tray.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\f-stopw.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.MultipleAV.Gen, %TEMP%\mtg\MSASCui.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CAPFUPGRADE.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pctsAuxs.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avz.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AFMAIN.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\A2HIJACKFREESETUP.EXE
Source: cpcs.exe, 00000009.00000003.2528855901.000000000A101000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avgtray.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HJTInstall.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sched.exe
Source: cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: procexp.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsm32.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcvsshld.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BOOTSAFE.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Backdoor.Agent, %SYSDIR%\InstallDir\avgnt.exe
Source: cpcs.exe, 00000009.00000003.2510009992.0000000003565000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2500648179.0000000002B4E000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2500622555.0000000002B48000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2510085331.000000000355F000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509982383.000000000355F000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509920343.000000000354D000.00000004.00000020.00020000.00000000.sdmp, cpcsgui.exe	Binary or memory string: $vars\commonappdata$\mbam-setup.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccenter.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vba32ldr.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcmgr.exe
Source: cpcs.exe, 00000009.00000003.2533526590.000000000A5C7000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2533704715.000000000A5CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MSASCUI.exe
Source: cpcs.exe, 00000009.00000003.2543791751.000000000DC0A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\SERVICEPROFILES\LOCALSERVICE\DOCUMENTS\SYS\MSASCUI.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gmer.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Agent, %TEMP%\MSASCui.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spybotsd.exe
Source: cpcs.exe, 00000009.00000003.2543791751.000000000DC90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\USERS\PUBLIC\LOCAL SETTINGS\APPLICATION DATA\AVG\MSASCUI.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CATCHME.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Backdoor.Agent, %SYSDIR%\install\virus.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\A2HIJACKFREE.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgui.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\umxcfg.exe
Source: cpcs.exe, 00000009.00000003.2544897121.000000000DD58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\USERS\user\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP\AVGUARD.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tmbmsrv.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.MultipleAV, %USERROOT%\Templates\MSASCui.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CAGLOBALLIGHT.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ufseagnt.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ravmond.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rtvscan.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashdisp.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav32.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onlnsvc.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\COMBOFIX.SCR
Source: cpcs.exe, 00000009.00000003.2543791751.000000000DC90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\USERS\PUBLIC\LOCAL SETTINGS\APPLICATION DATA\MSASCUI.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onlinent.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\portdetective.exe
Source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2533389394.000000000A54E000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2532883037.000000000A53D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HijackThis.exe
Source: cpcs.exe, 00000009.00000003.2543791751.000000000DC90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\USERS\PUBLIC\LOCAL SETTINGS\APPLICATION DATA\NOD32.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\COMBOFIX.BAT
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ACS.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tmproxy.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeaTimer.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SUPERAntiSpyware.exe
Source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Procexp.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav95.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ufnavi.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgupd.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Agent, %MYDOCS%\SYS\msascui.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLAMTRAY.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KSafeTray.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\A2START.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pctsGui.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVMENU.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BC5CA6A.EXE
Source: cpcs.exe, 00000009.00000003.2543791751.000000000DC90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\USERS\user\LOCAL SETTINGS\APPLICATION DATA\AVG\MSASCUI.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srengldr.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Agent, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgas.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ALERTMAN.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kissvc.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pctsSvc.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000009734000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PWHITE=%PROGRAMFILES%\BitDefender\BitDefender 2013\bdagent.exe
Source: cpcs.exe, 00000009.00000003.2528855901.000000000A101000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2533161271.000000000A493000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2528855901.000000000A14E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bdagent.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ABREGMON.EXE.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kasmain.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qoeloader.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CFGMNG32.EXE
Source: cpcs.exe, 00000009.00000003.2545740501.000000000E112000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\USERS\user\APPDATA\LOCAL\TEMP\PROCMON.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdss.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\umxpol.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ALMON.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avengine.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kxetray.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procdump.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.MultipleAV, %USERROOT%\Templates\avg\MSASCui.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fameh32.exe
Source: cpcs.exe, 00000009.00000003.2533161271.000000000A44A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: virusutilities.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvxp.kxp
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLAMWIN.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ALSVC.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsgk32.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fpwin.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\makereport.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CATEYE.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fprottray.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Agent, %APPDATA%\Microsoft\Virus.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Agent, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SuperKiller.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AYSERVICENT.AYE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsgk32st.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsmon.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Agent, %APPDATA%\Microsoft\Defender\MSASCui.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ollydbg.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fnrb32.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkservice.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avenger.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Agent, %MYDOCS%\System\msascui.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKTUNERSERVICE.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfp.exe
Source: cpcs.exe, 00000009.00000003.2529734518.000000000A248000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AVP.EXE
Source: cpcs.exe, 00000009.00000003.2545740501.000000000E112000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\USERS\DEFAULT\APPDATA\LOCAL\TEMP\PROCMON.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fast.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webproxy.exe
Source: cpcs.exe, 00000009.00000003.2544527727.000000000D66D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\SERVICEPROFILES\NETWORKSERVICE\APPDATA\ROAMING\AVG\MSASCUI.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Downloader, HKCU\Software\Microsoft\Windows\CurrentVersion\Run\|unlockerassistant=data\unlocker\unlockerassistant.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ARCABIT.CORE.LOGGINGSERVICE.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgwdsvc.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcupdate.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.MultipleAV, %TEMP%\avg\MSASCui.exe
Source: cpcs.exe, 00000009.00000003.2533389394.000000000A54E000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529734518.000000000A217000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2532883037.000000000A53D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MSASCui.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCTRAY.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe
Source: cpcs.exe, 00000009.00000003.2545034326.000000000E01A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\SERVICEPROFILES\LOCALSERVICE\APPDATA\LOCAL\TEMP\PROCMON.EXE
Source: cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 360Safe.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\f-prot95.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Agent, HKCR\Applications\360tray.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashmaisv.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGAMSVR.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Backdoor.Agent.DC, %APPDATA%\SYSTEM\kwatch.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sfctlcom.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Backdoor.Agent, %PROGRAMFILES%\SYSTEM\virus.exe
Source: cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avgnt.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfw32.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\acais.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ravtask.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\APT.EXE
Source: cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2533161271.000000000A493000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2528855901.000000000A14E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mbam.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fpavserver.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\arcavir.exe
Source: cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: **\NOD32.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\upschd.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CF9409.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\COMBOFIX.COM
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Small, %MYDOCS%\360Safe.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CMAIN.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKWCTL.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGARKT.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\emlproui.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsav530wtbyb.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavstart.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavpfw.exe
Source: cpcs.exe, 00000009.00000003.2546826441.000000000D614000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\SERVICEPROFILES\NETWORKSERVICE\APPDATA\LOCAL\TEMP\AVP.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswupdsv.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CAPFASEM.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Backdoor, %SYSDIR%\Sys32\cmdagent.exe
Source: cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avguard.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fprot.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spidernt.exe
Source: cpcs.exe, 00000009.00000003.2545034326.000000000DFB4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\USERS\user\TEMPLATES\MSASCUI.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ARCABIT.CORE.CONFIGURATOR2.EXE
Source: cpcs.exe, 00000009.00000003.2546561141.000000000BF7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\SERVICEPROFILES\LOCALSERVICE\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS DEFENDER\MSASCUI.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tpsrv.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardxservice.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regmon.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nmain.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ulibcfg.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\umxfwhlp.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\portmonitor.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\umxagent.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKTRAY.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2service.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\emlproxy.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pavprsrv.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcsrvx.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Security.Hijack, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashserv.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Rogue.MultipleAV, %USERROOT%\Local Settings\Application Data\avG\MSASCui.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Backdoor.PoisonIvy, %TEMP%\ixp000.tmp\123.exe

Stealing of Sensitive Information

Yara detected GhostRat

Source: Yara match	File source: 0000000F.00000003.2652428311.0000000004663000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cpcs.exe PID: 2412, type: MEMORYSTR

Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Backdoor.Agent, %SYSDIR%\aaa\Win_Xp.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Backdoor.Agent, %PROGRAMFILES%\Win_Xp.exe
Source: cpcs.exe, 00000009.00000003.2544105021.000000000DDDC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\SYSTEM32\MICROSOFT\WIN_XP.EXE
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Backdoor.Agent, %APPDATA%\Win_Xp.exe
Source: cpcs.exe, 00000009.00000003.2544105021.000000000DDDC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\SYSWOW64\MICROSOFT\WIN_XP.EXE
Source: cpcs.exe, 00000009.00000003.2546029145.000000000D31E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES (X86)\WIN_XP.EXE.EXEI
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Backdoor.SpyRat, %SYSDIR%\Microsoft\Win_Xp.exe
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Trojan.Agent, HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\|Microsoft WIN_XP
Source: cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EXTRA=Backdoor.Bifrose, %WINDIR%\Win_Xp\Win_Xp.exe
Source: cpcs.exe, 00000009.00000003.2541405292.000000000D450000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\SYSWOW64\MICROSOFT\WIN_XP.EXEW

Source: Yara match

File source: Process Memory Space: cpcs.exe PID: 2412, type: MEMORYSTR

Remote Access Functionality

Yara detected GhostRat

Source: Yara match	File source: 0000000F.00000003.2652428311.0000000004663000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cpcs.exe PID: 2412, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Valid Accounts	3 Native API	1 Scripting	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	1 Credential API Hooking	12 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	2 Replication Through Removable Media	3 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	2 Obfuscated Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	1 Credential API Hooking	22 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Service Execution	1 Valid Accounts	1 Valid Accounts	1 DLL Side-Loading	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	23 Windows Service	11 Access Token Manipulation	32 Masquerading	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	111 Registry Run Keys / Startup Folder	23 Windows Service	1 Valid Accounts	LSA Secrets	36 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	23 Process Injection	3 Virtualization/Sandbox Evasion	Cached Domain Credentials	131 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	111 Registry Run Keys / Startup Folder	11 Access Token Manipulation	DCSync	3 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	23 Process Injection	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Hidden Users	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Regsvr32	Network Sniffing	3 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
chica-pc-shield-1-75-0-1300-en-win.exe	3%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\7z.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe (copy)	2%	ReversingLabs
C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe (copy)	2%	ReversingLabs
C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcspt.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe (copy)	3%	ReversingLabs
C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsservice.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-0DUR6.tmp	2%	ReversingLabs
C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-6H2TN.tmp	4%	ReversingLabs
C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-6PN99.tmp	0%	ReversingLabs
C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-9INTD.tmp	2%	ReversingLabs
C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-CI4PM.tmp	0%	ReversingLabs
C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-CU77C.tmp	0%	ReversingLabs
C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-DB4G5.tmp	4%	ReversingLabs
C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-J2CDD.tmp	0%	ReversingLabs
C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-K9CAE.tmp	2%	ReversingLabs
C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-KP3IJ.tmp	2%	ReversingLabs
C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-L12IJ.tmp	2%	ReversingLabs
C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-S0PAI.tmp	3%	ReversingLabs
C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-SJQ69.tmp	0%	ReversingLabs
C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-UQ1R3.tmp	2%	ReversingLabs
C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\mbam.dll (copy)	2%	ReversingLabs
C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\mbamcore.dll (copy)	2%	ReversingLabs
C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\mbamext.dll (copy)	2%	ReversingLabs
C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\mbamnet.dll (copy)	2%	ReversingLabs
C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\mbamtoast.dll (copy)	4%	ReversingLabs
C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\ssubtmr6.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\unins000.exe (copy)	4%	ReversingLabs
C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\vbalsgrid6.ocx (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-93AED.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-93AED.tmp\_isetup\_shfoldr.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-93AED.tmp\mbam.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp	4%	ReversingLabs
C:\Windows\System32\drivers\is-VCK25.tmp	2%	ReversingLabs
C:\Windows\system32\drivers\cpcs.sys (copy)	2%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://www.innosetup.com/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
data-cdn.mbamupdates.com	65.9.66.84	true	false	unknown
edge.data-cdn.mbamupdates.com	unknown	unknown	false	unknown
hw.data-cdn.mbamupdates.com	unknown	unknown	false	unknown
llnw.data-cdn.mbamupdates.com	unknown	unknown	false	unknown
stats.mbamupdates.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
http://data-cdn.mbamupdates.com/v1/custom/chicalogic/version.chk	false	unknown
http://data-cdn.mbamupdates.com/v0/clients/chicalogic/mbam.check.program	false	unknown
http://data-cdn.mbamupdates.com/v1/news/chicalogic/version.chk	false	unknown
http://data-cdn.mbamupdates.com/v1/config/chicalogic/version.chk	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://best-pc.co.kr	cpcs.exe, 00000009.00000003.2534960911.000000000A621000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cdn.static.mal	cpcs.exe, 00000009.00000003.2509521137.0000000003556000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cdn.static.malwarebytes.org/clie	cpcsgui.exe	false		unknown
http://downloads.malwarebytes.org/mbam-download.phpon	cpcs.exe, 00000009.00000003.2510085331.000000000355F000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509982383.000000000355F000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509920343.000000000354D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.aimp.ru	cpcs.exe, 00000009.00000003.2556561426.0000000006534000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.chicalogic.com	chica-pc-shield-1-75-0-1300-en-win.exe, 00000000.00000003.2032168361.00000000023F0000.00000004.00001000.00020000.00000000.sdmp, chica-pc-shield-1-75-0-1300-en-win.exe, 00000000.00000003.2795341385.0000000002100000.00000004.00001000.00020000.00000000.sdmp, chica-pc-shield-1-75-0-1300-en-win.exe, 00000000.00000003.2032244303.00000000020F4000.00000004.00001000.00020000.00000000.sdmp, chica-pc-shield-1-75-0-1300-en-win.tmp, chica-pc-shield-1-75-0-1300-en-win.tmp, 00000001.00000003.2034370148.000000000213C000.00000004.00001000.00020000.00000000.sdmp, chica-pc-shield-1-75-0-1300-en-win.tmp, 00000001.00000003.2034264033.0000000003110000.00000004.00001000.00020000.00000000.sdmp, chica-pc-shield-1-75-0-1300-en-win.tmp, 00000001.00000003.2791392614.0000000002140000.00000004.00001000.00020000.00000000.sdmp, chica-pc-shield-1-75-0-1300-en-win.tmp, 00000001.00000003.2792550502.0000000002144000.00000004.00001000.00020000.00000000.sdmp, chica-pc-shield-1-75-0-1300-en-win.tmp, 00000001.00000003.2791262908.000000000213C000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://cdn.static.malwareb	cpcs.exe, 00000009.00000003.2509409389.0000000003565000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509325799.000000000355F000.00000004.00000020.00020000.00000000.sdmp, cpcsgui.exe	false		unknown
http://77.78.240.87/ebb.php	cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://xml.org/sax/features/namespace-prefixes	cpcsscheduler.exe, 0000000E.00000002.3285698951.000000006BCC3000.00000002.00000001.01000000.00000015.sdmp	false		unknown
http://wfef5.mine.nu/config.asp	cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.malwarebytes.org	cpcs.exe, 00000009.00000003.2510009992.0000000003565000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2510085331.000000000355F000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509982383.000000000355F000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509409389.0000000003565000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509325799.000000000355F000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509920343.000000000354D000.00000004.00000020.00020000.00000000.sdmp, cpcsgui.exe	false		unknown
http://cdn.static.malwarebytes.org/client_resources/1.7/images/StartupLite_64x64.png	cpcs.exe, 00000009.00000003.2510041575.000000000354D000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2510085331.000000000355F000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509409389.0000000003565000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509521137.0000000003556000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.malwarebytes.oY	cpcs.exe, 00000009.00000003.2509521137.0000000003553000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://xml.org/sax/features/string-interning	cpcsscheduler.exe, 0000000E.00000002.3285698951.000000006BCC3000.00000002.00000001.01000000.00000015.sdmp	false		unknown
http://www.ntkrnl.comy	cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.chicalogic.com/pc-shield-rew	cpcs.exe, 00000009.00000003.2510009992.0000000003565000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509982383.000000000355F000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509920343.000000000354D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://182.237.1.106:333/32.exe	cpcs.exe, 00000009.00000003.2528855901.000000000A101000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.GoCasino.com11	cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.6071.com/	cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://topagacilaboratuari.com/topagaci.com	cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://link0125baixa2010.fromru.com/arroxa.exe	cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cha.91mt.com/asp/xg.asp	cpcs.exe, 00000009.00000003.2528855901.000000000A101000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.ntkrnl.com	cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.go2000.cn.&	cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.malwarebytes.org/products/file	cpcsgui.exe	false		unknown
http://www.malwarebytes.or	cpcsgui.exe	false		unknown
http://www.malwarebytes.org/products/mbar	cpcsgui.exe	false		unknown
http://www.zippay.ru/robo-pay.php?lang=	cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.abyssmedia.com	cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529369405.0000000009D87000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.grandesgans.com/Vista.comr.	cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cdn.static.malwarebytes.org/client_resources/1.7/images/FileAssassin_64x64.png	cpcsgui.exe	false		unknown
http://www.heaventools.com)	cpcs.exe, 00000009.00000003.2556561426.0000000006534000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2533630438.000000000A445000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://bsalsa.com/	cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.appinf.com/features/no-whitespace-in-element-content	cpcsscheduler.exe, 0000000E.00000002.3285698951.000000006BCC3000.00000002.00000001.01000000.00000015.sdmp	false		unknown
http://www.innosetup.com/	chica-pc-shield-1-75-0-1300-en-win.tmp, chica-pc-shield-1-75-0-1300-en-win.tmp, 00000001.00000000.2033381655.0000000000401000.00000020.00000001.01000000.00000004.sdmp	false	URL Reputation: safe	unknown
http://saskentbbq.com/sasmate	cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.baidu.com	cpcs.exe, 00000009.00000003.2533161271.000000000A493000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2528855901.000000000A14E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.emule-project.net	cpcs.exe, 00000009.00000003.2556561426.0000000007934000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.malwarebytes.org/products/fileass	cpcsgui.exe	false		unknown
http://www.contoso.com/PostAccepter.aspxQ5	cpcs.exe, 00000009.00000003.2534960911.000000000A69B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.malwarebytes.org/products	cpcsgui.exe	false		unknown
http://www.Parodieront.com	cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.malwarebytes.org/products/fileassassin	cpcsgui.exe	false		unknown
http://www.abyssmedia.comz	cpcs.exe, 00000009.00000003.2529369405.0000000009D87000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.super-ec.cnhttp://wghai.com/echttp://qsyou.com	cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://xdinheirox.rememberit.com.au/	cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.abyssmedia.comion	cpcs.exe, 00000009.00000003.2529369405.0000000009D87000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cdn.static.malwareby	cpcsgui.exe	false		unknown
http://www.malwarebytes.org/products/fil	cpcsgui.exe	false		unknown
http://anthneic.blogspot.com/	cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2533842656.000000000A4B5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.malwarebytes.org/products/	cpcsgui.exe	false		unknown
http://as.starware.com	cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.go2000.cn	cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cdn.static.malwarebytes.org/client_resources/1.7/images/Chameleon_64x64.png	cpcs.exe, 00000009.00000003.2509409389.0000000003565000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.niudoudou.com/web/download/	cpcs.exe, 00000009.00000003.2528855901.000000000A101000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.qqceo.net	cpcs.exe, 00000009.00000003.2556561426.0000000006534000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cdn.static.malwa	cpcsgui.exe	false		unknown
http://geral.gratixhost.com.br/publicidade/publicidade.js	cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cdn.static.malwarebytes.org/client_r	cpcsgui.exe	false		unknown
http://http.proxy.icq.com/hello	cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://wara6.homeftp.org/c	cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://xml.org/sax/features/validation	cpcsscheduler.exe, 0000000E.00000002.3285698951.000000006BCC3000.00000002.00000001.01000000.00000015.sdmp	false		unknown
http://cdn.static.malwarebytes.org/client_resources/1.7/images/anti_rootkit_64x64.png	cpcsgui.exe	false		unknown
Http://WwW.YlmF.CoM	cpcs.exe, 00000009.00000003.2556561426.0000000006534000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://xml.org/sax/properties/lexical-handler	cpcsscheduler.exe, 0000000E.00000002.3285698951.000000006BCC3000.00000002.00000001.01000000.00000015.sdmp	false		unknown
http://www.appinf.com/features/enable-partial-reads	cpcsscheduler.exe, 0000000E.00000002.3285698951.000000006BCC3000.00000002.00000001.01000000.00000015.sdmp	false		unknown
http://www.jetswap.comD	cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://link0125baixa2010.fromru.com/arroxa.exeC:	cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://wsy539.myrice.com	cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2533842656.000000000A4B5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.cookst.com/sentry/api/20110306.exeW	cpcs.exe, 00000009.00000003.2533161271.000000000A44A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cdn.stat	cpcs.exe, 00000009.00000003.2510009992.0000000003565000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2510085331.000000000355F000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509982383.000000000355F000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509409389.0000000003565000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509325799.000000000355F000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509920343.000000000354D000.00000004.00000020.00020000.00000000.sdmp, cpcsgui.exe	false		unknown
http://w.clic	cpcs.exe, 00000009.00000003.2529231058.0000000009F11000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.chukotka.kz/cache/msn.php?id=0	cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.ww-xxooxx-ch.net	cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://redirecionamentosb.com/sw4.packer	cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.desksave.de	cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cdn.static.malwareb-	cpcs.exe, 00000009.00000003.2509521137.0000000003553000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.ankord.com/)	cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529734518.000000000A248000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://redirecionamentosb.com/sw4.pac	cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://xml.org/sax/features/external-parameter-entities	cpcsscheduler.exe, 0000000E.00000002.3285698951.000000006BCC3000.00000002.00000001.01000000.00000015.sdmp	false		unknown
http://www.malwarebytes.org/products/startuplite	cpcsgui.exe	false		unknown
http://www.malwarebytes.o	cpcs.exe, 00000009.00000003.2509521137.0000000003556000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.w3.	cpcs.exe, 00000009.00000003.2509409389.0000000003565000.00000004.00000020.00020000.00000000.sdmp, cpcs.exe, 00000009.00000003.2509325799.000000000355F000.00000004.00000020.00020000.00000000.sdmp, cpcsgui.exe	false		unknown
http://d1.kuai8.com	cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.appinf.com/features/no-whitespace-in-element-contenthttp://xml.org/sax/features/validatio	cpcsscheduler.exe, 0000000E.00000002.3285698951.000000006BCC3000.00000002.00000001.01000000.00000015.sdmp	false		unknown
http://www.eyuyan.com)	cpcs.exe, 00000009.00000003.2556561426.0000000007934000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://sms911.ru	cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://b.ez173.com/	cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.best-pc.co.kr	cpcs.exe, 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.grandesgans.com/Vista.com	cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.8es.cn/code/adview_pic.php	cpcs.exe, 00000009.00000003.2533161271.000000000A44A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.pdfforge.org/	cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.czsoft.go1.icpcn.com/	cpcs.exe, 00000009.00000003.2561266540.0000000003D26000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.a0?a.co0	cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://c.ez173.com/	cpcs.exe, 00000009.00000003.2535574656.000000000A39A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.GoCasino.com	cpcs.exe, 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
65.9.66.84	data-cdn.mbamupdates.com	United States		16509	AMAZON-02US	false
65.9.66.107	unknown	United States		16509	AMAZON-02US	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545541
Start date and time:	2024-10-30 16:56:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	chica-pc-shield-1-75-0-1300-en-win.exe
Detection:	MAL
Classification:	mal54.rans.troj.evad.winEXE@30/92@19/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 232 Number of non-executed functions: 239
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, e16604.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtEnumerateValueKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: chica-pc-shield-1-75-0-1300-en-win.exe

Simulations

Behavior and APIs

Time	Type	Description
11:57:54	API Interceptor	2x Sleep call for process: svchost.exe modified
11:58:55	API Interceptor	51x Sleep call for process: cpcs.exe modified
16:57:46	Autostart	Run: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce ChicaPC-Shield C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe /install /silent

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
65.9.66.84	https://www.pumpproducts.com/goulds-lb0735te-centrifugal-booster-pump-3-4-hp-208-230-460-volts-3-phase-1-1-4-npt-suction-1-npt-discharge-18-gpm-max-176-ft-max-head-5-impeller-tefc-stainless-steel-pump-end-casing.html	Get hash	malicious	Unknown	Browse
	https://meandyouj.weebly.com/	Get hash	malicious	Unknown	Browse
	https://coinbase-auth.netlify.app/	Get hash	malicious	HTMLPhisher	Browse
65.9.66.107	https://app.collabow.io/d/GNgkdZO5gKluqEP3mMdbEwzWbgEyOeRe8sIh64SLMvsN	Get hash	malicious	Unknown	Browse
	https://www.bdoiraq.com/	Get hash	malicious	Unknown	Browse
	http://smartchainplatformfx.pages.dev/	Get hash	malicious	Unknown	Browse
	http://umjkitjtsk.top/crp/325gewfkj345	Get hash	malicious	Unknown	Browse
	http://www.glasgowmobiletyres.com	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	Receipt.htm	Get hash	malicious	Unknown	Browse	18.245.86.57
	weekly-finances-report.xlsx	Get hash	malicious	KnowBe4	Browse	52.216.77.118
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.38
	https://token.onelogin.com-token-auth.com/XaFNXZmZxdFUzWDFPWVFxY2lia3BpYkY4UHdlcTNmZStWYjZidGFaMXFldkJJUk9VdmZTZVQxRk5QbVBlVFlJNGttbUlHcmViUysvaGcrWmRnbmwxLzZ6c0MrRWdVcEg1bHZtYnc4c2czNVlSUlhtdnRPc0gwWS9mZ3R4QTltZUZjdWZRZ1kvZmk0N2huS054TUFZUHJyNk4rNHcrNElWbjI0NWlrN2puRlNtYkx0ZzVhWExWcmpZbmt3PT0tLTFCMXhxTFNKS2ZOU3lIZTItLWtCRWhkMzBFQWZwNE0yN1QwM3BCT1E9PQ==?cid=2262276963	Get hash	malicious	KnowBe4	Browse	52.216.218.136
	https://token.onelogin.com-token-auth.com/Xa0Y1MmVibVhmY0E5dnlabzhVK2w2MVo4bXZUM3RzTFBZU1FSUEYxRHlzb29tODRTUDQ4alBDR3Y1cWUvN1JvVzhtWGVkaHFaSG0rOVpUTVV1VjY2a3MvZDB6TktwTHhsRk9xdzQwQjV6YjIvcnA5MjFsaFJEamtNdXI5UXQ1Qm9lK0ZsZFd0TXI0R2JWWlVYeFFXa2pBaXZOKzR2QXRkUTd3dlBLNzUrQ1RweERVMmQ5ZHQwdjlKZ2dlS2tEVUF5UEE9PS0tdFFWWndQdklZQXNodTY1US0tUXAyU1llVHhDaXRTRjU1OVNWMXFNdz09?cid=2262276963	Get hash	malicious	KnowBe4	Browse	54.231.236.168
	https://www.guidedtrack.com/programs/n5snx1a/run	Get hash	malicious	Unknown	Browse	52.222.236.122
	https://1rkzzyapew.beefreedesign.com/EfTl-assets-eurmktdynamics	Get hash	malicious	Unknown	Browse	13.32.121.40
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.38
	SecuriteInfo.com.Win32.SuspectCrc.28663.30359.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	https://www.google.im/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/s/cristorei.neemo.com.br/yaya/aALPghQuwJ38KMxdobOJdzxm/YW50b25lbGxhLmNvc3RhQGVzYS5pbnQ=	Get hash	malicious	Tycoon2FA	Browse	13.33.187.60
AMAZON-02US	Receipt.htm	Get hash	malicious	Unknown	Browse	18.245.86.57
	weekly-finances-report.xlsx	Get hash	malicious	KnowBe4	Browse	52.216.77.118
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.38
	https://token.onelogin.com-token-auth.com/XaFNXZmZxdFUzWDFPWVFxY2lia3BpYkY4UHdlcTNmZStWYjZidGFaMXFldkJJUk9VdmZTZVQxRk5QbVBlVFlJNGttbUlHcmViUysvaGcrWmRnbmwxLzZ6c0MrRWdVcEg1bHZtYnc4c2czNVlSUlhtdnRPc0gwWS9mZ3R4QTltZUZjdWZRZ1kvZmk0N2huS054TUFZUHJyNk4rNHcrNElWbjI0NWlrN2puRlNtYkx0ZzVhWExWcmpZbmt3PT0tLTFCMXhxTFNKS2ZOU3lIZTItLWtCRWhkMzBFQWZwNE0yN1QwM3BCT1E9PQ==?cid=2262276963	Get hash	malicious	KnowBe4	Browse	52.216.218.136
	https://token.onelogin.com-token-auth.com/Xa0Y1MmVibVhmY0E5dnlabzhVK2w2MVo4bXZUM3RzTFBZU1FSUEYxRHlzb29tODRTUDQ4alBDR3Y1cWUvN1JvVzhtWGVkaHFaSG0rOVpUTVV1VjY2a3MvZDB6TktwTHhsRk9xdzQwQjV6YjIvcnA5MjFsaFJEamtNdXI5UXQ1Qm9lK0ZsZFd0TXI0R2JWWlVYeFFXa2pBaXZOKzR2QXRkUTd3dlBLNzUrQ1RweERVMmQ5ZHQwdjlKZ2dlS2tEVUF5UEE9PS0tdFFWWndQdklZQXNodTY1US0tUXAyU1llVHhDaXRTRjU1OVNWMXFNdz09?cid=2262276963	Get hash	malicious	KnowBe4	Browse	54.231.236.168
	https://www.guidedtrack.com/programs/n5snx1a/run	Get hash	malicious	Unknown	Browse	52.222.236.122
	https://1rkzzyapew.beefreedesign.com/EfTl-assets-eurmktdynamics	Get hash	malicious	Unknown	Browse	13.32.121.40
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.38
	SecuriteInfo.com.Win32.SuspectCrc.28663.30359.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	https://www.google.im/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/s/cristorei.neemo.com.br/yaya/aALPghQuwJ38KMxdobOJdzxm/YW50b25lbGxhLmNvc3RhQGVzYS5pbnQ=	Get hash	malicious	Tycoon2FA	Browse	13.33.187.60

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\7z.dll (copy)	9f0TXmuCBE.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Variant.Mikey.166930.18140.30541.dll	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Variant.Mikey.166930.18140.30541.dll	Get hash	malicious	Unknown	Browse
	GzYMZtRVDU.exe	Get hash	malicious	Unknown	Browse
	msmdownloadtool.exe	Get hash	malicious	Unknown	Browse
	MsmDownloadTool.exe	Get hash	malicious	Unknown	Browse
	dmge-latest.exe	Get hash	malicious	Unknown	Browse
	lZYIQJNUsZ.exe	Get hash	malicious	Unknown	Browse
	sMpor4yDdu.exe	Get hash	malicious	Unknown	Browse
	Pxa4150NA5.exe	Get hash	malicious	AZORult++	Browse

Created / dropped Files

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\7z.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	914432
Entropy (8bit):	6.481500443477186
Encrypted:	false
SSDEEP:	24576:TW+wsDaQw6DDz3qRyPnmGfrnvVUKueY8RmneWtJ:TasY6DwOBfrnvV7UeWt
MD5:	04AD4B80880B32C94BE8D0886482C774
SHA1:	344FAF61C3EB76F4A2FB6452E83ED16C9CCE73E0
SHA-256:	A1E1D1F0FFF4FCCCFBDFA313F3BDFEA4D3DFE2C2D9174A615BBC39A0A6929338
SHA-512:	3E3AAF01B769471B18126E443A721C9E9A0269E9F5E48D0A10251BC1EE309855BD71EDE266CAA6828B007359B21BA562C2A5A3469078760F564FB7BD43ACABFB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 9f0TXmuCBE.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Variant.Mikey.166930.18140.30541.dll, Detection: malicious, Browse Filename: SecuriteInfo.com.Variant.Mikey.166930.18140.30541.dll, Detection: malicious, Browse Filename: GzYMZtRVDU.exe, Detection: malicious, Browse Filename: msmdownloadtool.exe, Detection: malicious, Browse Filename: MsmDownloadTool.exe, Detection: malicious, Browse Filename: dmge-latest.exe, Detection: malicious, Browse Filename: lZYIQJNUsZ.exe, Detection: malicious, Browse Filename: sMpor4yDdu.exe, Detection: malicious, Browse Filename: Pxa4150NA5.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........0;.tc;.tc;.tcT..c8.tc..zc3.tcT.~c?.tcT.pc9.tc..+c:.tc;.ucH.tc..)c<.tc...c.tcT..c..tcT..c9.tc..rc:.tc.pc:.tcRich;.tc........................PE..L....S.L...........!.....:...................P......................................................................p.......L...d........{......................8q...................................................P..(............................text....8.......:.................. ..`.rdata..bR...P...T...>..............@..@.data............^..................@....sxdata......p......................@....rsrc....{.......\|..................@..@.reloc...............n..............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\Languages\danish.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	26090
Entropy (8bit):	3.5138293053571332
Encrypted:	false
SSDEEP:	192:ZSmk2KLKS4DUjVNUve5sjIkm9PYt4PpwQ4sETQzI0BnMmka/kEasoAZ1SzGY:ZSmCKTcNEmsjdt4PcsETQDD/kEasoHGY
MD5:	605ED5505E900F06D4A0AFD4B52A6779
SHA1:	0C822909E159074F2E29C7D0E3453A2F5BBF7E00
SHA-256:	1F0C07F58A67FA154FE1A525A082705980F62FA84F6C8C58DA4A3E9141C19816
SHA-512:	93EC824B58BD4CA3FAB451A1EDEE6F31361B9F4D7EA341D6BB02602A11BEC88488D2B7F4562809A0F1320AA6DC8F1E0E26BBBB5D8C7D5AC533FCA863BDA95853
Malicious:	false
Preview:	..0.=.D.a.n.i.s.h.....1.=.C.h.i.c.a.P.C.-.S.h.i.e.l.d.....2.=.F...j. .t.i.l. .e.k.s.k.l.u.d.e.r.i.n.g.....3.=.G... .t.i.l. .l.o.k.a.t.i.o.n.....4.=.V...l.g. .a.l.l.e. .o.b.j.e.k.t.e.r.....5.=.F.r.a.v...l.g. .a.l.l.e. .o.b.j.e.k.t.e.r.....6.=.V...l.g. .a.l.l.e. .o.b.j.e.k.t.e.r. .f.r.a. .d.e.t.t.e. .f.i.r.m.a.....7.=.F.r.a.v...l.g. .a.l.l.e. .o.b.j.e.k.t.e.r. .f.r.a. .d.e.t.t.e. .f.i.r.m.a.....8.=.F.i.r.m.a. .i.n.f.o.r.m.a.t.i.o.n.....9.=.S.k.a.n.n.e.r.....1.0.=.B.e.s.k.y.t.t.e.l.s.e.....1.1.=.O.p.d.a.t.e.r.....1.2.=.K.a.r.a.n.t...n.e.....1.3.=.L.o.g.s.....1.4.=.E.k.s.k.l.u.d.e.r.i.n.g.....1.5.=.I.n.d.s.t.i.l.l.i.n.g.e.r.....1.6.=.F.l.e.r.e. .V...r.k.t...j.e.r.....1.7.=.O.m.....1.8.=.S.k.a.n.n.e.r.e.n. .k.a.n. .f.i.n.d.e. .o.g. .f.j.e.r.n.e. .s.k.a.d.e.l.i.g. .s.o.f.t.w.a.r.e.,. .s.o.m. .m...t.t.e. .f.i.n.d.e.s. .p... .d.i.n. .c.o.m.p.u.t.e.r... .V...l.g. .v.e.n.l.i.g.s.t. .e.n. .s.k.a.n.n.i.n.g.s.t.y.p.e. .o.g. .k.l.i.k. .. s.k.a.n.. .. .L.u.k. .v.e.n.l.i.g.s.t. .a.l.l.e. .u.n...d.v.e.

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\Languages\dutch.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	27806
Entropy (8bit):	3.4684618845087263
Encrypted:	false
SSDEEP:	768:c0fv25CUC2l61eFm41l2w3WdmD0Tpu3qWEpBjt2:nfv2ii6wFm41l2G4mwYqWE/jI
MD5:	E953D930719B22685F25BDA67DE3D1AD
SHA1:	5552871F6CA5F018E5991759D5DDEC7E23F8E630
SHA-256:	320428041630D443830840CF47857B73F4CC77C4D6FF8467A4B23D1B3817DE9D
SHA-512:	D0FBE77FE2C5B3282A2688377120E9C0C40CA7F835E347AE2B12E42A600CB6651DB79641034DC56E22D708B67C960B25F69E449A522C7777880F35BF331DC079
Malicious:	false
Preview:	..0.=.D.u.t.c.h.....1.=.C.h.i.c.a.P.C.-.S.h.i.e.l.d.....2.=.T.o.e.v.o.e.g.e.n. .a.a.n. .d.e. .n.e.g.e.e.r.l.i.j.s.t.....3.=.G.a. .n.a.a.r. .l.o.c.a.t.i.e.....4.=.S.e.l.e.c.t.e.e.r. .a.l.l.e. .o.b.j.e.c.t.e.n.....5.=.D.e.s.e.l.e.c.t.e.e.r. .a.l.l.e. .o.b.j.e.c.t.e.n.....6.=.S.e.l.e.c.t.e.e.r. .a.l.l.e. .o.b.j.e.c.t.e.n. .v.a.n. .d.e.z.e. .i.n.f.e.c.t.i.e.....7.=.D.e.s.e.l.e.c.t.e.e.r. .a.l.l.e. .o.b.j.e.c.t.e.n. .v.a.n. .d.e.z.e. .i.n.f.e.c.t.i.e.....8.=.I.n.f.o.r.m.a.t.i.e. .o.v.e.r. .d.e.z.e. .i.n.f.e.c.t.i.e.....9.=.S.c.a.n.n.e.r.....1.0.=.B.e.s.c.h.e.r.m.i.n.g.....1.1.=.U.p.d.a.t.e.s.....1.2.=.Q.u.a.r.a.n.t.a.i.n.e.....1.3.=.L.o.g.b.e.s.t.a.n.d.e.n.....1.4.=.N.e.g.e.e.r.l.i.j.s.t.....1.5.=.I.n.s.t.e.l.l.i.n.g.e.n.....1.6.=.G.e.r.e.e.d.s.c.h.a.p.....1.7.=.O.v.e.r.........1.8.=.D.e. .s.c.a.n.n.e.r. .k.a.n. .i.n.f.e.c.t.i.e.s. .v.i.n.d.e.n. .e.n. .v.e.r.w.i.j.d.e.r.e.n... .S.l.u.i.t. .e.e.r.s.t. .a.l.l.e. .a.n.d.e.r.e. .p.r.o.g.r.a.m.m.a.'.s. .a.f. .o.m. .d.e. .s.c.a.n. .p.r.e.s.t.a.t.

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\Languages\english.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	24032
Entropy (8bit):	3.5183168402875302
Encrypted:	false
SSDEEP:	384:vog5HwEduYOUiXvWZC+nMEtwCvWCReXz8jaDfNOTp1qI+:vog5HwfBQdXKoWIejea5OTp1k
MD5:	CB7FEE393B8B8553E1BA2516B3B163A8
SHA1:	051CAECA6E378D955F05315EA864F0FA2FD424CE
SHA-256:	1FF2ABFF575E156E2B2CC07C0F2B351B3DB1B9EEEBD9E42D0AE9AE7742666AE7
SHA-512:	9DC01D7C301C3D59570336D7411EA0DD324F9888740C3A31F04A2AC8F2EC799CBB751BA6B93D1B5874307A71A838751B94A6EA5EA98503AAB463743C3874F6B0
Malicious:	false
Preview:	..0.=.E.n.g.l.i.s.h.....1.=.C.h.i.c.a.P.C.-.S.h.i.e.l.d.....2.=.A.d.d. .t.o. .i.g.n.o.r.e. .l.i.s.t.....3.=.J.u.m.p. .t.o. .l.o.c.a.t.i.o.n.....4.=.C.h.e.c.k. .a.l.l. .i.t.e.m.s.....5.=.U.n.c.h.e.c.k. .a.l.l. .i.t.e.m.s.....6.=.C.h.e.c.k. .a.l.l. .i.t.e.m.s. .f.r.o.m. .t.h.i.s. .v.e.n.d.o.r.....7.=.U.n.c.h.e.c.k. .a.l.l. .i.t.e.m.s. .f.r.o.m. .t.h.i.s. .v.e.n.d.o.r.....8.=.V.e.n.d.o.r. .i.n.f.o.r.m.a.t.i.o.n.....9.=.S.c.a.n.n.e.r.....1.0.=.P.r.o.t.e.c.t.i.o.n.....1.1.=.U.p.d.a.t.e.....1.2.=.Q.u.a.r.a.n.t.i.n.e.....1.3.=.L.o.g.s.....1.4.=.I.g.n.o.r.e. .L.i.s.t.....1.5.=.S.e.t.t.i.n.g.s.....1.6.=.M.o.r.e. .T.o.o.l.s.....1.7.=.H.e.l.p.....1.8.=.T.h.e. .s.c.a.n.n.e.r. .w.i.l.l. .f.i.n.d. .a.n.d. .r.e.m.o.v.e. .m.a.l.i.c.i.o.u.s. .s.o.f.t.w.a.r.e. .t.h.a.t. .i.s. .i.n.f.e.c.t.i.n.g. .y.o.u.r. .c.o.m.p.u.t.e.r... .P.l.e.a.s.e. .s.e.l.e.c.t. .t.h.e. .s.c.a.n. .t.y.p.e. .a.n.d. .c.l.i.c.k. .'.S.c.a.n.'... .P.l.e.a.s.e. .c.l.o.s.e. .a.l.l. .u.n.n.e.c.e.s.s.a.r.y. .w.i.n.d.o.w.s. .a.n.d. .a.p.p.

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\Languages\finnish.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	25458
Entropy (8bit):	3.4525083855467718
Encrypted:	false
SSDEEP:	384:lWkz0VMgliFYHFa94CPiwixvEcuc+Cs/3wZh0f+9D3EzM+I:lhtglYYHFamY3KvEdQif+pZ
MD5:	22EC0A87090FDC6FF41525A09208374E
SHA1:	DAF9BD25E628157612622B65E2FD58A13E3E5095
SHA-256:	F66929356AB9895D1E4DA4F4047223F8348443C10A56CC1DD63CF87EA4724076
SHA-512:	70C7247127EDA54D16E8D2DEFC7B315D956C69A3BE99153EBB66F42960CFA03F9F48A86387F7E8ACAAE8FC59E0455DCEB6827ABA64130021DA284616F2631994
Malicious:	false
Preview:	..0.=.F.i.n.n.i.s.h.....1.=.C.h.i.c.a.P.C.-.S.h.i.e.l.d.....2.=.L.i.s..... .h.u.o.m.i.o.i.m.a.t.t.o.m.u.u.s.l.i.s.t.a.l.l.e.....3.=.S.i.i.r.r.y. .s.i.j.a.i.n.t.i.i.n.....4.=.V.a.l.i.t.s.e. .k.a.i.k.k.i. .k.o.h.t.e.e.t.....5.=...l... .v.a.l.i.t.s.e. .m.i.t.....n. .k.o.h.t.e.i.t.a.....6.=.V.a.l.i.t.s.e. .k.a.i.k.k.i. .k.o.h.t.e.e.t. .t...l.t... .v.a.l.m.i.s.t.a.j.a.l.t.a. .....7.=...l... .v.a.l.i.t.s.e. .m.i.t.....n. .k.o.h.t.e.i.t.a. .t...l.t... .v.a.l.m.i.s.t.a.j.a.l.t.a. .....8.=.V.a.l.m.i.s.t.a.j.a.n. .t.i.e.d.o.t.....9.=.T.a.r.k.i.s.t.u.s.....1.0.=.S.u.o.j.a.u.s.....1.1.=.P...i.v.i.t.y.s.....1.2.=.K.a.r.a.n.t.e.e.n.i.....1.3.=.L.o.k.i.t.i.e.d.o.s.t.o.t.....1.4.=.O.h.i.t.u.s.l.i.s.t.a.....1.5.=.A.s.e.t.u.k.s.e.t.....1.6.=.L.i.s..... .t.y...k.a.l.u.j.a.....1.7.=.T.i.e.t.o.a.....1.8.=.T.a.r.k.i.s.t.u.s. .v.o.i. .l...y.t..... .j.a. .p.o.i.s.t.a.a. .j...r.j.e.s.t.e.l.m...s.s...s.i. .o.l.e.v.i.a. .h.a.i.t.t.a.o.h.j.e.l.m.i.a... .V.a.l.i.t.s.e. .t.a.r.k.i.s.t.u.s.t.y.y.p.p.i. .j.a. .v.a.l.

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\Languages\french.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	29294
Entropy (8bit):	3.4950342969339037
Encrypted:	false
SSDEEP:	384:SF2PIuXEVX/VJ1RFDRrXq8tYKe7P+TMJhOkmGsUb4Frhipu9d:SLdRq1PCO74V
MD5:	9CF1C60759D70D870E2E01932E774AAE
SHA1:	1F286192B03C0C70698EF42BBB536C6954DFCB69
SHA-256:	1D72D91FFB86204BD9A61E504FF5BD363043E5F14B4CE04A6E07056A003E580D
SHA-512:	88805199FAE98D1EB851909C445D9A95D7C8F3E938FE5AA8208943AA417DDC93DE7BC4115196FD3AEC37B7F0E164A96B4240C4AAF080866025542C1049095518
Malicious:	false
Preview:	..0.=.F.r.e.n.c.h.....1.=.C.h.i.c.a.P.C.-.S.h.i.e.l.d.....2.=.A.j.o.u.t.e.r. .a.u.x. .e.x.c.l.u.s.i.o.n.s.....3.=.A.l.l.e.r. ... .l.'.e.m.p.l.a.c.e.m.e.n.t.....4.=.T.o.u.t. .c.o.c.h.e.r.....5.=.T.o.u.t. .d...c.o.c.h.e.r.....6.=.C.o.c.h.e.r. .t.o.u.s. .l.e.s. ...l...m.e.n.t.s. .d.e. .c.e. .v.e.n.d.e.u.r.....7.=.D...c.o.c.h.e.r. .t.o.u.s. .l.e.s. ...l...m.e.n.t.s. .d.e. .c.e. .v.e.n.d.e.u.r.....8.=.I.n.f.o.r.m.a.t.i.o.n.s. .s.u.r. .l.e. .v.e.n.d.e.u.r.....9.=.R.e.c.h.e.r.c.h.e.....1.0.=.P.r.o.t.e.c.t.i.o.n.....1.1.=.M.i.s.e. ... .j.o.u.r.....1.2.=.Q.u.a.r.a.n.t.a.i.n.e.....1.3.=.R.a.p.p.o.r.t.s./.L.o.g.s.....1.4.=.E.x.c.l.u.s.i.o.n.s.....1.5.=.P.a.r.a.m...t.r.e.s.....1.6.=.A.u.t.r.e.s. .o.u.t.i.l.s.....1.7.=.A. .p.r.o.p.o.s...........1.8.=.L.e. .m.o.d.u.l.e. .d.e. .r.e.c.h.e.r.c.h.e. .p.e.u.t. .t.r.o.u.v.e.r. .e.t. .s.u.p.p.r.i.m.e.r. .d.e.s. .p.r.o.g.r.a.m.m.e.s. .m.a.l.v.e.i.l.l.a.n.t.s. .p.r...s.e.n.t.s. .s.u.r. .v.o.t.r.e. .s.y.s.t...m.e... .C.h.o.i.s.i.s.s.e.z. .u.n. .t.y.p.e. .d.'.

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\Languages\german.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	29372
Entropy (8bit):	3.5425237288380647
Encrypted:	false
SSDEEP:	768:XmgtzRbWpEatDSp+Groyo0y9P65q18CIqMGls9FqxnGe1:WgtztWmaQp+Groyo0y9z8qMG6qxnGe1
MD5:	B46C9C0D2BDA5299659845A723DB640A
SHA1:	3BF0B555980F14AE06288C465322E07AC8AD4279
SHA-256:	9BDFDA5651B2284A057CC5F43E927AF95B580E06552ACF6A9D2677550ADBD612
SHA-512:	297C5A05CD5A6BD5138A6B2B7AD059CD7E79545DFC468C8EE7F106E64E3E7D94075854B8F1E262F2B170AE88ADF48CBD7AD989B0C297161FB479BA659510A922
Malicious:	false
Preview:	..0.=.G.e.r.m.a.n.....1.=.C.h.i.c.a.P.C.-.S.h.i.e.l.d.....2.=.Z.u.r. .I.g.n.o.r.i.e.r.l.i.s.t.e. .h.i.n.z.u.f...g.e.n.....3.=.S.p.r.i.n.g.e. .z.u. .P.o.s.i.t.i.o.n.....4.=.A.l.l.e. .E.i.n.t.r...g.e. .a.u.s.w...h.l.e.n.....5.=.A.u.s.w.a.h.l. .a.l.l.e.r. .E.i.n.t.r...g.e. .r...c.k.g...n.g.i.g. .m.a.c.h.e.n.....6.=.A.l.l.e. .E.i.n.t.r...g.e. .d.i.e.s.e.s. .A.n.b.i.e.t.e.r.s. .a.u.s.w...h.l.e.n.....7.=.A.u.s.w.a.h.l. .a.l.l.e.r. .E.i.n.t.r...g.e. .d.i.e.s.e.s. .A.n.b.i.e.t.e.r.s. .r...c.k.g...n.g.i.g. .m.a.c.h.e.n.....8.=.A.n.b.i.e.t.e.r. .I.n.f.o.r.m.a.t.i.o.n.e.n.....9.=.S.u.c.h.l.a.u.f.....1.0.=.S.c.h.u.t.z.....1.1.=.A.k.t.u.a.l.i.s.i.e.r.u.n.g.....1.2.=.Q.u.a.r.a.n.t...n.e.....1.3.=.L.o.g.d.a.t.e.i.e.n.....1.4.=.I.g.n.o.r.i.e.r.l.i.s.t.e.....1.5.=.E.i.n.s.t.e.l.l.u.n.g.e.n.....1.6.=.W.e.i.t.e.r.e. .P.r.o.g.r.a.m.m.e.....1.7.=...b.e.r.....1.8.=.D.e.r. .S.u.c.h.l.a.u.f. .k.a.n.n. .b...s.a.r.t.i.g.e. .P.r.o.g.r.a.m.m.e. .a.u.f. .I.h.r.e.m. .S.y.s.t.e.m. .f.i.n.d.e.n. .u.n.d. .e.n.t.f.e.r.

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\Languages\is-0HFFJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	29546
Entropy (8bit):	3.4652359591306263
Encrypted:	false
SSDEEP:	384:0oomqWisQuRZGDQb+CmsGyO+1UxQR8rEB+0uF7IuPSu+FKWlBk7:0oRiTO96CmsDOpQ2wB1XuPLWly
MD5:	3A57303C8AAF78C7AB7ED16B3DC10989
SHA1:	8DCA05D0C55CFA6FBD78AFA8C177FD68ECAEC8D9
SHA-256:	9CEE0D51D2385AA56A41461EEF49354AA473B67FF017DDF4437781CE505F5815
SHA-512:	F4F61AA31F0B1A42AA38793E8F8C6279223A34E68ABD624388E8C1469CFD91144283E459C89DE85E4C6053428B88CE6A95A7855061F2C80E7BAA624BA49A4AFB
Malicious:	false
Preview:	..0.=.S.p.a.n.i.s.h.....1.=.C.h.i.c.a.P.C.-.S.h.i.e.l.d.....2.=.A...a.d.i.r. .a. .l.a. .l.i.s.t.a. .d.e. .i.g.n.o.r.a.d.o.s.....3.=.I.r. .a. .l.a. .u.b.i.c.a.c.i...n.....4.=.M.a.r.c.a.r. .t.o.d.o.s. .l.o.s. .e.l.e.m.e.n.t.o.s.....5.=.D.e.s.m.a.r.c.a.r. .t.o.d.o.s. .l.o.s. .e.l.e.m.e.n.t.o.s.....6.=.C.o.m.p.r.u.e.b.e. .t.o.d.o.s. .l.o.s. .e.l.e.m.e.n.t.o.s. .d.e. .e.s.t.e. .p.r.o.v.e.e.d.o.r.....7.=.D.e.s.m.a.r.c.a.r. .t.o.d.o.s. .l.o.s. .e.l.e.m.e.n.t.o.s. .d.e. .e.s.t.e. .p.r.o.v.e.e.d.o.r.....8.=.I.n.f.o.r.m.a.c.i...n. .s.o.b.r.e. .e.l. .p.r.o.v.e.e.d.o.r.....9.=.E.s.c...n.e.r.....1.0.=.P.r.o.t.e.c.c.i...n.....1.1.=.A.c.t.u.a.l.i.z.a.r.....1.2.=.C.u.a.r.e.n.t.e.n.a.....1.3.=.R.e.g.i.s.t.r.o.s.....1.4.=.L.i.s.t.a. .d.e. .i.g.n.o.r.a.d.o.s.....1.5.=.C.o.n.f.i.g.u.r.a.c.i...n.....1.6.=.M...s. .h.e.r.r.a.m.i.e.n.t.a.s.....1.7.=.A.c.e.r.c.a. .d.e.....1.8.=.E.l. .e.s.c.a.n.e.o. .p.u.e.d.e. .e.n.c.o.n.t.r.a.r. .y. .e.l.i.m.i.n.a.r. .e.l. .s.o.f.t.w.a.r.e. .m.a.l.i.c.i.o.s.o. .p.r.e.s.e.n.t.

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\Languages\is-3614V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	24602
Entropy (8bit):	3.511817410114942
Encrypted:	false
SSDEEP:	384:w+uox0zeMk1KtiSsVJDu8AOcDjB3OyHTeuy:nuox0zeMk1KtiSsVNujvB3lTi
MD5:	33865F12839E7FEF9FC7956C5827295D
SHA1:	DF1AD9FDF84B12B69F8F1D701FEDA8AFD05D7AF8
SHA-256:	3A3F5DCD1518C6EFD066A36FAF09AA55AAA0C98201E31F5DB2406CDCB63DD4A2
SHA-512:	889B6BB7C7C83F14FF933C0AC4851AF789A511C6EB2AB7F8A9D983E4721052C274ABA7D0EA9F67A22F202DE960971BF0FE228A1E65F06F093EE840DAC11CCD58
Malicious:	false
Preview:	..0.=.N.o.r.w.e.g.i.a.n.....1.=.C.h.i.c.a.P.C.-.S.h.i.e.l.d.....2.=.L.e.g.g. .t.i.l. .e.k.s.k.l.u.d.e.r.i.n.g.s.l.i.s.t.e.n.....3.=.G... .t.i.l. .d.e.s.t.i.n.a.s.j.o.n.....4.=.V.e.l.g. .a.l.l.e. .o.b.j.e.k.t.e.r.....5.=.F.j.e.r.n. .a.l.l.e. .o.b.j.e.k.t.e.r.....6.=.V.e.l.g. .a.l.l.e. .o.b.j.e.k.t.e.r. .f.r.a. .d.e.n.n.e. .p.r.o.d.u.s.e.n.t.e.n.....7.=.F.j.e.r.n. .a.l.l.e. .e.l.e.m.e.n.t.e.r. .f.r.a. .d.e.n.n.e. .p.r.o.d.u.s.e.n.t.e.n.....8.=.P.r.o.d.u.s.e.n.t.i.n.f.o.r.m.a.s.j.o.n.....9.=.S.k.a.n.n.e.r.....1.0.=.B.e.s.k.y.t.t.e.l.s.e.....1.1.=.O.p.p.d.a.t.e.r.....1.2.=.K.a.r.a.n.t.e.n.e.....1.3.=.L.o.g.g.e.r.....1.4.=.E.k.s.k.l.u.d.e.r.i.n.g.s.l.i.s.t.e.....1.5.=.I.n.n.s.t.i.l.l.i.n.g.e.r.....1.6.=.F.l.e.r.e. .v.e.r.k.t...y.....1.7.=.O.m.....1.8.=.S.k.a.n.n.e.r.e.n. .k.a.n. .f.i.n.n.e. .o.g. .f.j.e.r.n.e. .s.k.a.d.e.l.i.g. .p.r.o.g.r.a.m.v.a.r.e. .p... .s.y.s.t.e.m.e.t. .d.i.t.t... .V.e.l.g. .e.n. .s...k.e.m.e.t.o.d.e. .o.g. .k.l.i.k.k. .'.S.k.a.n.n.'... .V.e.n.n.l.i.g.s.t. .l.u.k.k. .

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\Languages\is-36Q7V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	25478
Entropy (8bit):	3.5297575392191374
Encrypted:	false
SSDEEP:	384:X3DXSknVEWkeeXL0NqNP4X7DAh1rQrfYo+XbA089lZ7hEIY4u:XFVEXeeXL08NwX7DL+gjYl
MD5:	2EF431197148CAF95808046A43401EE0
SHA1:	6D23BC04CEECA33232B769492FC68C339794E945
SHA-256:	2B4A5A26AAC4F920C1D56DBB5764A7DF53EA99BAB0D70132FAF9955E5D6CA045
SHA-512:	B8182495CC18487942A5C0F5E32EF41315A3EEA467AF7A354D10ABBA1065A7A088966FC19CD816599EC529FA7D5C78CADBAE30436997DC230F8F61BA4E546370
Malicious:	false
Preview:	..0.=.S.w.e.d.i.s.h.....1.=.C.h.i.c.a.P.C.-.S.h.i.e.l.d.....2.=.L...g.g. .t.i.l.l. .i. .i.g.n.o.r.e.r.a.l.i.s.t.a.n.....3.=.H.o.p.p.a. .t.i.l.l. .p.l.a.t.s.....4.=.M.a.r.k.e.r.a. .a.l.l.a. .p.o.s.t.e.r.....5.=.A.v.m.a.r.k.e.r.a. .a.l.l.a. .p.o.s.t.e.r.....6.=.M.a.r.k.e.r.a. .a.l.l.a. .p.o.s.t.e.r. .f.r...n. .d.e.n. .h...r. .u.t.f...r.d.a.r.e.n.....7.=.A.v.m.a.r.k.e.r.a. .a.l.l.a. .p.o.s.t.e.r. .f.r...n. .d.e.n. .h...r. .u.t.f...r.d.a.r.e.n.....8.=.U.t.f...r.d.a.r.i.n.f.o.r.m.a.t.i.o.n.....9.=.S.k.a.n.n.e.r.....1.0.=.S.k.y.d.d.....1.1.=.U.p.p.d.a.t.e.r.a.....1.2.=.K.a.r.a.n.t...n.....1.3.=.L.o.g.g.a.r.....1.4.=.I.g.n.o.r.e.r.a.l.i.s.t.a.....1.5.=.I.n.s.t...l.l.n.i.n.g.a.r.....1.6.=.F.l.e.r. .v.e.r.k.t.y.g.....1.7.=.O.m.....1.8.=.S.k.a.n.n.e.r.n. .k.a.n. .h.i.t.t.a. .o.c.h. .t.a. .b.o.r.t. .s.k.a.d.l.i.g.a. .p.r.o.g.r.a.m. .s.o.m. .f.i.n.n.s. .i. .d.i.t.t. .s.y.s.t.e.m... .V...l.j. .e.n. .s.k.a.n.n.i.n.g.s.t.y.p. .o.c.h. .k.l.i.c.k.a. .p... .'.S.k.a.n.n.a.'... .A.v.s.l.u.t.a. .a.l.l.a. .

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\Languages\is-5A794.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	27806
Entropy (8bit):	3.4684618845087263
Encrypted:	false
SSDEEP:	768:c0fv25CUC2l61eFm41l2w3WdmD0Tpu3qWEpBjt2:nfv2ii6wFm41l2G4mwYqWE/jI
MD5:	E953D930719B22685F25BDA67DE3D1AD
SHA1:	5552871F6CA5F018E5991759D5DDEC7E23F8E630
SHA-256:	320428041630D443830840CF47857B73F4CC77C4D6FF8467A4B23D1B3817DE9D
SHA-512:	D0FBE77FE2C5B3282A2688377120E9C0C40CA7F835E347AE2B12E42A600CB6651DB79641034DC56E22D708B67C960B25F69E449A522C7777880F35BF331DC079
Malicious:	false
Preview:	..0.=.D.u.t.c.h.....1.=.C.h.i.c.a.P.C.-.S.h.i.e.l.d.....2.=.T.o.e.v.o.e.g.e.n. .a.a.n. .d.e. .n.e.g.e.e.r.l.i.j.s.t.....3.=.G.a. .n.a.a.r. .l.o.c.a.t.i.e.....4.=.S.e.l.e.c.t.e.e.r. .a.l.l.e. .o.b.j.e.c.t.e.n.....5.=.D.e.s.e.l.e.c.t.e.e.r. .a.l.l.e. .o.b.j.e.c.t.e.n.....6.=.S.e.l.e.c.t.e.e.r. .a.l.l.e. .o.b.j.e.c.t.e.n. .v.a.n. .d.e.z.e. .i.n.f.e.c.t.i.e.....7.=.D.e.s.e.l.e.c.t.e.e.r. .a.l.l.e. .o.b.j.e.c.t.e.n. .v.a.n. .d.e.z.e. .i.n.f.e.c.t.i.e.....8.=.I.n.f.o.r.m.a.t.i.e. .o.v.e.r. .d.e.z.e. .i.n.f.e.c.t.i.e.....9.=.S.c.a.n.n.e.r.....1.0.=.B.e.s.c.h.e.r.m.i.n.g.....1.1.=.U.p.d.a.t.e.s.....1.2.=.Q.u.a.r.a.n.t.a.i.n.e.....1.3.=.L.o.g.b.e.s.t.a.n.d.e.n.....1.4.=.N.e.g.e.e.r.l.i.j.s.t.....1.5.=.I.n.s.t.e.l.l.i.n.g.e.n.....1.6.=.G.e.r.e.e.d.s.c.h.a.p.....1.7.=.O.v.e.r.........1.8.=.D.e. .s.c.a.n.n.e.r. .k.a.n. .i.n.f.e.c.t.i.e.s. .v.i.n.d.e.n. .e.n. .v.e.r.w.i.j.d.e.r.e.n... .S.l.u.i.t. .e.e.r.s.t. .a.l.l.e. .a.n.d.e.r.e. .p.r.o.g.r.a.m.m.a.'.s. .a.f. .o.m. .d.e. .s.c.a.n. .p.r.e.s.t.a.t.

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\Languages\is-5RTRO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	29294
Entropy (8bit):	3.4950342969339037
Encrypted:	false
SSDEEP:	384:SF2PIuXEVX/VJ1RFDRrXq8tYKe7P+TMJhOkmGsUb4Frhipu9d:SLdRq1PCO74V
MD5:	9CF1C60759D70D870E2E01932E774AAE
SHA1:	1F286192B03C0C70698EF42BBB536C6954DFCB69
SHA-256:	1D72D91FFB86204BD9A61E504FF5BD363043E5F14B4CE04A6E07056A003E580D
SHA-512:	88805199FAE98D1EB851909C445D9A95D7C8F3E938FE5AA8208943AA417DDC93DE7BC4115196FD3AEC37B7F0E164A96B4240C4AAF080866025542C1049095518
Malicious:	false
Preview:	..0.=.F.r.e.n.c.h.....1.=.C.h.i.c.a.P.C.-.S.h.i.e.l.d.....2.=.A.j.o.u.t.e.r. .a.u.x. .e.x.c.l.u.s.i.o.n.s.....3.=.A.l.l.e.r. ... .l.'.e.m.p.l.a.c.e.m.e.n.t.....4.=.T.o.u.t. .c.o.c.h.e.r.....5.=.T.o.u.t. .d...c.o.c.h.e.r.....6.=.C.o.c.h.e.r. .t.o.u.s. .l.e.s. ...l...m.e.n.t.s. .d.e. .c.e. .v.e.n.d.e.u.r.....7.=.D...c.o.c.h.e.r. .t.o.u.s. .l.e.s. ...l...m.e.n.t.s. .d.e. .c.e. .v.e.n.d.e.u.r.....8.=.I.n.f.o.r.m.a.t.i.o.n.s. .s.u.r. .l.e. .v.e.n.d.e.u.r.....9.=.R.e.c.h.e.r.c.h.e.....1.0.=.P.r.o.t.e.c.t.i.o.n.....1.1.=.M.i.s.e. ... .j.o.u.r.....1.2.=.Q.u.a.r.a.n.t.a.i.n.e.....1.3.=.R.a.p.p.o.r.t.s./.L.o.g.s.....1.4.=.E.x.c.l.u.s.i.o.n.s.....1.5.=.P.a.r.a.m...t.r.e.s.....1.6.=.A.u.t.r.e.s. .o.u.t.i.l.s.....1.7.=.A. .p.r.o.p.o.s...........1.8.=.L.e. .m.o.d.u.l.e. .d.e. .r.e.c.h.e.r.c.h.e. .p.e.u.t. .t.r.o.u.v.e.r. .e.t. .s.u.p.p.r.i.m.e.r. .d.e.s. .p.r.o.g.r.a.m.m.e.s. .m.a.l.v.e.i.l.l.a.n.t.s. .p.r...s.e.n.t.s. .s.u.r. .v.o.t.r.e. .s.y.s.t...m.e... .C.h.o.i.s.i.s.s.e.z. .u.n. .t.y.p.e. .d.'.

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\Languages\is-DLO1P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	24032
Entropy (8bit):	3.5183168402875302
Encrypted:	false
SSDEEP:	384:vog5HwEduYOUiXvWZC+nMEtwCvWCReXz8jaDfNOTp1qI+:vog5HwfBQdXKoWIejea5OTp1k
MD5:	CB7FEE393B8B8553E1BA2516B3B163A8
SHA1:	051CAECA6E378D955F05315EA864F0FA2FD424CE
SHA-256:	1FF2ABFF575E156E2B2CC07C0F2B351B3DB1B9EEEBD9E42D0AE9AE7742666AE7
SHA-512:	9DC01D7C301C3D59570336D7411EA0DD324F9888740C3A31F04A2AC8F2EC799CBB751BA6B93D1B5874307A71A838751B94A6EA5EA98503AAB463743C3874F6B0
Malicious:	false
Preview:	..0.=.E.n.g.l.i.s.h.....1.=.C.h.i.c.a.P.C.-.S.h.i.e.l.d.....2.=.A.d.d. .t.o. .i.g.n.o.r.e. .l.i.s.t.....3.=.J.u.m.p. .t.o. .l.o.c.a.t.i.o.n.....4.=.C.h.e.c.k. .a.l.l. .i.t.e.m.s.....5.=.U.n.c.h.e.c.k. .a.l.l. .i.t.e.m.s.....6.=.C.h.e.c.k. .a.l.l. .i.t.e.m.s. .f.r.o.m. .t.h.i.s. .v.e.n.d.o.r.....7.=.U.n.c.h.e.c.k. .a.l.l. .i.t.e.m.s. .f.r.o.m. .t.h.i.s. .v.e.n.d.o.r.....8.=.V.e.n.d.o.r. .i.n.f.o.r.m.a.t.i.o.n.....9.=.S.c.a.n.n.e.r.....1.0.=.P.r.o.t.e.c.t.i.o.n.....1.1.=.U.p.d.a.t.e.....1.2.=.Q.u.a.r.a.n.t.i.n.e.....1.3.=.L.o.g.s.....1.4.=.I.g.n.o.r.e. .L.i.s.t.....1.5.=.S.e.t.t.i.n.g.s.....1.6.=.M.o.r.e. .T.o.o.l.s.....1.7.=.H.e.l.p.....1.8.=.T.h.e. .s.c.a.n.n.e.r. .w.i.l.l. .f.i.n.d. .a.n.d. .r.e.m.o.v.e. .m.a.l.i.c.i.o.u.s. .s.o.f.t.w.a.r.e. .t.h.a.t. .i.s. .i.n.f.e.c.t.i.n.g. .y.o.u.r. .c.o.m.p.u.t.e.r... .P.l.e.a.s.e. .s.e.l.e.c.t. .t.h.e. .s.c.a.n. .t.y.p.e. .a.n.d. .c.l.i.c.k. .'.S.c.a.n.'... .P.l.e.a.s.e. .c.l.o.s.e. .a.l.l. .u.n.n.e.c.e.s.s.a.r.y. .w.i.n.d.o.w.s. .a.n.d. .a.p.p.

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\Languages\is-GM6MD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	25458
Entropy (8bit):	3.4525083855467718
Encrypted:	false
SSDEEP:	384:lWkz0VMgliFYHFa94CPiwixvEcuc+Cs/3wZh0f+9D3EzM+I:lhtglYYHFamY3KvEdQif+pZ
MD5:	22EC0A87090FDC6FF41525A09208374E
SHA1:	DAF9BD25E628157612622B65E2FD58A13E3E5095
SHA-256:	F66929356AB9895D1E4DA4F4047223F8348443C10A56CC1DD63CF87EA4724076
SHA-512:	70C7247127EDA54D16E8D2DEFC7B315D956C69A3BE99153EBB66F42960CFA03F9F48A86387F7E8ACAAE8FC59E0455DCEB6827ABA64130021DA284616F2631994
Malicious:	false
Preview:	..0.=.F.i.n.n.i.s.h.....1.=.C.h.i.c.a.P.C.-.S.h.i.e.l.d.....2.=.L.i.s..... .h.u.o.m.i.o.i.m.a.t.t.o.m.u.u.s.l.i.s.t.a.l.l.e.....3.=.S.i.i.r.r.y. .s.i.j.a.i.n.t.i.i.n.....4.=.V.a.l.i.t.s.e. .k.a.i.k.k.i. .k.o.h.t.e.e.t.....5.=...l... .v.a.l.i.t.s.e. .m.i.t.....n. .k.o.h.t.e.i.t.a.....6.=.V.a.l.i.t.s.e. .k.a.i.k.k.i. .k.o.h.t.e.e.t. .t...l.t... .v.a.l.m.i.s.t.a.j.a.l.t.a. .....7.=...l... .v.a.l.i.t.s.e. .m.i.t.....n. .k.o.h.t.e.i.t.a. .t...l.t... .v.a.l.m.i.s.t.a.j.a.l.t.a. .....8.=.V.a.l.m.i.s.t.a.j.a.n. .t.i.e.d.o.t.....9.=.T.a.r.k.i.s.t.u.s.....1.0.=.S.u.o.j.a.u.s.....1.1.=.P...i.v.i.t.y.s.....1.2.=.K.a.r.a.n.t.e.e.n.i.....1.3.=.L.o.k.i.t.i.e.d.o.s.t.o.t.....1.4.=.O.h.i.t.u.s.l.i.s.t.a.....1.5.=.A.s.e.t.u.k.s.e.t.....1.6.=.L.i.s..... .t.y...k.a.l.u.j.a.....1.7.=.T.i.e.t.o.a.....1.8.=.T.a.r.k.i.s.t.u.s. .v.o.i. .l...y.t..... .j.a. .p.o.i.s.t.a.a. .j...r.j.e.s.t.e.l.m...s.s...s.i. .o.l.e.v.i.a. .h.a.i.t.t.a.o.h.j.e.l.m.i.a... .V.a.l.i.t.s.e. .t.a.r.k.i.s.t.u.s.t.y.y.p.p.i. .j.a. .v.a.l.

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\Languages\is-P4B2K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	26090
Entropy (8bit):	3.5138293053571332
Encrypted:	false
SSDEEP:	192:ZSmk2KLKS4DUjVNUve5sjIkm9PYt4PpwQ4sETQzI0BnMmka/kEasoAZ1SzGY:ZSmCKTcNEmsjdt4PcsETQDD/kEasoHGY
MD5:	605ED5505E900F06D4A0AFD4B52A6779
SHA1:	0C822909E159074F2E29C7D0E3453A2F5BBF7E00
SHA-256:	1F0C07F58A67FA154FE1A525A082705980F62FA84F6C8C58DA4A3E9141C19816
SHA-512:	93EC824B58BD4CA3FAB451A1EDEE6F31361B9F4D7EA341D6BB02602A11BEC88488D2B7F4562809A0F1320AA6DC8F1E0E26BBBB5D8C7D5AC533FCA863BDA95853
Malicious:	false
Preview:	..0.=.D.a.n.i.s.h.....1.=.C.h.i.c.a.P.C.-.S.h.i.e.l.d.....2.=.F...j. .t.i.l. .e.k.s.k.l.u.d.e.r.i.n.g.....3.=.G... .t.i.l. .l.o.k.a.t.i.o.n.....4.=.V...l.g. .a.l.l.e. .o.b.j.e.k.t.e.r.....5.=.F.r.a.v...l.g. .a.l.l.e. .o.b.j.e.k.t.e.r.....6.=.V...l.g. .a.l.l.e. .o.b.j.e.k.t.e.r. .f.r.a. .d.e.t.t.e. .f.i.r.m.a.....7.=.F.r.a.v...l.g. .a.l.l.e. .o.b.j.e.k.t.e.r. .f.r.a. .d.e.t.t.e. .f.i.r.m.a.....8.=.F.i.r.m.a. .i.n.f.o.r.m.a.t.i.o.n.....9.=.S.k.a.n.n.e.r.....1.0.=.B.e.s.k.y.t.t.e.l.s.e.....1.1.=.O.p.d.a.t.e.r.....1.2.=.K.a.r.a.n.t...n.e.....1.3.=.L.o.g.s.....1.4.=.E.k.s.k.l.u.d.e.r.i.n.g.....1.5.=.I.n.d.s.t.i.l.l.i.n.g.e.r.....1.6.=.F.l.e.r.e. .V...r.k.t...j.e.r.....1.7.=.O.m.....1.8.=.S.k.a.n.n.e.r.e.n. .k.a.n. .f.i.n.d.e. .o.g. .f.j.e.r.n.e. .s.k.a.d.e.l.i.g. .s.o.f.t.w.a.r.e.,. .s.o.m. .m...t.t.e. .f.i.n.d.e.s. .p... .d.i.n. .c.o.m.p.u.t.e.r... .V...l.g. .v.e.n.l.i.g.s.t. .e.n. .s.k.a.n.n.i.n.g.s.t.y.p.e. .o.g. .k.l.i.k. .. s.k.a.n.. .. .L.u.k. .v.e.n.l.i.g.s.t. .a.l.l.e. .u.n...d.v.e.

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\Languages\is-S8JRA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	27680
Entropy (8bit):	3.418267624959816
Encrypted:	false
SSDEEP:	384:bOS+eRPUkw14KqCIXtR9xY+HJyG+32FQofgrvYGFodLdF:BUoZr9c42orGFodD
MD5:	E3D594A7687D758B29574C77E8E43839
SHA1:	061F7701987364A1CEDCEECD078AA8CBA814E3C1
SHA-256:	80BD8B7CA567EEE73C7D1F1335B906B8BDEE022C71855593147CD756D6A74CAD
SHA-512:	5DC81FD6478CAEE9849B96B9E5CE92B181ABFFF5BB890BE37B73A6079ED621AC5ACBAAEDE2CC995264EB881A327663077EFD389E76910E9EA0B858D6B44E3327
Malicious:	false
Preview:	..0.=.I.t.a.l.i.a.n.....1.=.C.h.i.c.a.P.C.-.S.h.i.e.l.d.....2.=.A.g.g.i.u.n.g.i. .a. .l.i.s.t.a. .i.g.n.o.r.a.....3.=.V.a.i. .a.l.l.a. .p.o.s.i.z.i.o.n.e.....4.=.S.e.l.e.z.i.o.n.a. .t.u.t.t.i. .g.l.i. .e.l.e.m.e.n.t.i.....5.=.D.e.s.e.l.e.z.i.o.n.a. .t.u.t.t.i. .g.l.i. .e.l.e.m.e.n.t.i.....6.=.S.e.l.e.z.i.o.n.a. .t.u.t.t.i. .g.l.i. .e.l.e.m.e.n.t.i. .c.o.n. .q.u.e.s.t.a. .p.r.o.v.e.n.i.e.n.z.a.....7.=.D.e.s.e.l.e.z.i.o.n.a. .t.u.t.t.i. .g.l.i. .e.l.e.m.e.n.t.i. .c.o.n. .q.u.e.s.t.a. .p.r.o.v.e.n.i.e.n.z.a.....8.=.I.n.f.o. .p.r.o.v.e.n.i.e.n.z.a.....9.=.S.c.a.n.s.i.o.n.e.....1.0.=.P.r.o.t.e.z.i.o.n.e.....1.1.=.A.g.g.i.o.r.n.a.m.e.n.t.o.....1.2.=.Q.u.a.r.a.n.t.e.n.a.....1.3.=.L.o.g.....1.4.=.L.i.s.t.a. .i.g.n.o.r.a.....1.5.=.I.m.p.o.s.t.a.z.i.o.n.i.....1.6.=.A.l.t.r.i. .s.t.r.u.m.e.n.t.i.....1.7.=.I.n.f.o.r.m.a.z.i.o.n.i.....1.8.=.L.a. .s.c.a.n.s.i.o.n.e. .r.i.l.e.v.a. .e. .r.i.m.u.o.v.e. .i.l. .s.o.f.t.w.a.r.e. .n.o.c.i.v.o. .e.v.e.n.t.u.a.l.m.e.n.t.e. .p.r.e.s.e.n.t.e. .n.e.l. .s.i.s.t.

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\Languages\is-UFVDK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	29372
Entropy (8bit):	3.5425237288380647
Encrypted:	false
SSDEEP:	768:XmgtzRbWpEatDSp+Groyo0y9P65q18CIqMGls9FqxnGe1:WgtztWmaQp+Groyo0y9z8qMG6qxnGe1
MD5:	B46C9C0D2BDA5299659845A723DB640A
SHA1:	3BF0B555980F14AE06288C465322E07AC8AD4279
SHA-256:	9BDFDA5651B2284A057CC5F43E927AF95B580E06552ACF6A9D2677550ADBD612
SHA-512:	297C5A05CD5A6BD5138A6B2B7AD059CD7E79545DFC468C8EE7F106E64E3E7D94075854B8F1E262F2B170AE88ADF48CBD7AD989B0C297161FB479BA659510A922
Malicious:	false
Preview:	..0.=.G.e.r.m.a.n.....1.=.C.h.i.c.a.P.C.-.S.h.i.e.l.d.....2.=.Z.u.r. .I.g.n.o.r.i.e.r.l.i.s.t.e. .h.i.n.z.u.f...g.e.n.....3.=.S.p.r.i.n.g.e. .z.u. .P.o.s.i.t.i.o.n.....4.=.A.l.l.e. .E.i.n.t.r...g.e. .a.u.s.w...h.l.e.n.....5.=.A.u.s.w.a.h.l. .a.l.l.e.r. .E.i.n.t.r...g.e. .r...c.k.g...n.g.i.g. .m.a.c.h.e.n.....6.=.A.l.l.e. .E.i.n.t.r...g.e. .d.i.e.s.e.s. .A.n.b.i.e.t.e.r.s. .a.u.s.w...h.l.e.n.....7.=.A.u.s.w.a.h.l. .a.l.l.e.r. .E.i.n.t.r...g.e. .d.i.e.s.e.s. .A.n.b.i.e.t.e.r.s. .r...c.k.g...n.g.i.g. .m.a.c.h.e.n.....8.=.A.n.b.i.e.t.e.r. .I.n.f.o.r.m.a.t.i.o.n.e.n.....9.=.S.u.c.h.l.a.u.f.....1.0.=.S.c.h.u.t.z.....1.1.=.A.k.t.u.a.l.i.s.i.e.r.u.n.g.....1.2.=.Q.u.a.r.a.n.t...n.e.....1.3.=.L.o.g.d.a.t.e.i.e.n.....1.4.=.I.g.n.o.r.i.e.r.l.i.s.t.e.....1.5.=.E.i.n.s.t.e.l.l.u.n.g.e.n.....1.6.=.W.e.i.t.e.r.e. .P.r.o.g.r.a.m.m.e.....1.7.=...b.e.r.....1.8.=.D.e.r. .S.u.c.h.l.a.u.f. .k.a.n.n. .b...s.a.r.t.i.g.e. .P.r.o.g.r.a.m.m.e. .a.u.f. .I.h.r.e.m. .S.y.s.t.e.m. .f.i.n.d.e.n. .u.n.d. .e.n.t.f.e.r.

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\Languages\italian.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	27680
Entropy (8bit):	3.418267624959816
Encrypted:	false
SSDEEP:	384:bOS+eRPUkw14KqCIXtR9xY+HJyG+32FQofgrvYGFodLdF:BUoZr9c42orGFodD
MD5:	E3D594A7687D758B29574C77E8E43839
SHA1:	061F7701987364A1CEDCEECD078AA8CBA814E3C1
SHA-256:	80BD8B7CA567EEE73C7D1F1335B906B8BDEE022C71855593147CD756D6A74CAD
SHA-512:	5DC81FD6478CAEE9849B96B9E5CE92B181ABFFF5BB890BE37B73A6079ED621AC5ACBAAEDE2CC995264EB881A327663077EFD389E76910E9EA0B858D6B44E3327
Malicious:	false
Preview:	..0.=.I.t.a.l.i.a.n.....1.=.C.h.i.c.a.P.C.-.S.h.i.e.l.d.....2.=.A.g.g.i.u.n.g.i. .a. .l.i.s.t.a. .i.g.n.o.r.a.....3.=.V.a.i. .a.l.l.a. .p.o.s.i.z.i.o.n.e.....4.=.S.e.l.e.z.i.o.n.a. .t.u.t.t.i. .g.l.i. .e.l.e.m.e.n.t.i.....5.=.D.e.s.e.l.e.z.i.o.n.a. .t.u.t.t.i. .g.l.i. .e.l.e.m.e.n.t.i.....6.=.S.e.l.e.z.i.o.n.a. .t.u.t.t.i. .g.l.i. .e.l.e.m.e.n.t.i. .c.o.n. .q.u.e.s.t.a. .p.r.o.v.e.n.i.e.n.z.a.....7.=.D.e.s.e.l.e.z.i.o.n.a. .t.u.t.t.i. .g.l.i. .e.l.e.m.e.n.t.i. .c.o.n. .q.u.e.s.t.a. .p.r.o.v.e.n.i.e.n.z.a.....8.=.I.n.f.o. .p.r.o.v.e.n.i.e.n.z.a.....9.=.S.c.a.n.s.i.o.n.e.....1.0.=.P.r.o.t.e.z.i.o.n.e.....1.1.=.A.g.g.i.o.r.n.a.m.e.n.t.o.....1.2.=.Q.u.a.r.a.n.t.e.n.a.....1.3.=.L.o.g.....1.4.=.L.i.s.t.a. .i.g.n.o.r.a.....1.5.=.I.m.p.o.s.t.a.z.i.o.n.i.....1.6.=.A.l.t.r.i. .s.t.r.u.m.e.n.t.i.....1.7.=.I.n.f.o.r.m.a.z.i.o.n.i.....1.8.=.L.a. .s.c.a.n.s.i.o.n.e. .r.i.l.e.v.a. .e. .r.i.m.u.o.v.e. .i.l. .s.o.f.t.w.a.r.e. .n.o.c.i.v.o. .e.v.e.n.t.u.a.l.m.e.n.t.e. .p.r.e.s.e.n.t.e. .n.e.l. .s.i.s.t.

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\Languages\norwegian.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	24602
Entropy (8bit):	3.511817410114942
Encrypted:	false
SSDEEP:	384:w+uox0zeMk1KtiSsVJDu8AOcDjB3OyHTeuy:nuox0zeMk1KtiSsVNujvB3lTi
MD5:	33865F12839E7FEF9FC7956C5827295D
SHA1:	DF1AD9FDF84B12B69F8F1D701FEDA8AFD05D7AF8
SHA-256:	3A3F5DCD1518C6EFD066A36FAF09AA55AAA0C98201E31F5DB2406CDCB63DD4A2
SHA-512:	889B6BB7C7C83F14FF933C0AC4851AF789A511C6EB2AB7F8A9D983E4721052C274ABA7D0EA9F67A22F202DE960971BF0FE228A1E65F06F093EE840DAC11CCD58
Malicious:	false
Preview:	..0.=.N.o.r.w.e.g.i.a.n.....1.=.C.h.i.c.a.P.C.-.S.h.i.e.l.d.....2.=.L.e.g.g. .t.i.l. .e.k.s.k.l.u.d.e.r.i.n.g.s.l.i.s.t.e.n.....3.=.G... .t.i.l. .d.e.s.t.i.n.a.s.j.o.n.....4.=.V.e.l.g. .a.l.l.e. .o.b.j.e.k.t.e.r.....5.=.F.j.e.r.n. .a.l.l.e. .o.b.j.e.k.t.e.r.....6.=.V.e.l.g. .a.l.l.e. .o.b.j.e.k.t.e.r. .f.r.a. .d.e.n.n.e. .p.r.o.d.u.s.e.n.t.e.n.....7.=.F.j.e.r.n. .a.l.l.e. .e.l.e.m.e.n.t.e.r. .f.r.a. .d.e.n.n.e. .p.r.o.d.u.s.e.n.t.e.n.....8.=.P.r.o.d.u.s.e.n.t.i.n.f.o.r.m.a.s.j.o.n.....9.=.S.k.a.n.n.e.r.....1.0.=.B.e.s.k.y.t.t.e.l.s.e.....1.1.=.O.p.p.d.a.t.e.r.....1.2.=.K.a.r.a.n.t.e.n.e.....1.3.=.L.o.g.g.e.r.....1.4.=.E.k.s.k.l.u.d.e.r.i.n.g.s.l.i.s.t.e.....1.5.=.I.n.n.s.t.i.l.l.i.n.g.e.r.....1.6.=.F.l.e.r.e. .v.e.r.k.t...y.....1.7.=.O.m.....1.8.=.S.k.a.n.n.e.r.e.n. .k.a.n. .f.i.n.n.e. .o.g. .f.j.e.r.n.e. .s.k.a.d.e.l.i.g. .p.r.o.g.r.a.m.v.a.r.e. .p... .s.y.s.t.e.m.e.t. .d.i.t.t... .V.e.l.g. .e.n. .s...k.e.m.e.t.o.d.e. .o.g. .k.l.i.k.k. .'.S.k.a.n.n.'... .V.e.n.n.l.i.g.s.t. .l.u.k.k. .

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\Languages\spanish.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	29546
Entropy (8bit):	3.4652359591306263
Encrypted:	false
SSDEEP:	384:0oomqWisQuRZGDQb+CmsGyO+1UxQR8rEB+0uF7IuPSu+FKWlBk7:0oRiTO96CmsDOpQ2wB1XuPLWly
MD5:	3A57303C8AAF78C7AB7ED16B3DC10989
SHA1:	8DCA05D0C55CFA6FBD78AFA8C177FD68ECAEC8D9
SHA-256:	9CEE0D51D2385AA56A41461EEF49354AA473B67FF017DDF4437781CE505F5815
SHA-512:	F4F61AA31F0B1A42AA38793E8F8C6279223A34E68ABD624388E8C1469CFD91144283E459C89DE85E4C6053428B88CE6A95A7855061F2C80E7BAA624BA49A4AFB
Malicious:	false
Preview:	..0.=.S.p.a.n.i.s.h.....1.=.C.h.i.c.a.P.C.-.S.h.i.e.l.d.....2.=.A...a.d.i.r. .a. .l.a. .l.i.s.t.a. .d.e. .i.g.n.o.r.a.d.o.s.....3.=.I.r. .a. .l.a. .u.b.i.c.a.c.i...n.....4.=.M.a.r.c.a.r. .t.o.d.o.s. .l.o.s. .e.l.e.m.e.n.t.o.s.....5.=.D.e.s.m.a.r.c.a.r. .t.o.d.o.s. .l.o.s. .e.l.e.m.e.n.t.o.s.....6.=.C.o.m.p.r.u.e.b.e. .t.o.d.o.s. .l.o.s. .e.l.e.m.e.n.t.o.s. .d.e. .e.s.t.e. .p.r.o.v.e.e.d.o.r.....7.=.D.e.s.m.a.r.c.a.r. .t.o.d.o.s. .l.o.s. .e.l.e.m.e.n.t.o.s. .d.e. .e.s.t.e. .p.r.o.v.e.e.d.o.r.....8.=.I.n.f.o.r.m.a.c.i...n. .s.o.b.r.e. .e.l. .p.r.o.v.e.e.d.o.r.....9.=.E.s.c...n.e.r.....1.0.=.P.r.o.t.e.c.c.i...n.....1.1.=.A.c.t.u.a.l.i.z.a.r.....1.2.=.C.u.a.r.e.n.t.e.n.a.....1.3.=.R.e.g.i.s.t.r.o.s.....1.4.=.L.i.s.t.a. .d.e. .i.g.n.o.r.a.d.o.s.....1.5.=.C.o.n.f.i.g.u.r.a.c.i...n.....1.6.=.M...s. .h.e.r.r.a.m.i.e.n.t.a.s.....1.7.=.A.c.e.r.c.a. .d.e.....1.8.=.E.l. .e.s.c.a.n.e.o. .p.u.e.d.e. .e.n.c.o.n.t.r.a.r. .y. .e.l.i.m.i.n.a.r. .e.l. .s.o.f.t.w.a.r.e. .m.a.l.i.c.i.o.s.o. .p.r.e.s.e.n.t.

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\Languages\swedish.lng (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	25478
Entropy (8bit):	3.5297575392191374
Encrypted:	false
SSDEEP:	384:X3DXSknVEWkeeXL0NqNP4X7DAh1rQrfYo+XbA089lZ7hEIY4u:XFVEXeeXL08NwX7DL+gjYl
MD5:	2EF431197148CAF95808046A43401EE0
SHA1:	6D23BC04CEECA33232B769492FC68C339794E945
SHA-256:	2B4A5A26AAC4F920C1D56DBB5764A7DF53EA99BAB0D70132FAF9955E5D6CA045
SHA-512:	B8182495CC18487942A5C0F5E32EF41315A3EEA467AF7A354D10ABBA1065A7A088966FC19CD816599EC529FA7D5C78CADBAE30436997DC230F8F61BA4E546370
Malicious:	false
Preview:	..0.=.S.w.e.d.i.s.h.....1.=.C.h.i.c.a.P.C.-.S.h.i.e.l.d.....2.=.L...g.g. .t.i.l.l. .i. .i.g.n.o.r.e.r.a.l.i.s.t.a.n.....3.=.H.o.p.p.a. .t.i.l.l. .p.l.a.t.s.....4.=.M.a.r.k.e.r.a. .a.l.l.a. .p.o.s.t.e.r.....5.=.A.v.m.a.r.k.e.r.a. .a.l.l.a. .p.o.s.t.e.r.....6.=.M.a.r.k.e.r.a. .a.l.l.a. .p.o.s.t.e.r. .f.r...n. .d.e.n. .h...r. .u.t.f...r.d.a.r.e.n.....7.=.A.v.m.a.r.k.e.r.a. .a.l.l.a. .p.o.s.t.e.r. .f.r...n. .d.e.n. .h...r. .u.t.f...r.d.a.r.e.n.....8.=.U.t.f...r.d.a.r.i.n.f.o.r.m.a.t.i.o.n.....9.=.S.k.a.n.n.e.r.....1.0.=.S.k.y.d.d.....1.1.=.U.p.p.d.a.t.e.r.a.....1.2.=.K.a.r.a.n.t...n.....1.3.=.L.o.g.g.a.r.....1.4.=.I.g.n.o.r.e.r.a.l.i.s.t.a.....1.5.=.I.n.s.t...l.l.n.i.n.g.a.r.....1.6.=.F.l.e.r. .v.e.r.k.t.y.g.....1.7.=.O.m.....1.8.=.S.k.a.n.n.e.r.n. .k.a.n. .h.i.t.t.a. .o.c.h. .t.a. .b.o.r.t. .s.k.a.d.l.i.g.a. .p.r.o.g.r.a.m. .s.o.m. .f.i.n.n.s. .i. .d.i.t.t. .s.y.s.t.e.m... .V...l.j. .e.n. .s.k.a.n.n.i.n.g.s.t.y.p. .o.c.h. .k.l.i.c.k.a. .p... .'.S.k.a.n.n.a.'... .A.v.s.l.u.t.a. .a.l.l.a. .

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\changes.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	178
Entropy (8bit):	3.451125105766001
Encrypted:	false
SSDEEP:	3:QmXlM1xlC3JpBIBdRUUOlWF5uERUNo1/fFaAJyMPlfRwkGlMZ1CNWly0uM2vl:QmGDE5wby3lDEtaAJyMPNO6L2iUM29
MD5:	BB3FDC8A63D5D0AEE231A1B48087BF32
SHA1:	AB71C287D0A31AB100CEBA863C22E4F782DBFBA6
SHA-256:	8F413AFD995C6F75F3B056F66EF222FCE061A7F5BDFC6D31CB6423FBFFC19F52
SHA-512:	17F55B945F5F6DA51BCCF23827CE515F02B8C23FFACEA1476D28AABE892E1DEBA7D44497DA55AA53CA57D079EEB9D2B2BEAA0407F76BB875B5DF36E95E4EAE89
Malicious:	false
Preview:	..C.h.i.c.a.P.C.-.S.h.i.e.l.d. .1...7.5...0...1.3.0.0.........N.e.w. .F.e.a.t.u.r.e.s.:....." . . .A.d.d.e.d. .a.b.i.l.i.t.y. .t.o. .s.c.a.n. .w.i.t.h.i.n. .a.r.c.h.i.v.e.s.....

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	973448
Entropy (8bit):	6.667557972562886
Encrypted:	false
SSDEEP:	12288:uSQWk9X1yhnMA53KWTCzxx+cQ/MkDKs3dyaOk8Ui2UHIEufwb4Isj:u9X1yhnMA5Ozxx+cyMApsaOk8RNad
MD5:	064E37783673E0094DAE704513F29393
SHA1:	96A6F17D7D3378F1368CDB6485E8355675B26527
SHA-256:	845EE2CD431F30CE068B4BF4564E2CF03E91A5D0421B310571A18D298663B018
SHA-512:	973241BC66BD387BF568BFBF657B172298B8D83E71C2F69ACB67A1B2596057D8763035A2725589995FCB45B6B1AF55949CCA1198F4309C3437A7C222E22BC791
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W.x.....................\...4...%.......Rich............................PE..L......Q.................`...........+.......p....@...............K.......... ...............................................V..(........;..........@...H...........@.......................................8... .......8............................text....P.......`.................. ..`.data...$n...p.......p..............@....rsrc....;.......@..................@..@l.[J............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	788040
Entropy (8bit):	6.397289855239814
Encrypted:	false
SSDEEP:	12288:8yJ84SmYtXI+OLNdc5lDAqnO129aisT2UHIEufwb4I3R:8ykhXI+iNdc5aqnO129aisdNam
MD5:	9CC7642A4825E87C9EACB29391279F43
SHA1:	B9F2FF58EB2107D27F1C7DEA9781F72E7E0AF475
SHA-256:	B258E4CA50F5A2DDB9602F3F95CC79F1E11DEA622790E95018189721C8F13C1B
SHA-512:	7267FC2B1495C416DAFF7E73D3831D4A88B6BD3D9B83E05D57F5DD4EB50BD1D5D4472E846740DB3E6241B234BC24CFA453A8645C120C7FD3AD2FD5E1CCE11CBB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........H..............[.......n.......o.V.....Y......V.......................j......._.......X.....Rich............PE..L...../Q.................X..................p....@..........................@......X.....@.................................L...........................H........I...s..................................@............p...............................text....V.......X.................. ..`.rdata..B"...p...$...\..............@..@.data....[.......6..................@....rsrc...............................@..@.reloc...m.......n...~..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcspt.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	40008
Entropy (8bit):	6.271830222041746
Encrypted:	false
SSDEEP:	384:xrMoO34N7GQd6hoAwMR9PzO6UUhQGgmN2gWNKUGfOvEDH8b0nuy4mPvfXNeeMWRx:uoIN1jO6hh6mgVmyEDcAn2mPNNuH
MD5:	D325C6C919A7E56731E8835B7A8350EF
SHA1:	26C662140BA567468D68C5D09482C4A18B0ECE08
SHA-256:	16E52579BF5FB3AECE000CCC2D8217C91B94545A0CBE4061EB3C167583CC44C5
SHA-512:	E609164CD2CC64E7FF0AD9FA3C5B630A5B96D5A28151D36EC41C340EAF7AB348CFB84710568EFCEB45D6A14EF64891A24F2334D8AB239E5A552277DB1846F0BA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.V.{.8M{.8M{.8M..Mq.8M..Ms.8M..MC.8Mr.Mx.8M{.9MG.8M{.8Mz.8M..Mz.8M..Mz.8M{..Mz.8M..Mz.8MRich{.8M................PE..L...0./Q.................D...H...............`....@......................................@.................................Lz..(.......................H............a...............................x..@............`...............................text....C.......D.................. ..`.rdata..>....`... ...H..............@..@.data................h..............@....rsrc................t..............@..@.reloc..^............z..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	418376
Entropy (8bit):	6.499528532289575
Encrypted:	false
SSDEEP:	12288:sVZ7DhFUcAWNPHzqswHZahEpQUfTxWXtc9uhZ:U/JfWswHZahEpQaxitc9uhZ
MD5:	C56F757EB2A6D9B850FAD5F075008A57
SHA1:	5495FB9CC42D55C4D3B79B47E8A583CB5DA8AABF
SHA-256:	CDD73A8974B724A62266ED73F7A5E89B52E882D61B2766A994F6D1CDDE027113
SHA-512:	5069F6F6E7F1B5C9E4427721D088321C6856C89CE27C0F197EAE664C9C87797F2A759327249A131582F189E124790F2940A3E148A144541C3091500714BA8D88
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.{.............z.......z...T...z.......z...............................z.../...z..............z.......Rich............PE..L... ./Q............................k.............@..................................d....@..........................................0...............H..H....@..P@...................................J..@...............(............................text............................... ..`.rdata..V...........................@..@.data....Z.......6..................@....rsrc........0......................@..@.reloc..@\...@...^..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsservice.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	701512
Entropy (8bit):	6.491661073895199
Encrypted:	false
SSDEEP:	12288:SsxYiXcF3Y5icaHzy2mkonRpouFnrUTf7Bw+gcoc2jOPdjm3VOTrAItqCR:SsxYiXcFaicaHe2ceuFnrQfFwpcYOPFJ
MD5:	C6BF2747298011BBCAAEAE96E5EC34D1
SHA1:	E5AE7CAE8B3FC18F459B54976F572CE657BA0E99
SHA-256:	DA0F8F13DF923976791FEFFB1C4EB683939CA188AE5D4799521664DF767C843E
SHA-512:	D574D977DD17C7FAA98B31F38A860D26C812392BAD7881F754D90BA364CD954E66D8D8679955A04E944FE8BEF9B32A5B101528D349DC4F737AD8E1D5B43A6F33
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V...7...7...7..An.7..Ao.~7..AY..7..A[..7...OV..7...7...6...7...7..Aj.7..A_..7...7R..7..AX..7..Rich.7..................PE..L...../Q..................................... ....@.......................................@.....................................,....@..................H....P...d..`$............................................... ...............................text............................... ..`.rdata..P.... ......................@..@.data... _.......:..................@....rsrc........@......................@..@.reloc..r....P......................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-0DUR6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	788040
Entropy (8bit):	6.397289855239814
Encrypted:	false
SSDEEP:	12288:8yJ84SmYtXI+OLNdc5lDAqnO129aisT2UHIEufwb4I3R:8ykhXI+iNdc5aqnO129aisdNam
MD5:	9CC7642A4825E87C9EACB29391279F43
SHA1:	B9F2FF58EB2107D27F1C7DEA9781F72E7E0AF475
SHA-256:	B258E4CA50F5A2DDB9602F3F95CC79F1E11DEA622790E95018189721C8F13C1B
SHA-512:	7267FC2B1495C416DAFF7E73D3831D4A88B6BD3D9B83E05D57F5DD4EB50BD1D5D4472E846740DB3E6241B234BC24CFA453A8645C120C7FD3AD2FD5E1CCE11CBB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........H..............[.......n.......o.V.....Y......V.......................j......._.......X.....Rich............PE..L...../Q.................X..................p....@..........................@......X.....@.................................L...........................H........I...s..................................@............p...............................text....V.......X.................. ..`.rdata..B"...p...$...\..............@..@.data....[.......6..................@....rsrc...............................@..@.reloc...m.......n...~..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-382MP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	178
Entropy (8bit):	3.451125105766001
Encrypted:	false
SSDEEP:	3:QmXlM1xlC3JpBIBdRUUOlWF5uERUNo1/fFaAJyMPlfRwkGlMZ1CNWly0uM2vl:QmGDE5wby3lDEtaAJyMPNO6L2iUM29
MD5:	BB3FDC8A63D5D0AEE231A1B48087BF32
SHA1:	AB71C287D0A31AB100CEBA863C22E4F782DBFBA6
SHA-256:	8F413AFD995C6F75F3B056F66EF222FCE061A7F5BDFC6D31CB6423FBFFC19F52
SHA-512:	17F55B945F5F6DA51BCCF23827CE515F02B8C23FFACEA1476D28AABE892E1DEBA7D44497DA55AA53CA57D079EEB9D2B2BEAA0407F76BB875B5DF36E95E4EAE89
Malicious:	false
Preview:	..C.h.i.c.a.P.C.-.S.h.i.e.l.d. .1...7.5...0...1.3.0.0.........N.e.w. .F.e.a.t.u.r.e.s.:....." . . .A.d.d.e.d. .a.b.i.l.i.t.y. .t.o. .s.c.a.n. .w.i.t.h.i.n. .a.r.c.h.i.v.e.s.....

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-6H2TN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	74312
Entropy (8bit):	6.291733112880314
Encrypted:	false
SSDEEP:	768:J2qlA0Jww5dns1jG2rbt7nIdRkRexdhb1I2kkVJCED7nuj1dxD6S/omj/7P72UPv:JFG0JbVwra/BLkqL8xDZww/7KUP
MD5:	D8B30620769A323FCB6253BCBA9542B6
SHA1:	9FA60EA7F2D5FA49C633AA5AC07F1DE287E45D8B
SHA-256:	B8FAC26DC5E2F773417D3F9E716AC531C37D09E59E50D659AD79F72E86E075A9
SHA-512:	119A323DC959B91B5F2F2CD9F05A98E6C222C0130950BFCA3062FBDD4B32CA6D2BF620FBA40B1C42C427ECB56F202C918CEBA36B7A8A5EA9B6DF5626286B4531
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........nF...................l......................l.......................................Rich............PE..L....J.P...........!.........\|.......S.......................................P............@.........................`...M...,...(.... ..................H....0..........................................@............................................text............................... ..`.rdata...8.......:..................@..@.data....&..........................@....rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-6PN99.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	914432
Entropy (8bit):	6.481500443477186
Encrypted:	false
SSDEEP:	24576:TW+wsDaQw6DDz3qRyPnmGfrnvVUKueY8RmneWtJ:TasY6DwOBfrnvV7UeWt
MD5:	04AD4B80880B32C94BE8D0886482C774
SHA1:	344FAF61C3EB76F4A2FB6452E83ED16C9CCE73E0
SHA-256:	A1E1D1F0FFF4FCCCFBDFA313F3BDFEA4D3DFE2C2D9174A615BBC39A0A6929338
SHA-512:	3E3AAF01B769471B18126E443A721C9E9A0269E9F5E48D0A10251BC1EE309855BD71EDE266CAA6828B007359B21BA562C2A5A3469078760F564FB7BD43ACABFB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........0;.tc;.tc;.tcT..c8.tc..zc3.tcT.~c?.tcT.pc9.tc..+c:.tc;.ucH.tc..)c<.tc...c.tcT..c..tcT..c9.tc..rc:.tc.pc:.tcRich;.tc........................PE..L....S.L...........!.....:...................P......................................................................p.......L...d........{......................8q...................................................P..(............................text....8.......:.................. ..`.rdata..bR...P...T...>..............@..@.data............^..................@....sxdata......p......................@....rsrc....{.......\|..................@..@.reloc...............n..............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-9INTD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2191944
Entropy (8bit):	6.642037719289481
Encrypted:	false
SSDEEP:	49152:M+uzsaJOaZZ5ULvyDB1bwJrbwnDOT00pnke2u6ln1GUcV4Zb4B:MVxJOwU7CrbwJwnDqke2ukn
MD5:	6E4470AEA570CA88F4FAEF57BA59F0C5
SHA1:	D02C99A75D596D1CFD928AD687842BF826B7703C
SHA-256:	6D56B3F5CF27FEFEDD8CC823F8583FC082EE20B42E041B927975DFAF2C9CBAEB
SHA-512:	F845C8DD32B9C6E2E221F4CA714AE979D400BC93D275954CD2B4DBD2E91B68D526EB34D782F4679D2F993655D44F340F2E2987D6157946F10832D049387CD224
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........DM.............................................+............................................Rich..*.................PE..L...../Q...........!.........................0................................!......."...@..........................I..m....7.......................X!.H.......xY...8..................................@............0..`............................text............................... ..`.rdata.......0....... ..............@..@.data...<S...P.......>..............@....rsrc................0..............@..@.reloc... ......."...6..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-CI4PM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	40008
Entropy (8bit):	6.271830222041746
Encrypted:	false
SSDEEP:	384:xrMoO34N7GQd6hoAwMR9PzO6UUhQGgmN2gWNKUGfOvEDH8b0nuy4mPvfXNeeMWRx:uoIN1jO6hh6mgVmyEDcAn2mPNNuH
MD5:	D325C6C919A7E56731E8835B7A8350EF
SHA1:	26C662140BA567468D68C5D09482C4A18B0ECE08
SHA-256:	16E52579BF5FB3AECE000CCC2D8217C91B94545A0CBE4061EB3C167583CC44C5
SHA-512:	E609164CD2CC64E7FF0AD9FA3C5B630A5B96D5A28151D36EC41C340EAF7AB348CFB84710568EFCEB45D6A14EF64891A24F2334D8AB239E5A552277DB1846F0BA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.V.{.8M{.8M{.8M..Mq.8M..Ms.8M..MC.8Mr.Mx.8M{.9MG.8M{.8Mz.8M..Mz.8M..Mz.8M{..Mz.8M..Mz.8MRich{.8M................PE..L...0./Q.................D...H...............`....@......................................@.................................Lz..(.......................H............a...............................x..@............`...............................text....C.......D.................. ..`.rdata..>....`... ...H..............@..@.data................h..............@....rsrc................t..............@..@.reloc..^............z..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-CU77C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	701512
Entropy (8bit):	6.491661073895199
Encrypted:	false
SSDEEP:	12288:SsxYiXcF3Y5icaHzy2mkonRpouFnrUTf7Bw+gcoc2jOPdjm3VOTrAItqCR:SsxYiXcFaicaHe2ceuFnrQfFwpcYOPFJ
MD5:	C6BF2747298011BBCAAEAE96E5EC34D1
SHA1:	E5AE7CAE8B3FC18F459B54976F572CE657BA0E99
SHA-256:	DA0F8F13DF923976791FEFFB1C4EB683939CA188AE5D4799521664DF767C843E
SHA-512:	D574D977DD17C7FAA98B31F38A860D26C812392BAD7881F754D90BA364CD954E66D8D8679955A04E944FE8BEF9B32A5B101528D349DC4F737AD8E1D5B43A6F33
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V...7...7...7..An.7..Ao.~7..AY..7..A[..7...OV..7...7...6...7...7..Aj.7..A_..7...7R..7..AX..7..Rich.7..................PE..L...../Q..................................... ....@.......................................@.....................................,....@..................H....P...d..`$............................................... ...............................text............................... ..`.rdata..P.... ......................@..@.data... _.......:..................@....rsrc........@......................@..@.reloc..r....P......................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-DB4G5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	712264
Entropy (8bit):	6.524059965918702
Encrypted:	false
SSDEEP:	12288:qTPcYn5c/rPx37/zHBA6a5UeypkxmFERhD7rNdR81QNERxyF:iPcYn5c/rPx37/zHBA6pDpk8FEK1uERU
MD5:	C2BE7988C8762E314534B2908C4D6E49
SHA1:	CBC373D596D389F5ABEA8177D1F86EE767284466
SHA-256:	4A53C567369F2F30571019E17B13F650680280962B9C4105B2B3CF306FE47C36
SHA-512:	EEFA58E16BBFBEFD1AFBF63409CDF5907FBE87BDD5BCFFEB9FEC47790E0428E3290ED22108EAE4BCD6711C9CD92D947E87CFBF68EBCF37FE4A68405142776216
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................z........................@..............................................@...............................%......................H...........................................................................................CODE.....y.......z.................. ..`DATA.................~..............@...BSS......................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc....... ......................@..P.rsrc...............................@..P.....................P..............@..P........................................................................................................................................

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-J2CDD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	46416
Entropy (8bit):	4.872445450776674
Encrypted:	false
SSDEEP:	768:JjBzwlSCIuAXEDsyPFHhOlLA57EkcAZnhtyFmNj/LWFbCF:JLuAUocFHMlL07fRZPHDaNCF
MD5:	91EA28804EC3A71126841554199E28BC
SHA1:	00D568F31E6D4E2110F54C3FEA93219092181891
SHA-256:	E5F85613264ED15FCA01E332068CB4515D56FB7F4F7267B4A94DEB06B7944063
SHA-512:	F8209A77DD64B9562057ECC2DA1DE46FE763E1B0E6459FF4CFB5EFAE05300B8027BC71C3F44033D8BE0B2115AAF3ACDAD6A8B83796F26044F88BC76E5C466E82
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_.._>.._>.._>..."..^>......Z>......^>......^>..Rich_>..........PE..L.....3>...........!.....P...@...............`.......................................................................W.......S..(....p..................P...................................................X... ....................................text....H.......P.................. ..`.data........`.......`..............@....rsrc........p... ...p..............@..@.reloc..z...........................@..B'.};............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-K9CAE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	95304
Entropy (8bit):	5.981207201467423
Encrypted:	false
SSDEEP:	1536:K74We9oCdZ6GNDNe+D+Tfb0WdeSe+w4IW1DmeuvF5uV7s88Wf:K7E9h/J7+Tfb0y2+Z5mrvF5uNsjY
MD5:	76549804F14999EDEB55598A84E2804B
SHA1:	B6D8FAE4C7E4BC1376D7B0381EBCE9043E4A4AC2
SHA-256:	5EAF813C597F9FEAD461771687BC452A30F0CBB66CC0BB843060CAA45C7AD987
SHA-512:	6AF33E80F27D035F0B4F6CBFB4E862258AA3A75D522E62F7DA1196F368FA040D4B2D6F238D1249F4BB99B4007A0BF7EAC4013B5B910B610784CD13788AE77A73
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r1.6P..6P..6P..Y&..nP..Y&..<P..@...4P..?(..'P..6P..\P..Y&/..P..Y&..7P..Y&..7P..Y&..7P..Rich6P..........................PE..d...6./Q.........." ................ E..............................................L.....@.........................................p3.......(..................0....Z..H...............................................................@............................text............................... ..`.rdata...T.......V..................@..@.data....;...@......................@....pdata..0............4..............@..@.rsrc................B..............@..@.reloc...............T..............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-KP3IJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	973448
Entropy (8bit):	6.667557972562886
Encrypted:	false
SSDEEP:	12288:uSQWk9X1yhnMA53KWTCzxx+cQ/MkDKs3dyaOk8Ui2UHIEufwb4Isj:u9X1yhnMA5Ozxx+cyMApsaOk8RNad
MD5:	064E37783673E0094DAE704513F29393
SHA1:	96A6F17D7D3378F1368CDB6485E8355675B26527
SHA-256:	845EE2CD431F30CE068B4BF4564E2CF03E91A5D0421B310571A18D298663B018
SHA-512:	973241BC66BD387BF568BFBF657B172298B8D83E71C2F69ACB67A1B2596057D8763035A2725589995FCB45B6B1AF55949CCA1198F4309C3437A7C222E22BC791
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W.x.....................\...4...%.......Rich............................PE..L......Q.................`...........+.......p....@...............K.......... ...............................................V..(........;..........@...H...........@.......................................8... .......8............................text....P.......`.................. ..`.data...$n...p.......p..............@....rsrc....;.......@..................@..@l.[J............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-L12IJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1127496
Entropy (8bit):	6.488890971256239
Encrypted:	false
SSDEEP:	24576:m7+uEDVpEDH52BvDSG6XNAkV40/Q1tNqOgTDNhTmlnqnzu:OrTLo0/QTNqhTphqlnqnzu
MD5:	F8340FF46DD9F7CF070F6C707EBA11C6
SHA1:	02BC5EEC85A0FD2EC84775B5B88CB3D0610DC283
SHA-256:	81712DD284B1E834E7BB16613DE348E453A6FD8244CFAA14AF6A8907F8C83ADE
SHA-512:	FDD0C3E97D780ADE35A9363A4FEAD0AE8792E2ECD4C586CCE8BC83A79F582986425F7BD0182C755B7CC7F69E5DCA0371067DEBE7A8A69B9659856EF9AEE7AB02
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........w$s..J ..J ..J .`. ..J .`. >.J .n. ..J .`. ..J .n. ..J ..K w.J ..J ..J .`. ..J .`. ..J .`. ..J ... ..J .`. ..J Rich..J ........................PE..L.....]Q...........!.....6..................P...............................p.......a....@.........................................0...x..............H...........S...............................................P..(............................text....4.......6.................. ..`.rdata..rf...P...h...:..............@..@.data....b.......>..................@....rsrc....x...0...z..................@..@.reloc..l............Z..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-S0PAI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	418376
Entropy (8bit):	6.499528532289575
Encrypted:	false
SSDEEP:	12288:sVZ7DhFUcAWNPHzqswHZahEpQUfTxWXtc9uhZ:U/JfWswHZahEpQaxitc9uhZ
MD5:	C56F757EB2A6D9B850FAD5F075008A57
SHA1:	5495FB9CC42D55C4D3B79B47E8A583CB5DA8AABF
SHA-256:	CDD73A8974B724A62266ED73F7A5E89B52E882D61B2766A994F6D1CDDE027113
SHA-512:	5069F6F6E7F1B5C9E4427721D088321C6856C89CE27C0F197EAE664C9C87797F2A759327249A131582F189E124790F2940A3E148A144541C3091500714BA8D88
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.{.............z.......z...T...z.......z...............................z.../...z..............z.......Rich............PE..L... ./Q............................k.............@..................................d....@..........................................0...............H..H....@..P@...................................J..@...............(............................text............................... ..`.rdata..V...........................@..@.data....Z.......6..................@....rsrc........0......................@..@.reloc..@\...@...^..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-SJQ69.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	496976
Entropy (8bit):	6.339735772308435
Encrypted:	false
SSDEEP:	6144:U82koJD/n28/8V+H0JWq8GRvWzaWKfCBQ/3o78qUc662F83Wcehs4qwdI:WkoJrn28UV+H0JWq8iEdq/FqIFQ4q2I
MD5:	BAA4DE42156350754976DD563D02CDE4
SHA1:	BA617EFEBE79C1A60DAF941F2766FA92FE1635DD
SHA-256:	2CA8945C81BE66F6B023AF6DFA37D336FFDFB9A9A3E785F26F8891198D362295
SHA-512:	B7A02698A795DBBC98A22C899CCC3E69C1070D9A2B678E9D5E682D21A31A4B4F9355A00061879310847C40D21C14253C4CE8639489C6509CE17E1E8CDB4D52A5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;Qy..0...0...0...,..~0..0...u0......~0......~0..Rich.0..........................PE..L....x)@...........!................PG.............(................................A............................... .......T...(....0..................P........o..........................................h... ....................................text............................... ..`.data...............................@....rsrc........0....... ..............@..@.reloc...{..........................@..B'.};............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-T6R1L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252
Category:	dropped
Size (bytes):	16810
Entropy (8bit):	5.09051992169333
Encrypted:	false
SSDEEP:	384:e1SZQqhQ9mrDH5YAZb8dhu9Qh4MbAItA8AlghsIGjY2:6SZ9+9kFb89WAAItA8sP
MD5:	A6D669BD282B70E7BDD1E6D68CBF1CA1
SHA1:	7DEA2AC97B5B53795D46B6BE0FE3E9FDE09344A6
SHA-256:	A2A345810202792C81F49C0E41305237141922F67E1DF1F7441266749CB83BD7
SHA-512:	1370B7EE531430991EB39067859B953E68A4AB986364DB29097CC4E2158236DEB3EB4877C11D360D9A9058A83580A36CBD79FACE36AF997CE537AEDAD39076D0
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\deff0{\fonttbl{\f0\fnil\fcharset0 Times New Roman;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\lang1033\f0\fs20 CHICALOGIC END USER LICENSE AGREEMENT\par..\par..\par..IMPORTANT: PLEASE READ ALL OF THE TERMS AND CONDITIONS OF THIS LICENSE AGREEMENT BEFORE USING CHICALOGIC SOFTWARE. CHICALOGIC, INC. AND/OR ITS SUBSIDIARIES ("CHICALOGIC") IS PLEASED TO LICENSE THE ChicaLogic, Inc. SOFTWARE TO YOU AS THE INDIVIDUAL, COMPANY, OR OTHER LEGAL ENTITY THAT WILL BE UTILIZING THE SOFTWARE (REFERRED TO BELOW AS "YOU" OR "YOUR") ON THE CONDITION THAT YOU ACCEPT ALL OF THE TERMS OF THIS AGREEMENT. THIS IS A LEGAL AND ENFORCEABLE CONTRACT BETWEEN YOU AND CHICALOGIC. BY CLICKING ON THE "AGREE" OR "YES" BUTTON OR OTHER INDICATOR OF YOUR ELECTRONIC ACCEPTANCE OF THIS AGREEMENT, INSTALLING THE DOWNLOADED SOFTWARE, ACCESSING THE SOFTWARE ONLINE, OR, IF APPLICABLE, BREAKING THE SEAL OF THE TANGIBLE MEDIA CONTAINING THE SOFTWARE

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\is-UQ1R3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	527432
Entropy (8bit):	6.554357599549209
Encrypted:	false
SSDEEP:	6144:0d3w5EjjbHtGYp1H8sPF0ZMAHzrGOF2OAN0TxlgCh/4gezc3NTkv4xl7nRlQAz31:2w5EjPHr98lZFTFH9TrZ4gcc9TKE
MD5:	6043B2F884CDE44CEEA91A34EB2FAE81
SHA1:	5F0A4D9D2C61B0045B5C94CE366949CA26E49A11
SHA-256:	5E08FCA6421A1E89538C52E8ACB1D9A83FAEC7138EED6451BB5D5180A4F39938
SHA-512:	322591B9E87900BCF9B24020FCBC601CB250EB5A8C82838D4DCE10810D803A7EB692CF1462E79E7A3193A01FD7FCE8C32AC37EC42C2A51E93D873CB19DB61B95
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1{.OP..OP..OP.. &..XP.. &...P.. &...P..F(..XP..OP...P..OP..NP.. &...P.. &..NP.. &..NP..OP..NP.. &..NP..RichOP..........................PE..L...../Q...........!.........................................................@......;.....@.........................`M..i....>..........................H........O..0...................................@...............\|............................text............................... ..`.rdata...K.......L..................@..@.data....Z...`...6...J..............@....rsrc...............................@..@.reloc...k.......l..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\license.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	Rich Text Format data, version 1, ANSI, code page 1252
Category:	dropped
Size (bytes):	16810
Entropy (8bit):	5.09051992169333
Encrypted:	false
SSDEEP:	384:e1SZQqhQ9mrDH5YAZb8dhu9Qh4MbAItA8AlghsIGjY2:6SZ9+9kFb89WAAItA8sP
MD5:	A6D669BD282B70E7BDD1E6D68CBF1CA1
SHA1:	7DEA2AC97B5B53795D46B6BE0FE3E9FDE09344A6
SHA-256:	A2A345810202792C81F49C0E41305237141922F67E1DF1F7441266749CB83BD7
SHA-512:	1370B7EE531430991EB39067859B953E68A4AB986364DB29097CC4E2158236DEB3EB4877C11D360D9A9058A83580A36CBD79FACE36AF997CE537AEDAD39076D0
Malicious:	false
Preview:	{\rtf1\ansi\ansicpg1252\deff0{\fonttbl{\f0\fnil\fcharset0 Times New Roman;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\lang1033\f0\fs20 CHICALOGIC END USER LICENSE AGREEMENT\par..\par..\par..IMPORTANT: PLEASE READ ALL OF THE TERMS AND CONDITIONS OF THIS LICENSE AGREEMENT BEFORE USING CHICALOGIC SOFTWARE. CHICALOGIC, INC. AND/OR ITS SUBSIDIARIES ("CHICALOGIC") IS PLEASED TO LICENSE THE ChicaLogic, Inc. SOFTWARE TO YOU AS THE INDIVIDUAL, COMPANY, OR OTHER LEGAL ENTITY THAT WILL BE UTILIZING THE SOFTWARE (REFERRED TO BELOW AS "YOU" OR "YOUR") ON THE CONDITION THAT YOU ACCEPT ALL OF THE TERMS OF THIS AGREEMENT. THIS IS A LEGAL AND ENFORCEABLE CONTRACT BETWEEN YOU AND CHICALOGIC. BY CLICKING ON THE "AGREE" OR "YES" BUTTON OR OTHER INDICATOR OF YOUR ELECTRONIC ACCEPTANCE OF THIS AGREEMENT, INSTALLING THE DOWNLOADED SOFTWARE, ACCESSING THE SOFTWARE ONLINE, OR, IF APPLICABLE, BREAKING THE SEAL OF THE TANGIBLE MEDIA CONTAINING THE SOFTWARE

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\mbam.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	527432
Entropy (8bit):	6.554357599549209
Encrypted:	false
SSDEEP:	6144:0d3w5EjjbHtGYp1H8sPF0ZMAHzrGOF2OAN0TxlgCh/4gezc3NTkv4xl7nRlQAz31:2w5EjPHr98lZFTFH9TrZ4gcc9TKE
MD5:	6043B2F884CDE44CEEA91A34EB2FAE81
SHA1:	5F0A4D9D2C61B0045B5C94CE366949CA26E49A11
SHA-256:	5E08FCA6421A1E89538C52E8ACB1D9A83FAEC7138EED6451BB5D5180A4F39938
SHA-512:	322591B9E87900BCF9B24020FCBC601CB250EB5A8C82838D4DCE10810D803A7EB692CF1462E79E7A3193A01FD7FCE8C32AC37EC42C2A51E93D873CB19DB61B95
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1{.OP..OP..OP.. &..XP.. &...P.. &...P..F(..XP..OP...P..OP..NP.. &...P.. &..NP.. &..NP..OP..NP.. &..NP..RichOP..........................PE..L...../Q...........!.........................................................@......;.....@.........................`M..i....>..........................H........O..0...................................@...............\|............................text............................... ..`.rdata...K.......L..................@..@.data....Z...`...6...J..............@....rsrc...............................@..@.reloc...k.......l..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\mbamcore.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1127496
Entropy (8bit):	6.488890971256239
Encrypted:	false
SSDEEP:	24576:m7+uEDVpEDH52BvDSG6XNAkV40/Q1tNqOgTDNhTmlnqnzu:OrTLo0/QTNqhTphqlnqnzu
MD5:	F8340FF46DD9F7CF070F6C707EBA11C6
SHA1:	02BC5EEC85A0FD2EC84775B5B88CB3D0610DC283
SHA-256:	81712DD284B1E834E7BB16613DE348E453A6FD8244CFAA14AF6A8907F8C83ADE
SHA-512:	FDD0C3E97D780ADE35A9363A4FEAD0AE8792E2ECD4C586CCE8BC83A79F582986425F7BD0182C755B7CC7F69E5DCA0371067DEBE7A8A69B9659856EF9AEE7AB02
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........w$s..J ..J ..J .`. ..J .`. >.J .n. ..J .`. ..J .n. ..J ..K w.J ..J ..J .`. ..J .`. ..J .`. ..J ... ..J .`. ..J Rich..J ........................PE..L.....]Q...........!.....6..................P...............................p.......a....@.........................................0...x..............H...........S...............................................P..(............................text....4.......6.................. ..`.rdata..rf...P...h...:..............@..@.data....b.......>..................@....rsrc....x...0...z..................@..@.reloc..l............Z..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\mbamext.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	95304
Entropy (8bit):	5.981207201467423
Encrypted:	false
SSDEEP:	1536:K74We9oCdZ6GNDNe+D+Tfb0WdeSe+w4IW1DmeuvF5uV7s88Wf:K7E9h/J7+Tfb0y2+Z5mrvF5uNsjY
MD5:	76549804F14999EDEB55598A84E2804B
SHA1:	B6D8FAE4C7E4BC1376D7B0381EBCE9043E4A4AC2
SHA-256:	5EAF813C597F9FEAD461771687BC452A30F0CBB66CC0BB843060CAA45C7AD987
SHA-512:	6AF33E80F27D035F0B4F6CBFB4E862258AA3A75D522E62F7DA1196F368FA040D4B2D6F238D1249F4BB99B4007A0BF7EAC4013B5B910B610784CD13788AE77A73
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r1.6P..6P..6P..Y&..nP..Y&..<P..@...4P..?(..'P..6P..\P..Y&/..P..Y&..7P..Y&..7P..Y&..7P..Rich6P..........................PE..d...6./Q.........." ................ E..............................................L.....@.........................................p3.......(..................0....Z..H...............................................................@............................text............................... ..`.rdata...T.......V..................@..@.data....;...@......................@....pdata..0............4..............@..@.rsrc................B..............@..@.reloc...............T..............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\mbamnet.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2191944
Entropy (8bit):	6.642037719289481
Encrypted:	false
SSDEEP:	49152:M+uzsaJOaZZ5ULvyDB1bwJrbwnDOT00pnke2u6ln1GUcV4Zb4B:MVxJOwU7CrbwJwnDqke2ukn
MD5:	6E4470AEA570CA88F4FAEF57BA59F0C5
SHA1:	D02C99A75D596D1CFD928AD687842BF826B7703C
SHA-256:	6D56B3F5CF27FEFEDD8CC823F8583FC082EE20B42E041B927975DFAF2C9CBAEB
SHA-512:	F845C8DD32B9C6E2E221F4CA714AE979D400BC93D275954CD2B4DBD2E91B68D526EB34D782F4679D2F993655D44F340F2E2987D6157946F10832D049387CD224
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........DM.............................................+............................................Rich..*.................PE..L...../Q...........!.........................0................................!......."...@..........................I..m....7.......................X!.H.......xY...8..................................@............0..`............................text............................... ..`.rdata.......0....... ..............@..@.data...<S...P.......>..............@....rsrc................0..............@..@.reloc... ......."...6..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\mbamtoast.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	74312
Entropy (8bit):	6.291733112880314
Encrypted:	false
SSDEEP:	768:J2qlA0Jww5dns1jG2rbt7nIdRkRexdhb1I2kkVJCED7nuj1dxD6S/omj/7P72UPv:JFG0JbVwra/BLkqL8xDZww/7KUP
MD5:	D8B30620769A323FCB6253BCBA9542B6
SHA1:	9FA60EA7F2D5FA49C633AA5AC07F1DE287E45D8B
SHA-256:	B8FAC26DC5E2F773417D3F9E716AC531C37D09E59E50D659AD79F72E86E075A9
SHA-512:	119A323DC959B91B5F2F2CD9F05A98E6C222C0130950BFCA3062FBDD4B32CA6D2BF620FBA40B1C42C427ECB56F202C918CEBA36B7A8A5EA9B6DF5626286B4531
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........nF...................l......................l.......................................Rich............PE..L....J.P...........!.........\|.......S.......................................P............@.........................`...M...,...(.... ..................H....0..........................................@............................................text............................... ..`.rdata...8.......:..................@..@.data....&..........................@....rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\ssubtmr6.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	46416
Entropy (8bit):	4.872445450776674
Encrypted:	false
SSDEEP:	768:JjBzwlSCIuAXEDsyPFHhOlLA57EkcAZnhtyFmNj/LWFbCF:JLuAUocFHMlL07fRZPHDaNCF
MD5:	91EA28804EC3A71126841554199E28BC
SHA1:	00D568F31E6D4E2110F54C3FEA93219092181891
SHA-256:	E5F85613264ED15FCA01E332068CB4515D56FB7F4F7267B4A94DEB06B7944063
SHA-512:	F8209A77DD64B9562057ECC2DA1DE46FE763E1B0E6459FF4CFB5EFAE05300B8027BC71C3F44033D8BE0B2115AAF3ACDAD6A8B83796F26044F88BC76E5C466E82
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_.._>.._>.._>..."..^>......Z>......^>......^>..Rich_>..........PE..L.....3>...........!.....P...@...............`.......................................................................W.......S..(....p..................P...................................................X... ....................................text....H.......P.................. ..`.data........`.......`..............@....rsrc........p... ...p..............@..@.reloc..z...........................@..B'.};............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	InnoSetup Log ChicaPC-Shield, version 0x30, 10690 bytes, 467601\user, "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield"
Category:	dropped
Size (bytes):	10690
Entropy (8bit):	5.168951823595991
Encrypted:	false
SSDEEP:	192:GClBlhfkm2ANOmG7kk0IN8ICSsAAWejTstMbGBKiCpp8CYlZE/34+JqMimOl2qUE:blh7NOmAkkLAWe7hx8l/L
MD5:	E3F42B3D4A8145CB01BD3A5E739DAEE8
SHA1:	755F53CC60C7684FA9A9171D26CFB0268CD53C32
SHA-256:	93BBB2755DD8C8E212017555E46EF978E6D296F77CDB6497DD83D25A9829C886
SHA-512:	8941FC3A0DE7C705C48E0C0188F88F9BE268D2E54AF3B88D354FDDA658195F5ED9224F20C6A9C3E186C782EF98647FD861C5BA9AF9247BF6CA247E84DDF5B091
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................ChicaPC-Shield..................................................................................................................ChicaPC-Shield..................................................................................................................0...A....)..%................................................................................................................{.]........vgu.......Q....467601.user0C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield...........9.(.,.. ............IFPS........&....................................................................................................BOOLEAN..................................................................$...........!MAIN....-1..1...dll:setup:files:mbam.dll.ProtectionUninstall.......5...dll:uninstall:{app}\mbam.dll.ProtectionUninstall......./...dll:setup:files:mbam.dll.ProtectionInstall.......0...dll:setup:files:mbam.dll.SchedulerUninstall.......4...

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	712264
Entropy (8bit):	6.524059965918702
Encrypted:	false
SSDEEP:	12288:qTPcYn5c/rPx37/zHBA6a5UeypkxmFERhD7rNdR81QNERxyF:iPcYn5c/rPx37/zHBA6pDpk8FEK1uERU
MD5:	C2BE7988C8762E314534B2908C4D6E49
SHA1:	CBC373D596D389F5ABEA8177D1F86EE767284466
SHA-256:	4A53C567369F2F30571019E17B13F650680280962B9C4105B2B3CF306FE47C36
SHA-512:	EEFA58E16BBFBEFD1AFBF63409CDF5907FBE87BDD5BCFFEB9FEC47790E0428E3290ED22108EAE4BCD6711C9CD92D947E87CFBF68EBCF37FE4A68405142776216
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................z........................@..............................................@...............................%......................H...........................................................................................CODE.....y.......z.................. ..`DATA.................~..............@...BSS......................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc....... ......................@..P.rsrc...............................@..P.....................P..............@..P........................................................................................................................................

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\unins000.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	InnoSetup messages, version 5.5.0, 220 messages (ASCII), &About Setup...
Category:	dropped
Size (bytes):	11277
Entropy (8bit):	4.696222526137289
Encrypted:	false
SSDEEP:	192:+yuyHdp77ksdrKUURqCZYcI71gWb/I+XIWCMVtos:1Fz7J5KaCZYcI71Tb/rIWCMVtF
MD5:	1A5EFCDFF3AA344588E9624F73386193
SHA1:	5FCE901ACEC50BAACF647404ABCDBCF328C60DC7
SHA-256:	E2E13726C44B23FAAE8D1CC7BD53D83DDCB93B537CEA405A09261BFEE8B199B6
SHA-512:	6A04C40BC72D2B9853848337A45F87558CD8595176A1F8508FAE130E847CCA84AC608818249598C8937F60F8FD1E257D535BA20B23F030E55BB8825895E734C6
Malicious:	false
Preview:	Inno Setup Messages (5.5.0)..........................................+......]..E&About Setup....%1 version %2..%3....%1 home page:..%4..About Setup.You must be logged in as an administrator when installing this program..The following applications are using files that need to be updated by Setup. It is recommended that you allow Setup to automatically close these applications..The following applications are using files that need to be updated by Setup. It is recommended that you allow Setup to automatically close these applications. After the installation has completed, Setup will attempt to restart the applications..Folder names cannot include any of the following characters:....%1.The folder name cannot include any of the following characters:....%1..Select a folder in the list below, then click OK..Browse For Folder.< &Back.&Browse....Cancel.&Finish.&Install.&Make New Folder.&Next >.&No.N&o to All.OK.B&rowse....&Yes.Yes to &All.Setup cannot continue. Please click Cancel to exit..Setu

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\vbalsgrid6.ocx (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	496976
Entropy (8bit):	6.339735772308435
Encrypted:	false
SSDEEP:	6144:U82koJD/n28/8V+H0JWq8GRvWzaWKfCBQ/3o78qUc662F83Wcehs4qwdI:WkoJrn28UV+H0JWq8iEdq/FqIFQ4q2I
MD5:	BAA4DE42156350754976DD563D02CDE4
SHA1:	BA617EFEBE79C1A60DAF941F2766FA92FE1635DD
SHA-256:	2CA8945C81BE66F6B023AF6DFA37D336FFDFB9A9A3E785F26F8891198D362295
SHA-512:	B7A02698A795DBBC98A22C899CCC3E69C1070D9A2B678E9D5E682D21A31A4B4F9355A00061879310847C40D21C14253C4CE8639489C6509CE17E1E8CDB4D52A5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;Qy..0...0...0...,..~0..0...u0......~0......~0..Rich.0..........................PE..L....x)@...........!................PG.............(................................A............................... .......T...(....0..................P........o..........................................h... ....................................text............................... ..`.data...............................@....rsrc........0....... ..............@..@.reloc...{..........................@..B'.};............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ChicaLogic\ChicaPC-Shield\Configuration\build.conf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	data
Category:	dropped
Size (bytes):	142
Entropy (8bit):	6.735980306109167
Encrypted:	false
SSDEEP:	3:2fB1WDYZs4S8yQyun38hu3dramTusdwCd4UkGl:61WB4GQy2D3dOmTuSeUkA
MD5:	2F275DA13F68A4E6C2D7154FBDDC8451
SHA1:	07FD1A4D93AE8788C1934365488B6136D02B8861
SHA-256:	97F76D2EEEDBA90A0B2D00723417CEA78C50DF79459DE4C4FC35574B8821A6F3
SHA-512:	56846D85472A260E2FE16225804D0758AF3B2895FCD2AFF385161A29DBB31B131CC7793465612E7BA27EBCCEA590DE951BE1038E53FAF0E13455BAFFCB6BEF1D
Malicious:	false
Preview:	M..y+z.<b0.....+.. ...}:...y.....'...m...A..A5 ....,.Fa.*t.,F.........._.4...J.?.8`..%q...\|:2...?<........._2.....Y..s..v..5.........

C:\ProgramData\ChicaLogic\ChicaPC-Shield\Configuration\config.conf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	data
Category:	dropped
Size (bytes):	3258
Entropy (8bit):	7.95290126060931
Encrypted:	false
SSDEEP:	96:31WdW/B7wmxHoHmCOQfBsBLw4DOU8uudSsVdYWh2:31Wd2MmBoHm9QfBsBLw4VWYG2
MD5:	E6676357E76BC8771F9A0BFA6839CFBC
SHA1:	55B779741717A67EDBA2F9B697937CACE43EA105
SHA-256:	8768DDAE90F83A45DC87AF8B251F3B711E41D8361361C0E5F62EC3AE72B0C8B1
SHA-512:	6DA7614C81B61D981ACB3FB253A861ACD6C2DB17AFB21ABD78DA40238E57591623636124206F26B846FF785C206257857465655AEE1ED81EEF2C1A955F973589
Malicious:	false
Preview:	.3.h<i.o.~.....od...-xhm.;-.S....f.......R.(qnQ.../.Sa.~w.g@............`......b.B$C.!v...E~g...o}"........w.....b...y..9..{h....^Gb.L.\..xM.........p=%q<..j.d.v.....=.o..t=..I.V...p.!V.,r@.mP......K...~<Gy....V3W...`+.G...K..RF..Fn.....sBD,+.i.g.i......U.r.:.\|......:~..3...SA.HE.&$...MaLt... .....JP .1-:...d...zM......N0$P9.....M..u.Gq..~w3.<.5....R.B.E../#V...t..P.Q.qE...f...{....X.....s'F.o?g.....P.....^..vb.!..x./.4 bx.-.5..>..sP.........U..T.}8....U.J&y.\|.......Z...b.n. n8..t...O...9....k%(.$TY..Q....z.H..d..^..k....@{... T..rC.x.\&~^`._MS....P..5=\|.f.G_..Y.......kq.....Y..j-\..!.P.#.C.a....X..Dg..h...L.......N<Y.....w...)..Wu....,...`Y.....O....>w.x<Q...y.M/3....l+.......P._..~.k.G.UCi.8L.\j...7..q.3A;h3.)... ..T.o..us......k5.b0..m.Q ./!2.......u..6....W.....".*S...oY.......3..\:.M...6...^.......z....R..n.\.J..!.....s....q......=<5{MO.cs4..e.E.D..}.\...B3.....tI....<a...1'.._.)....hW.\|W..&.W...{..=Q..,......>S..S\|....k+.

C:\ProgramData\ChicaLogic\ChicaPC-Shield\Configuration\custom.conf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.221928094887362
Encrypted:	false
SSDEEP:	3:KZqXK9O:CqXK9O
MD5:	529584EC24AB8643D97E43EB2C0BFA6F
SHA1:	95AABFB6F47E24D278808C29C0E6C2B6B1195A63
SHA-256:	54FA58F6F44DFFDCED1C0AC7212C292E36A76049AAE98E09D22C3A08661EB66E
SHA-512:	F4394523E28C74780DC64C779A35BBBFC61F707A1628D43D3D7FE49782593D41E0BD2CC1FAD76FC53C11C91F15CE3098537B6B628C4C5DF2BD51BE49BBC71C5D
Malicious:	false
Preview:	.3.h<i.o.~.....ld...

C:\ProgramData\ChicaLogic\ChicaPC-Shield\Configuration\database.conf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	data
Category:	dropped
Size (bytes):	432
Entropy (8bit):	7.497715151628741
Encrypted:	false
SSDEEP:	12:6qRfpkD+qglWXyYJDPTsXlet0ZWs28a0TWSUsUIBVk7r:6ekFzyGDg1ea8R82SjC
MD5:	34A626D29697DE3C62D507E7E00E7DB5
SHA1:	D1E98F8E33CFC97B17928EB3438511A78EFDDCCE
SHA-256:	75133AF2F9E8C3E4B0360091072891A18180714D76A479FB5F8334C55CE4BFBB
SHA-512:	6828D66CAE2C51C97F69A8C92DF593B23BAC54A92D30913FA9967B5074BDAB5C8965F09BBDBCF38FB3EE9B18F29B41E1D8CCB650D72437384E0994191143ED2E
Malicious:	false
Preview:	P..w?~.rR......<....c=<4._T~.....'.......K..q5l....;.A..*2.i.............2...S.6.PwDJ'c...N3u...+<v........S4.....-.t...7..z%....N.=..H..P1W.....Kx..$\|q">..n.k.3......m..x%..\.h..\|.I>.xb@.m[......Z...z.[bqG..f4D...xc....._.@....Ao.......ky.gF.t.6..P..PJc.5.s....J.K?w.F\|...BA.TR.7<...3.=.c ......^.s.:l0...3{...:.......f2.%,.....O..+..%...?![.S.f[..1...E..2v....t....)......~...?N........s'F.n+x..y...KA

C:\ProgramData\ChicaLogic\ChicaPC-Shield\Configuration\html.conf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	data
Category:	dropped
Size (bytes):	2762
Entropy (8bit):	7.9377620479734405
Encrypted:	false
SSDEEP:	48:BOH12yXks7nYai3plXpVrb1CGSiOsYuKKFe1sWdeITOIPIigfqazavIZrHpoE:BOJnY35fCGISrWdeqngF4K7pP
MD5:	FB893D6DE8B37A994A4FBD1579502E9F
SHA1:	BD728D3E53F6EF34C58C854B55112F8645DDD84D
SHA-256:	0825BD7F34AC058857B81E44E10753AB37043549207BE0BE61CB42E4324EB5DC
SHA-512:	7FC6AC8E4898BEA68B8ACE6F79D022D7B620322783D5C2C514DB08E6DDF91549852672B19581F4AC5DAA188629E15D196A86A5F1BECBEA0C5C3486FA2F78E0F0
Malicious:	false
Preview:	K..m0t.<H!.....Tc.n./'.]..Mt.....k...,..i...EE_.....sP.F[.i...........NeK..D.?.f2C.7l..F3+...E@t........p......j...:..z.. M.....QJ>.H.\..b......"Q..X~o>0..g.r.:...&.v..6g.._......z..e.5(K.a[.^N...O...7)Aw8...zn@...0S.)..\...s.AG....f^_v..3P.z.d........`.".G7..6.K0i.Tz.....HL^..1!...KfRx...(a.....KE>.:gh.N.&o...pS......Xkw.-.....D..0.Ob.h\|..+.f.....9...[.@.>R.....P../.....i............5k..:"\|..<...._......}.. .1.<.w.\|eti.1.?..b..l.Y.K.........B.y$....@.J.~c.d....}.D..\..{.'..;o.N6.......\|..G.//$.z........x....u..........@)....:F..v[....4?.q....M..J...wx&.p.N..U..S..0.6p...G.O..>y@.`...t.........Mz..N6..2.]..I...^..T.E....`...zM..!.....\|......{..9#..c....4.m...,..+.I/.....l2.*.K...N.]..j.j.;.X@n."..Xi..[.y..vQ7p3.=m...A...o...z7...E.+..%d..p.U=.W,.....,..:..#V....o.....m.`:....\|^..S...f...n..^..2..[.J...../.@.D..$....E.?...f.}....5[......wz:]..ij.3.!.Y....)..V....(>....4P....<y.,&0..IXu...8...8..;.\...y..(B..t...\?H...b\|...q<.

C:\ProgramData\ChicaLogic\ChicaPC-Shield\Configuration\is-26J2K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	data
Category:	dropped
Size (bytes):	432
Entropy (8bit):	7.497715151628741
Encrypted:	false
SSDEEP:	12:6qRfpkD+qglWXyYJDPTsXlet0ZWs28a0TWSUsUIBVk7r:6ekFzyGDg1ea8R82SjC
MD5:	34A626D29697DE3C62D507E7E00E7DB5
SHA1:	D1E98F8E33CFC97B17928EB3438511A78EFDDCCE
SHA-256:	75133AF2F9E8C3E4B0360091072891A18180714D76A479FB5F8334C55CE4BFBB
SHA-512:	6828D66CAE2C51C97F69A8C92DF593B23BAC54A92D30913FA9967B5074BDAB5C8965F09BBDBCF38FB3EE9B18F29B41E1D8CCB650D72437384E0994191143ED2E
Malicious:	false
Preview:	P..w?~.rR......<....c=<4._T~.....'.......K..q5l....;.A..*2.i.............2...S.6.PwDJ'c...N3u...+<v........S4.....-.t...7..z%....N.=..H..P1W.....Kx..$\|q">..n.k.3......m..x%..\.h..\|.I>.xb@.m[......Z...z.[bqG..f4D...xc....._.@....Ao.......ky.gF.t.6..P..PJc.5.s....J.K?w.F\|...BA.TR.7<...3.=.c ......^.s.:l0...3{...:.......f2.%,.....O..+..%...?![.S.f[..1...E..2v....t....)......~...?N........s'F.n+x..y...KA

C:\ProgramData\ChicaLogic\ChicaPC-Shield\Configuration\is-41DE0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	data
Category:	dropped
Size (bytes):	2762
Entropy (8bit):	7.9377620479734405
Encrypted:	false
SSDEEP:	48:BOH12yXks7nYai3plXpVrb1CGSiOsYuKKFe1sWdeITOIPIigfqazavIZrHpoE:BOJnY35fCGISrWdeqngF4K7pP
MD5:	FB893D6DE8B37A994A4FBD1579502E9F
SHA1:	BD728D3E53F6EF34C58C854B55112F8645DDD84D
SHA-256:	0825BD7F34AC058857B81E44E10753AB37043549207BE0BE61CB42E4324EB5DC
SHA-512:	7FC6AC8E4898BEA68B8ACE6F79D022D7B620322783D5C2C514DB08E6DDF91549852672B19581F4AC5DAA188629E15D196A86A5F1BECBEA0C5C3486FA2F78E0F0
Malicious:	false
Preview:	K..m0t.<H!.....Tc.n./'.]..Mt.....k...,..i...EE_.....sP.F[.i...........NeK..D.?.f2C.7l..F3+...E@t........p......j...:..z.. M.....QJ>.H.\..b......"Q..X~o>0..g.r.:...&.v..6g.._......z..e.5(K.a[.^N...O...7)Aw8...zn@...0S.)..\...s.AG....f^_v..3P.z.d........`.".G7..6.K0i.Tz.....HL^..1!...KfRx...(a.....KE>.:gh.N.&o...pS......Xkw.-.....D..0.Ob.h\|..+.f.....9...[.@.>R.....P../.....i............5k..:"\|..<...._......}.. .1.<.w.\|eti.1.?..b..l.Y.K.........B.y$....@.J.~c.d....}.D..\..{.'..;o.N6.......\|..G.//$.z........x....u..........@)....:F..v[....4?.q....M..J...wx&.p.N..U..S..0.6p...G.O..>y@.`...t.........Mz..N6..2.]..I...^..T.E....`...zM..!.....\|......{..9#..c....4.m...,..+.I/.....l2.*.K...N.]..j.j.;.X@n."..Xi..[.y..vQ7p3.=m...A...o...z7...E.+..%d..p.U=.W,.....,..:..#V....o.....m.`:....\|^..S...f...n..^..2..[.J...../.@.D..$....E.?...f.}....5[......wz:]..ij.3.!.Y....)..V....(>....4P....<y.,&0..IXu...8...8..;.\...y..(B..t...\?H...b\|...q<.

C:\ProgramData\ChicaLogic\ChicaPC-Shield\Configuration\is-7JP9T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	data
Category:	dropped
Size (bytes):	321
Entropy (8bit):	7.400769518086214
Encrypted:	false
SSDEEP:	6:qfL4sxiVv8OWNqbG7CG3QEcqZsa0882NM4apF9V/KmWFRoj/iNoCEEzjIX:qf0ui8NB1Q4Z1rWzV6RojOFvoX
MD5:	7A7EFDD8689A4B56134730EC90ABB1B0
SHA1:	0B942791A7038E97BBD265070971EB9CE0D18D98
SHA-256:	0A903C89BC186426E59FE36878A0FD9103CDDD8934DC742333ADB02A92C0BCDA
SHA-512:	27D0249141813C2DDACA2C9FF48E291910C6E42BD13F6B4BF6ACA0E832FBDB9CD16A34B846AB906259DC7B3AEDAAEAD6DC50FE75C566F0B5027C9D57865FEE01
Malicious:	false
Preview:	.3.p<o].b......6.. .I..w...u............C..xeE.h.b..%.ka.>L............Xm...i./.Vz.~N%...Qhg...+x7.........u......\|..d..5).....1,..H.T..1n.....6...$\|"v9..x..\...../.k..#h.%.....t.U(.ab....=.\....X...5"A.u....I.V..d}....M..E....;....kUH -.*P@...........p.".....`.Kk>.Ea..._.OVP..YO...FgZz..~/....2

C:\ProgramData\ChicaLogic\ChicaPC-Shield\Configuration\is-9E5DG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	data
Category:	dropped
Size (bytes):	131
Entropy (8bit):	6.549575077985894
Encrypted:	false
SSDEEP:	3:KZqXK9MyLzMoVhxsmGecdt78HKqKn2z51gqwn4sMFULFFKepn:CqXK9My3ZgD3t2A4DCBFT
MD5:	8661D1596435A702F403C5F35BCE19B0
SHA1:	F886E49D5692CFA8F0E7A0F27A8387F07F763966
SHA-256:	D81784D2414CE8BD02A241F057A00E5C0AE86D4A1AEC7A9CFFCD7B8005308444
SHA-512:	4F0368D7EAA78396E61EAF9CC688700628FF9289BC3D9836DA148381AB5F7D35EA43AE7142C50693A47C3665DFA27026FBFF64C57C57D0149F8B38253772D521
Malicious:	false
Preview:	.3.h<i.o.~.....ld...-xk$.<*.y...p.........3a:_.o.H..i.dy.D)...........Tg......j.8`.Sd`..D7#...jp%.........=......y../T....

C:\ProgramData\ChicaLogic\ChicaPC-Shield\Configuration\is-A47L8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	data
Category:	dropped
Size (bytes):	3258
Entropy (8bit):	7.95290126060931
Encrypted:	false
SSDEEP:	96:31WdW/B7wmxHoHmCOQfBsBLw4DOU8uudSsVdYWh2:31Wd2MmBoHm9QfBsBLw4VWYG2
MD5:	E6676357E76BC8771F9A0BFA6839CFBC
SHA1:	55B779741717A67EDBA2F9B697937CACE43EA105
SHA-256:	8768DDAE90F83A45DC87AF8B251F3B711E41D8361361C0E5F62EC3AE72B0C8B1
SHA-512:	6DA7614C81B61D981ACB3FB253A861ACD6C2DB17AFB21ABD78DA40238E57591623636124206F26B846FF785C206257857465655AEE1ED81EEF2C1A955F973589
Malicious:	false
Preview:	.3.h<i.o.~.....od...-xhm.;-.S....f.......R.(qnQ.../.Sa.~w.g@............`......b.B$C.!v...E~g...o}"........w.....b...y..9..{h....^Gb.L.\..xM.........p=%q<..j.d.v.....=.o..t=..I.V...p.!V.,r@.mP......K...~<Gy....V3W...`+.G...K..RF..Fn.....sBD,+.i.g.i......U.r.:.\|......:~..3...SA.HE.&$...MaLt... .....JP .1-:...d...zM......N0$P9.....M..u.Gq..~w3.<.5....R.B.E../#V...t..P.Q.qE...f...{....X.....s'F.o?g.....P.....^..vb.!..x./.4 bx.-.5..>..sP.........U..T.}8....U.J&y.\|.......Z...b.n. n8..t...O...9....k%(.$TY..Q....z.H..d..^..k....@{... T..rC.x.\&~^`._MS....P..5=\|.f.G_..Y.......kq.....Y..j-\..!.P.#.C.a....X..Dg..h...L.......N<Y.....w...)..Wu....,...`Y.....O....>w.x<Q...y.M/3....l+.......P._..~.k.G.UCi.8L.\j...7..q.3A;h3.)... ..T.o..us......k5.b0..m.Q ./!2.......u..6....W.....".*S...oY.......3..\:.M...6...^.......z....R..n.\.J..!.....s....q......=<5{MO.cs4..e.E.D..}.\...B3.....tI....<a...1'.._.)....hW.\|W..&.W...{..=Q..,......>S..S\|....k+.

C:\ProgramData\ChicaLogic\ChicaPC-Shield\Configuration\is-AF3S0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	data
Category:	dropped
Size (bytes):	142
Entropy (8bit):	6.735980306109167
Encrypted:	false
SSDEEP:	3:2fB1WDYZs4S8yQyun38hu3dramTusdwCd4UkGl:61WB4GQy2D3dOmTuSeUkA
MD5:	2F275DA13F68A4E6C2D7154FBDDC8451
SHA1:	07FD1A4D93AE8788C1934365488B6136D02B8861
SHA-256:	97F76D2EEEDBA90A0B2D00723417CEA78C50DF79459DE4C4FC35574B8821A6F3
SHA-512:	56846D85472A260E2FE16225804D0758AF3B2895FCD2AFF385161A29DBB31B131CC7793465612E7BA27EBCCEA590DE951BE1038E53FAF0E13455BAFFCB6BEF1D
Malicious:	false
Preview:	M..y+z.<b0.....+.. ...}:...y.....'...m...A..A5 ....,.Fa.*t.,F.........._.4...J.?.8`..%q...\|:2...?<........._2.....Y..s..v..5.........

C:\ProgramData\ChicaLogic\ChicaPC-Shield\Configuration\is-AJB53.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	data
Category:	dropped
Size (bytes):	184
Entropy (8bit):	6.899681589103373
Encrypted:	false
SSDEEP:	3:n7eAXali3N/NtFJ7hxxQghQjjrWqlaUpDmDueJDnqS7hXrqNwo3ooqIuwoALYUHx:7eAXz/NvzGjGqlHtmDpDqwhww/5ex
MD5:	5A4535CE45D1A6A84DAB4F6D3B891BBA
SHA1:	59830E8DA4D813AE1A72C4C2EF8E1AD8C5059A5A
SHA-256:	99C173C423F84A0C7185E883CE9BAF820135DE3AB532FB14799AECFEAF315009
SHA-512:	CFE02184D2E0C4C6858CA2DC1F406EF16B337795721385480A3261FAE2BF9888F31693193CEA03D3512EDA1F849DBE5E3435D8CFA6062D3670636677443B4C72
Malicious:	false
Preview:	P..w?~.rR......?.. .c=<w.TRh.....6......S..$x:u.E.b.Fw.c}.s............d.#......f.\z.Br7...?"..lu8.........n.....8..{..-./)....SH5..M..b+C.....mX..$\|q"...x.e.l.....`.,..)x

C:\ProgramData\ChicaLogic\ChicaPC-Shield\Configuration\is-NKMPM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	data
Category:	dropped
Size (bytes):	1430
Entropy (8bit):	7.8514817294491195
Encrypted:	false
SSDEEP:	24:8ICgNAfYc5fnf0Ou2xa8x6qQPLtcfl+lApM8xkNbSzePhPT83JcpF/QI:8nokB5ffTx6FLislApMxBYEPTeJcplQI
MD5:	83A933C593922DA6A3712856308E56F6
SHA1:	C1A37617B5FBE69988864E84ED2949BCC6AE9882
SHA-256:	D4325F1C1A2D5C5F56A0D239EFD75D668E2211F981FA914797C4B147DC2B00CC
SHA-512:	0F0D10911EF31CD1B154BC8F1BAD95D537E50AD880C9B422BE69957C86364A09877AF424EC7A52710DE1CE534214ADC7B7ECED82EB9E8F3D3B64074F8FA5C01B
Malicious:	false
Preview:	.3.h<i.o.~.....od....xo$.VIu........o..C..q..r.E.b..3.hw.(..,..........Nb...D..{.?J.Sd%...Z; ...1<.........u....}....T..7.nj....gJf.W.O..b......,...w9'g..r..7.....C."..9h..A.@..r..\|."1..."..L@.......z!Tnn...c,KL..Z;:.Z....m....;....fT.k-.2Pw.....B....g.&.(n..J.K?w.Mv...Q...U.55....3.=.u\|......cT1.- h.V.WB.).....C?m.FJ....,e..q..%..h`.. .f.....1.o...Zkl.....1.O..5.[T.&...<P........>f..e8f..7..A......^..wC.0..t.{.us"=.;.p.Uj..Ov..Q........r.l4..W.E..+.].... .].G...d.3..>f.+x...O..\|O.^.'.$.#HI..\|....5....&..e..z....$... E..cO.0_.-r.:.u\_.......$J0.$.+~........:.12...I.O..f-M..0...j.R.*..O...C.Uk..d.E.Lw...Z....d.o7...{...jX..!.....e.S.As.... '..g...G...o..0.....%VN...w..........O.t..,.G...:.vH.Fm...0..[.3.n$v.gg..... .{..,;.@.[.0t.s-..".Q%.j\|!...P..r........V.....y.o..G..oO...J..a...u..... ...\.P.....`.W....e.C....x..Li.e....#.......<0>5.B.(#\<.$....S..h..W..U`&....o.....1p..;1!..B.{I..r...\|...+.....4..&G..(...S>T..?T5....#..

C:\ProgramData\ChicaLogic\ChicaPC-Shield\Configuration\is-NN3CS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.221928094887362
Encrypted:	false
SSDEEP:	3:KZqXK9O:CqXK9O
MD5:	529584EC24AB8643D97E43EB2C0BFA6F
SHA1:	95AABFB6F47E24D278808C29C0E6C2B6B1195A63
SHA-256:	54FA58F6F44DFFDCED1C0AC7212C292E36A76049AAE98E09D22C3A08661EB66E
SHA-512:	F4394523E28C74780DC64C779A35BBBFC61F707A1628D43D3D7FE49782593D41E0BD2CC1FAD76FC53C11C91F15CE3098537B6B628C4C5DF2BD51BE49BBC71C5D
Malicious:	false
Preview:	.3.h<i.o.~.....ld...

C:\ProgramData\ChicaLogic\ChicaPC-Shield\Configuration\local.conf

Download File

Process:	C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe
File Type:	data
Category:	dropped
Size (bytes):	474
Entropy (8bit):	7.554711593100334
Encrypted:	false
SSDEEP:	12:5HPtbypzJ+DC8Yer35o10wGfNipj3EaKYMLEUlXQj5kQTBJMSI:ZPt2J+D/YerS10OjkY+EeQ2G7Y
MD5:	50682FA0E3378107F37CCFB7C8C9BCEE
SHA1:	C95CCCD31782E2319A339E2FE9387E4FAFFAB035
SHA-256:	578C450B61348B415DEDF631C4F4E5EAFB33C3B0507C55036EA38F5E96C48F64
SHA-512:	356D5C86D2C267FDBD46BCDF201B02A2E26AC4128A004BF86162A840D08DE258E3BD011B78631A47499E0BC402F001ECF6F52F853FCFB428DE7C73B0BB569A6A
Malicious:	false
Preview:	Q..{7h.<b0.....cI.8.c=u3...9y...~...,...R..k5p....x..%.\|.$F..........Jl...D.....`..7`...E7}....l$.........d....y..y~.~..5.....JG{.S.I..nY.....,...K?%"j..?.;.l.....n.O..9h..Z.L..=..V.,bK.~V......C...xn?68...a.\|...c{....@.@TU..;....kUH -.P@..=..R..B^.a.%U..J..z/.C{...B.K]...vO...GgV{...jp.....KE&.**:.B.~&..).......A0>[tH.....V..d.,p..7.O...'.....U.B...."(.....6.XQ.v.M..9...5T..I.....f0V.cs...y...\[......)t.!.h.a.x.%ry<.9.`..7..&L.........

C:\ProgramData\ChicaLogic\ChicaPC-Shield\Configuration\manifest.conf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	data
Category:	dropped
Size (bytes):	184
Entropy (8bit):	6.899681589103373
Encrypted:	false
SSDEEP:	3:n7eAXali3N/NtFJ7hxxQghQjjrWqlaUpDmDueJDnqS7hXrqNwo3ooqIuwoALYUHx:7eAXz/NvzGjGqlHtmDpDqwhww/5ex
MD5:	5A4535CE45D1A6A84DAB4F6D3B891BBA
SHA1:	59830E8DA4D813AE1A72C4C2EF8E1AD8C5059A5A
SHA-256:	99C173C423F84A0C7185E883CE9BAF820135DE3AB532FB14799AECFEAF315009
SHA-512:	CFE02184D2E0C4C6858CA2DC1F406EF16B337795721385480A3261FAE2BF9888F31693193CEA03D3512EDA1F849DBE5E3435D8CFA6062D3670636677443B4C72
Malicious:	false
Preview:	P..w?~.rR......?.. .c=<w.TRh.....6......S..$x:u.E.b.Fw.c}.s............d.#......f.\z.Br7...?"..lu8.........n.....8..{..-./)....SH5..M..b+C.....mX..$\|q"...x.e.l.....`.,..)x

C:\ProgramData\ChicaLogic\ChicaPC-Shield\Configuration\messaging.conf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	data
Category:	dropped
Size (bytes):	1430
Entropy (8bit):	7.8514817294491195
Encrypted:	false
SSDEEP:	24:8ICgNAfYc5fnf0Ou2xa8x6qQPLtcfl+lApM8xkNbSzePhPT83JcpF/QI:8nokB5ffTx6FLislApMxBYEPTeJcplQI
MD5:	83A933C593922DA6A3712856308E56F6
SHA1:	C1A37617B5FBE69988864E84ED2949BCC6AE9882
SHA-256:	D4325F1C1A2D5C5F56A0D239EFD75D668E2211F981FA914797C4B147DC2B00CC
SHA-512:	0F0D10911EF31CD1B154BC8F1BAD95D537E50AD880C9B422BE69957C86364A09877AF424EC7A52710DE1CE534214ADC7B7ECED82EB9E8F3D3B64074F8FA5C01B
Malicious:	false
Preview:	.3.h<i.o.~.....od....xo$.VIu........o..C..q..r.E.b..3.hw.(..,..........Nb...D..{.?J.Sd%...Z; ...1<.........u....}....T..7.nj....gJf.W.O..b......,...w9'g..r..7.....C."..9h..A.@..r..\|."1..."..L@.......z!Tnn...c,KL..Z;:.Z....m....;....fT.k-.2Pw.....B....g.&.(n..J.K?w.Mv...Q...U.55....3.=.u\|......cT1.- h.V.WB.).....C?m.FJ....,e..q..%..h`.. .f.....1.o...Zkl.....1.O..5.[T.&...<P........>f..e8f..7..A......^..wC.0..t.{.us"=.;.p.Uj..Ov..Q........r.l4..W.E..+.].... .].G...d.3..>f.+x...O..\|O.^.'.$.#HI..\|....5....&..e..z....$... E..cO.0_.-r.:.u\_.......$J0.$.+~........:.12...I.O..f-M..0...j.R.*..O...C.Uk..d.E.Lw...Z....d.o7...{...jX..!.....e.S.As.... '..g...G...o..0.....%VN...w..........O.t..,.G...:.vH.Fm...0..[.3.n$v.gg..... .{..,;.@.[.0t.s-..".Q%.j\|!...P..r........V.....y.o..G..oO...J..a...u..... ...\.P.....`.W....e.C....x..Li.e....#.......<0>5.B.(#\<.$....S..h..W..U`&....o.....1p..;1!..B.{I..r...\|...+.....4..&G..(...S>T..?T5....#..

C:\ProgramData\ChicaLogic\ChicaPC-Shield\Configuration\news.conf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	data
Category:	dropped
Size (bytes):	131
Entropy (8bit):	6.549575077985894
Encrypted:	false
SSDEEP:	3:KZqXK9MyLzMoVhxsmGecdt78HKqKn2z51gqwn4sMFULFFKepn:CqXK9My3ZgD3t2A4DCBFT
MD5:	8661D1596435A702F403C5F35BCE19B0
SHA1:	F886E49D5692CFA8F0E7A0F27A8387F07F763966
SHA-256:	D81784D2414CE8BD02A241F057A00E5C0AE86D4A1AEC7A9CFFCD7B8005308444
SHA-512:	4F0368D7EAA78396E61EAF9CC688700628FF9289BC3D9836DA148381AB5F7D35EA43AE7142C50693A47C3665DFA27026FBFF64C57C57D0149F8B38253772D521
Malicious:	false
Preview:	.3.h<i.o.~.....ld...-xk$.<*.y...p.........3a:_.o.H..i.dy.D)...........Tg......j.8`.Sd`..D7#...jp%.........=......y../T....

C:\ProgramData\ChicaLogic\ChicaPC-Shield\is-Q97HV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	data
Category:	dropped
Size (bytes):	6302342
Entropy (8bit):	7.999972936872293
Encrypted:	true
SSDEEP:	196608:MPBf0K9/bDPsBDfzQqsPMkskQbSuB7OeFr7jC:MPBJJ3PWbz9/kbulL1C
MD5:	1A08F442E5067494A73361F6E3137E18
SHA1:	39E056E5D8FF330EDC85DCD65D9C072C239F2920
SHA-256:	DB47787C60C915DC51D3115F5FC7CA69EC64F348E41406F24F0D2276759C23A6
SHA-512:	AE1598E2FF9E39DA7977BB574BAF644B4833E6528792CDDC4C049BAC77C671452752F6B9FACB3F16C6112322441E15EDDB91A8E35AE3BCBD4A51B67D50BEF15D
Malicious:	false
Preview:	..7......~. . ...d...O.7..;.......t...JZ...O./...;.%<......1~#Hhh..(....+4.;....,..._.<h>...].........HD.IGZ..@@>?.m.}TT....wy.KI......4....?.rq&aE.=.>..b7...p..[k\E.cl...N.s.tFqtG.....&}..[..\|.=...UQ3...m.o.}."...n.._?._.uAS....#.{e...<@.$x..<..>....7....\|..._.}.....>..).\#...j.V(.5..gh...).).X....eA\:....5...[.........@M............}..]..nn$..g....."f...@2..]G.W_.3S..../........<..BZ.:-..+A.{H.%.9...9.pe...9.F_....M..&.......W.Fm}<..P....e.T.a..u.{.u.J...@g#g...I.......o.^...unK.....?.Aq...r.DG..)..m..c....<$.ST.<..2>..3....n.j......&......t.....P..{...._.%V..tf$....(...C'..i......1A.yJ..........aV.RM.xS.....=.y.~..N.m..../.{..{h.?!S...w..Tt.U.`..V.Zz3...>...y.....cG.J.l..1"....k.....f..g.u.~1oN.....j.....4......S>...B@.,I\|bO...Mug^>5.rk....,j.;..'N/W.XI.J7.hpp6...]..SF...y.'..PT..w..}M....L..y.q.<.+{CR..q..SF.........O7.w).....d=I+.J~$Gh..x<h.E.........&6...\..l..A.g..V .M...i.....I....si...Lv./&..p..WL...../$a..x.p.x..&.Z.%.A...

C:\ProgramData\ChicaLogic\ChicaPC-Shield\rules.ref (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	data
Category:	dropped
Size (bytes):	6302342
Entropy (8bit):	7.999972936872293
Encrypted:	true
SSDEEP:	196608:MPBf0K9/bDPsBDfzQqsPMkskQbSuB7OeFr7jC:MPBJJ3PWbz9/kbulL1C
MD5:	1A08F442E5067494A73361F6E3137E18
SHA1:	39E056E5D8FF330EDC85DCD65D9C072C239F2920
SHA-256:	DB47787C60C915DC51D3115F5FC7CA69EC64F348E41406F24F0D2276759C23A6
SHA-512:	AE1598E2FF9E39DA7977BB574BAF644B4833E6528792CDDC4C049BAC77C671452752F6B9FACB3F16C6112322441E15EDDB91A8E35AE3BCBD4A51B67D50BEF15D
Malicious:	false
Preview:	..7......~. . ...d...O.7..;.......t...JZ...O./...;.%<......1~#Hhh..(....+4.;....,..._.<h>...].........HD.IGZ..@@>?.m.}TT....wy.KI......4....?.rq&aE.=.>..b7...p..[k\E.cl...N.s.tFqtG.....&}..[..\|.=...UQ3...m.o.}."...n.._?._.uAS....#.{e...<@.$x..<..>....7....\|..._.}.....>..).\#...j.V(.5..gh...).).X....eA\:....5...[.........@M............}..]..nn$..g....."f...@2..]G.W_.3S..../........<..BZ.:-..+A.{H.%.9...9.pe...9.F_....M..&.......W.Fm}<..P....e.T.a..u.{.u.J...@g#g...I.......o.^...unK.....?.Aq...r.DG..)..m..c....<$.ST.<..2>..3....n.j......&......t.....P..{...._.%V..tf$....(...C'..i......1A.yJ..........aV.RM.xS.....=.y.~..N.m..../.{..{h.?!S...w..Tt.U.`..V.Zz3...>...y.....cG.J.l..1"....k.....f..g.u.~1oN.....j.....4......S>...B@.,I\|bO...Mug^>5.rk....,j.;..'N/W.XI.J7.hpp6...]..SF...y.'..PT..w..}M....L..y.q.<.+{CR..q..SF.........O7.w).....d=I+.J~$Gh..x<h.E.........&6...\..l..A.g..V .M...i.....I....si...Lv./&..p..WL...../$a..x.p.x..&.Z.%.A...

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307237401252656
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugn:gJjJGtpTq2yv1AuNZRY3diu8iBVqFt
MD5:	8366DC6225F58CFF0402FA8A963766FC
SHA1:	E4848309FD349EAE311B6E7F8832132B9F3A6B3C
SHA-256:	75B6B4EB9F047A0C32FCF4FA349A853113E1E19E66DFEBC2C06A676D2D130CA4
SHA-512:	DF2F4538BB0F70C23A60F1DB4F7E2315972F8394C56DEC90A229320CAC96E3D96BFD6F40E3BB538C5C59EF3624BBB3F29B31B9148B5EBB5753057C76D77E1F21
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xe5e072a7, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.658589129396548
Encrypted:	false
SSDEEP:	1536:pSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:paza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	F5AB5BFC735C775D40A8B201BEEF5A26
SHA1:	C9C25392AC45C0316A2DBC99DDA591BB5E15FCBB
SHA-256:	89FAB4CDA2DCBBFBA372FA8C66B52C6A88B922D4EBFE4AFE2EA634F0D46A1719
SHA-512:	CE7E4DFE3FB1D9810FAD5193DB185841AF722702648F00B00754D3AD20B8FCBAE1930947DABEFFB49E51E964A5F4A4F67F54F0361C4A0CAE2595210F256558A5
Malicious:	false
Preview:	..r.... ...............X\...;...{......................0.z..........{..79...\|..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{....................................H79...\|.....................V79...\|...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08147490623636147
Encrypted:	false
SSDEEP:	3:yrilEYelfvMrAkGuAJkhvekl1Dk8vZylillrekGltll/SPj:ozlfvMrbrxlC8v4IJe3l
MD5:	CD243A3E03DD055512C5CBBD2DE3789A
SHA1:	4D108D9C3D314D49C9F58963A5DEBD78C067F715
SHA-256:	BAE8D017A7D52D31067891964FBCED7AA99916DB8D52B2E61B042EE4D060673F
SHA-512:	C45C90578DC3494D382DE88AAEA9262E6FF6AB46F2F82570B74587FD39BC47B321CBB0F967E3674991594AAB34F249D7C3493A195FA39CCE064A7D15479E6C3C
Malicious:	false
Preview:	.m.......................................;...{..79...\|.......{...............{.......{...XL......{.....................V79...\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ChicaLogic\ChicaPC-Shield\ChicaPC-Shield Notifications.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Oct 30 14:57:41 2024, mtime=Wed Oct 30 14:57:41 2024, atime=Thu Apr 4 17:51:30 2013, length=788040, window=hide
Category:	dropped
Size (bytes):	1431
Entropy (8bit):	4.57848823639599
Encrypted:	false
SSDEEP:	24:8mAb83ErdOEuPhKKZ8Afacpxsdgk9U+dgksUUCaydN6nqFqygm:8mA8UrdO9PMKFSo+dD9U+dDZZNYDyg
MD5:	93384F880A494F53CB54E6540272EF68
SHA1:	FFE8F96B4DD6893E9BEADFC77FEC18C5B17E7F2A
SHA-256:	0D668D99998C2CFE8F94B9BB1217FCBA5B14D94A18D0435B4555C8057650DEF0
SHA-512:	A5E65906C268FB7F87B204BFFC2E0F98DBEF7A3C60C3FB340D62416D79EA7A01A2022D4AF0A959433B042C5D2AA841AED85816E69140FE0302BE4ADF9314DD8E
Malicious:	false
Preview:	L..................F.... ..../es...&.is......ke1..H............................P.O. .:i.....+00.../C:\.....................1.....^Y5...PROGRA~2.........O.I^Y6.....................V.....-+..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....^.1.....^Y5...CHICAL~1..F......^Y5.^Y6...........................-+..C.h.i.c.a.L.o.g.i.c.....f.1.....^Y6...CHICAP~1..N......^Y5.^Y6...............................C.h.i.c.a.P.C.-.S.h.i.e.l.d.....b.2.H....Bo. .cpcsgui.exe.H......^Y5.^Y5...............................c.p.c.s.g.u.i...e.x.e.......k...............-.......j.............Qw.....C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe..N.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.C.h.i.c.a.L.o.g.i.c.\.C.h.i.c.a.P.C.-.S.h.i.e.l.d.\.c.p.c.s.g.u.i...e.x.e.0.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.C.h.i.c.a.L.o.g.i.c.\.C.h.i.c.a.P.C.-.S.h.i.e.l.d.........*................@Z\|...K.J.........`.......X.......467601

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ChicaLogic\ChicaPC-Shield\ChicaPC-Shield.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Oct 30 14:57:41 2024, mtime=Wed Oct 30 14:57:41 2024, atime=Thu Apr 4 17:51:30 2013, length=973448, window=hide
Category:	dropped
Size (bytes):	1271
Entropy (8bit):	4.580640568559658
Encrypted:	false
SSDEEP:	24:8m11+72EvdOEuQhKFA6acpxjCdgk9udgksUUCbqygm:8mW7pvdO9QMu1oodD9udDZOyg
MD5:	544C68611EA365E5ADFD252834F6C4D8
SHA1:	0C62FAE5CFD4CF2ACEF358EB39DC2E1EB08510A1
SHA-256:	AB409652A90BCA417F1649BD25EC718A154C6CFAD8E4787F3C9338D86083DF56
SHA-512:	FA5A3C1905A22982B96EA5F862AD4202EA6A70BD0D4499BA652D33430E54419D82B1A1F7DF5DA2C17B8739DA705501F59F895288AAAF8ED393F6ECCAC7AC0B77
Malicious:	false
Preview:	L..................F.... ...CYs.....^s......ke1...............................P.O. .:i.....+00.../C:\.....................1.....^Y....PROGRA~2.........O.I^Y......................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....^.1.....^Y5...CHICAL~1..F......^Y5.^Y5...........................-+..C.h.i.c.a.L.o.g.i.c.....f.1.....^Y6...CHICAP~1..N......^Y5.^Y6...............................C.h.i.c.a.P.C.-.S.h.i.e.l.d.....Z.2......Bo. .cpcs.exe..B......^Y5.^Y5...............................c.p.c.s...e.x.e.......h...............-.......g.............Qw.....C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe..K.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.C.h.i.c.a.L.o.g.i.c.\.C.h.i.c.a.P.C.-.S.h.i.e.l.d.\.c.p.c.s...e.x.e.0.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.C.h.i.c.a.L.o.g.i.c.\.C.h.i.c.a.P.C.-.S.h.i.e.l.d.........................@Z\|...K.J.........`.......X.......467601...........hT..Cr

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ChicaLogic\ChicaPC-Shield\Uninstall ChicaPC-Shield.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Oct 30 14:57:40 2024, mtime=Wed Oct 30 14:57:40 2024, atime=Wed Oct 30 14:57:01 2024, length=712264, window=hide
Category:	dropped
Size (bytes):	1295
Entropy (8bit):	4.623613690638364
Encrypted:	false
SSDEEP:	24:8mf5K23ErdOEuPhK8uYAyVacpxH0dgki9dgksUUCfqygm:8mPUrdO9PMH/Ro2dDi9dDZyyg
MD5:	3E447465E4FD643F301FD41F9365E30D
SHA1:	E3A9A90F5213DBAE023F20DC99B504A813433717
SHA-256:	99B8555D5BF6AC26016BB757413091CF8E7DE06F94CF1FB5DF56810D13B7DF98
SHA-512:	700619F97C6D30EB25B9E2883EB90488B31E2D866E05DAEB8B16B33BD91222783D935F7E44E634DE32262F2F3DD68BDEF0E8E8B4F325EC3CEE7978DCE6495CA9
Malicious:	false
Preview:	L..................F.... .....s.....s.....i[...H............................P.O. .:i.....+00.../C:\.....................1.....^Y5...PROGRA~2.........O.I^Y6.....................V.....-+..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....^.1.....^Y5...CHICAL~1..F......^Y5.^Y6...........................-+..C.h.i.c.a.L.o.g.i.c.....f.1.....^Y6...CHICAP~1..N......^Y5.^Y6...............................C.h.i.c.a.P.C.-.S.h.i.e.l.d.....f.2.H...^Y!. .unins000.exe..J......^Y5.^Y5.....D.....................'.w.u.n.i.n.s.0.0.0...e.x.e.......l...............-.......k.............Qw.....C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\unins000.exe..O.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.C.h.i.c.a.L.o.g.i.c.\.C.h.i.c.a.P.C.-.S.h.i.e.l.d.\.u.n.i.n.s.0.0.0...e.x.e.0.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.C.h.i.c.a.L.o.g.i.c.\.C.h.i.c.a.P.C.-.S.h.i.e.l.d.........................@Z\|...K.J.........`.......X......

C:\Users\Public\Desktop\ChicaPC-Shield.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Oct 30 14:57:41 2024, mtime=Wed Oct 30 14:57:42 2024, atime=Thu Apr 4 17:51:30 2013, length=973448, window=hide
Category:	dropped
Size (bytes):	1247
Entropy (8bit):	4.599975843430075
Encrypted:	false
SSDEEP:	24:8m7G3ErdOEuPhKFA6acpxTedgk9udgksUUCbqygm:8maUrdO9PMu1ocdD9udDZOyg
MD5:	E71758F3486FB8790B61AC5F1AEAAA48
SHA1:	95457733F87B19B7AC6F8703A30A6DB83BBDECD4
SHA-256:	CB6026E0DADD5A6CB3120DB1764BAFC53BD2F6EA17413AF74489437B59D954FD
SHA-512:	F1D329DAA1D4C1168AF1B4EC55B4E676E5291642BEE6E5DDCCF105572FB95ED699AB6260B3ABA02825FB71422FBBC31E11BBEA0DFD6EAFEF8B73CD2403D57D11
Malicious:	false
Preview:	L..................F.... ...CYs....v.t......ke1...............................P.O. .:i.....+00.../C:\.....................1.....^Y5...PROGRA~2.........O.I^Y6.....................V.....-+..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....^.1.....^Y5...CHICAL~1..F......^Y5.^Y6...........................-+..C.h.i.c.a.L.o.g.i.c.....f.1.....^Y6...CHICAP~1..N......^Y5.^Y6...............................C.h.i.c.a.P.C.-.S.h.i.e.l.d.....Z.2......Bo. .cpcs.exe..B......^Y5.^Y5...............................c.p.c.s...e.x.e.......h...............-.......g.............Qw.....C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe..?.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.C.h.i.c.a.L.o.g.i.c.\.C.h.i.c.a.P.C.-.S.h.i.e.l.d.\.c.p.c.s...e.x.e.0.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.C.h.i.c.a.L.o.g.i.c.\.C.h.i.c.a.P.C.-.S.h.i.e.l.d.........................@Z\|...K.J.........`.......X.......467601...........hT..CrF.f4... .@.2=.b...,...W.

C:\Users\user\AppData\Local\Temp\is-93AED.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.289297026665552
Encrypted:	false
SSDEEP:	48:Sv1LfWvPcXegCPUo1vlZQrAxoONfHFZONfH3d1xCWMBFNL2pGSS4k+bkg6j0KHc:wfkcXegaJ/ZAYNzcld1xaX12pfSKvkc
MD5:	C8871EFD8AF2CF4D9D42D1FF8FADBF89
SHA1:	D0EACD5322C036554D509C7566F0BCC7607209BD
SHA-256:	E4FC574A01B272C2D0AED0EC813F6D75212E2A15A5F5C417129DD65D69768F40
SHA-512:	2735BB610060F749E26ACD86F2DF2B8A05F2BDD3DCCF3E4B2946EBB21BA0805FB492C474B1EEB2C5B8BF1A421F7C1B8728245F649C644F4A9ECC5BD8770A16F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....HP..........#............................@.............................`..............................................................<!.......P.......@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc........P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-93AED.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-93AED.tmp\mbam.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	527432
Entropy (8bit):	6.554357599549209
Encrypted:	false
SSDEEP:	6144:0d3w5EjjbHtGYp1H8sPF0ZMAHzrGOF2OAN0TxlgCh/4gezc3NTkv4xl7nRlQAz31:2w5EjPHr98lZFTFH9TrZ4gcc9TKE
MD5:	6043B2F884CDE44CEEA91A34EB2FAE81
SHA1:	5F0A4D9D2C61B0045B5C94CE366949CA26E49A11
SHA-256:	5E08FCA6421A1E89538C52E8ACB1D9A83FAEC7138EED6451BB5D5180A4F39938
SHA-512:	322591B9E87900BCF9B24020FCBC601CB250EB5A8C82838D4DCE10810D803A7EB692CF1462E79E7A3193A01FD7FCE8C32AC37EC42C2A51E93D873CB19DB61B95
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1{.OP..OP..OP.. &..XP.. &...P.. &...P..F(..XP..OP...P..OP..NP.. &...P.. &..NP.. &..NP..OP..NP.. &..NP..RichOP..........................PE..L...../Q...........!.........................................................@......;.....@.........................`M..i....>..........................H........O..0...................................@...............\|............................text............................... ..`.rdata...K.......L..................@..@.data....Z...`...6...J..............@....rsrc...............................@..@.reloc...k.......l..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp

Download File

Process:	C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	712264
Entropy (8bit):	6.524059965918702
Encrypted:	false
SSDEEP:	12288:qTPcYn5c/rPx37/zHBA6a5UeypkxmFERhD7rNdR81QNERxyF:iPcYn5c/rPx37/zHBA6pDpk8FEK1uERU
MD5:	C2BE7988C8762E314534B2908C4D6E49
SHA1:	CBC373D596D389F5ABEA8177D1F86EE767284466
SHA-256:	4A53C567369F2F30571019E17B13F650680280962B9C4105B2B3CF306FE47C36
SHA-512:	EEFA58E16BBFBEFD1AFBF63409CDF5907FBE87BDD5BCFFEB9FEC47790E0428E3290ED22108EAE4BCD6711C9CD92D947E87CFBF68EBCF37FE4A68405142776216
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................z........................@..............................................@...............................%......................H...........................................................................................CODE.....y.......z.................. ..`DATA.................~..............@...BSS......................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc....... ......................@..P.rsrc...............................@..P.....................P..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF2964631E0BFA171F.TMP

Download File

Process:	C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	229376
Entropy (8bit):	7.815150077225042
Encrypted:	false
SSDEEP:	6144:MT8kDKsyI5CNkKX7QaDCsjsxzx+5xwk59j1Be3:MokDKs35e1X7TCzxx+cQ/Y
MD5:	5466A34115AB65A755ED55705B8896D3
SHA1:	15417ABF1578E08E6EB4481BC3693FA7D750CD3E
SHA-256:	7D470A1642FAF28EB0B978D6AB8CCFE2577A1AE21521047EF2EC1E5CF1645048
SHA-512:	0E61299647891CE67FB6D603E6B581BC610687D3F68E605CC857688EFE36F2E9CACB099A8E27C48AE7F12D2ECEEBDBE1EB16636B5F6DA8AE36B683ABD769CF46
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF49A45B89983BB0A7.TMP

Download File

Process:	C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	229376
Entropy (8bit):	7.55347303111672
Encrypted:	false
SSDEEP:	6144:MT8kDKsyI5CNkKX7QaDCsjsxzx+5xwk59j1B:MokDKs35e1X7TCzxx+cQ/
MD5:	A199E8FBB620A18EABB4EA75C0BF7054
SHA1:	7DD1554B4D2DCB43CDE52615E8B5C255DAD7E0C4
SHA-256:	9DB2BC2CF3AC0DCACBF05E1C18BEEFE7583F5DDC345D837E4F98F41B418E40A2
SHA-512:	60669BBD2D58637E40EFEE62D162781D5C46992FECAB1FDA1CC2193C6FB33D43F25D68C9F1B5C3964264464EFABB76C339C1E5A21D6A1E87883A69AD91E199A4
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF9084460160876095.TMP

Download File

Process:	C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	229376
Entropy (8bit):	7.815150077225042
Encrypted:	false
SSDEEP:	6144:MT8kDKsyI5CNkKX7QaDCsjsxzx+5xwk59j1Be3:MokDKs35e1X7TCzxx+cQ/Y
MD5:	5466A34115AB65A755ED55705B8896D3
SHA1:	15417ABF1578E08E6EB4481BC3693FA7D750CD3E
SHA-256:	7D470A1642FAF28EB0B978D6AB8CCFE2577A1AE21521047EF2EC1E5CF1645048
SHA-512:	0E61299647891CE67FB6D603E6B581BC610687D3F68E605CC857688EFE36F2E9CACB099A8E27C48AE7F12D2ECEEBDBE1EB16636B5F6DA8AE36B683ABD769CF46
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\System32\drivers\is-VCK25.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25928
Entropy (8bit):	6.18637440886807
Encrypted:	false
SSDEEP:	384:kHxJKo4EZvnMIMMayvbjwd0m1KJJ9NyZN3HxMr4MCPa6jfm2eMFEBns:kHxDZ+Yjm31KJJ9Nxv3meBs
MD5:	26F6761FF37E7A41E8B042059DF83843
SHA1:	359AA7AE9A76E63445D01A605B785BF0DF775B39
SHA-256:	6B582D96220FFBC2C7AA1A046891B7008AFABF1D91DB5421993579C4D6C317D7
SHA-512:	62EC5D7A919D1540EE430B21E5130E898C9C8845F709B2839A5F97FB397139994A981FAAB360DAAA1921AE2D8A2CE8117FD329B7664FB3C8089AFF3BE9456714
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......cZ..';}.';}.';}.';\|..;}.Q... ;}.Q...%;}.....$;}.....&;}.Q...&;}.....";}.....&;}.....&;}.Rich';}.................PE..d...A./Q.........."......0...........p...............................................$......................................................dp..P............`.......F..H.......$....A...............................................@...............................text...6'.......(.................. ..h.rdata.. ....@.......,..............@..H.data........P.......2..............@....pdata.......`.......6..............@..HINIT.........p.......8.............. ....rsrc................@..............@..B.reloc..`............D..............@..B........................................................................................................................................................................................................................

C:\Windows\system32\drivers\cpcs.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25928
Entropy (8bit):	6.18637440886807
Encrypted:	false
SSDEEP:	384:kHxJKo4EZvnMIMMayvbjwd0m1KJJ9NyZN3HxMr4MCPa6jfm2eMFEBns:kHxDZ+Yjm31KJJ9Nxv3meBs
MD5:	26F6761FF37E7A41E8B042059DF83843
SHA1:	359AA7AE9A76E63445D01A605B785BF0DF775B39
SHA-256:	6B582D96220FFBC2C7AA1A046891B7008AFABF1D91DB5421993579C4D6C317D7
SHA-512:	62EC5D7A919D1540EE430B21E5130E898C9C8845F709B2839A5F97FB397139994A981FAAB360DAAA1921AE2D8A2CE8117FD329B7664FB3C8089AFF3BE9456714
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......cZ..';}.';}.';}.';\|..;}.Q... ;}.Q...%;}.....$;}.....&;}.Q...&;}.....";}.....&;}.....&;}.Rich';}.................PE..d...A./Q.........."......0...........p...............................................$......................................................dp..P............`.......F..H.......$....A...............................................@...............................text...6'.......(.................. ..h.rdata.. ....@.......,..............@..H.data........P.......2..............@....pdata.......`.......6..............@..HINIT.........p.......8.............. ....rsrc................@..............@..B.reloc..`............D..............@..B........................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.999608904936307
TrID:	Win32 Executable (generic) a (10002005/4) 98.86% Inno Setup installer (109748/4) 1.08% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	chica-pc-shield-1-75-0-1300-en-win.exe
File size:	8'967'808 bytes
MD5:	1870fbe03e739325c142eacbe1667ff3
SHA1:	7b86308efbcde9175b405445179bbceb196d0f73
SHA256:	fba0337b65c15b029ee4f87b3db5fcfc6ce61a29289d9e6c58d0bcebee995ce0
SHA512:	ccef3baab4f4b0314e3e0ce0eecb3cae8424a38dd931813bb40bd05121ba25c434ffe1f33d2057b578c4aa3a5e6fb2d42b6c3d6360a3551bf1b9f7af9a583b3e
SSDEEP:	196608:N7H8qcOrHa05E8utKAcbZzchsPRt1EWZ4ufcJhANtXzrfOpa:NQ3OrHNvgK7lzw+EBuEDCzDSa
TLSH:	439633EDC095A5B1C98856758BABFF9A6E9C533248ECD9CD328C79A80B3F1F009D4705
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Static PE Info

General

Entrypoint:	0x409c40
Entrypoint Section:	CODE
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	1
OS Version Minor:	0
File Version Major:	1
File Version Minor:	0
Subsystem Version Major:	1
Subsystem Version Minor:	0
Import Hash:	884310b1928934402ea6fec1dbd3cf5e

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	23/05/2011 20:00:00 04/06/2013 19:59:59
Subject Chain	CN=Malwarebytes Corporation, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Malwarebytes Corporation, L=San Jose, S=California, C=US
Version:	3
Thumbprint MD5:	E1B30BACA0EA129562156225F2A61B51
Thumbprint SHA-1:	96D578E1B0D4854F8E870BAE1DF5CB8BAB78E124
Thumbprint SHA-256:	9EFEE65EAC008E4F64FDF30C1830C4A54A9D5C2706FEE9A9E8231ED0EC07663A
Serial:	635725F2493191F6F4F686234034FE80

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFC4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-10h], eax
mov dword ptr [ebp-24h], eax
call 00007FBFD8B6252Bh
call 00007FBFD8B63732h
call 00007FBFD8B639C1h
call 00007FBFD8B63A64h
call 00007FBFD8B65A03h
call 00007FBFD8B6836Eh
call 00007FBFD8B684D5h
xor eax, eax
push ebp
push 0040A2FCh
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 0040A2C5h
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [0040C014h]
call 00007FBFD8B68F3Bh
call 00007FBFD8B68B6Eh
lea edx, dword ptr [ebp-10h]
xor eax, eax
call 00007FBFD8B66028h
mov edx, dword ptr [ebp-10h]
mov eax, 0040CE24h
call 00007FBFD8B625D7h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [0040CE24h]
mov dl, 01h
mov eax, 0040738Ch
call 00007FBFD8B668B7h
mov dword ptr [0040CE28h], eax
xor edx, edx
push ebp
push 0040A27Dh
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007FBFD8B68FABh
mov dword ptr [0040CE30h], eax
mov eax, dword ptr [0040CE30h]
cmp dword ptr [eax+0Ch], 01h
jne 00007FBFD8B690EAh
mov eax, dword ptr [0040CE30h]
mov edx, 00000028h
call 00007FBFD8B66CB8h
mov edx, dword ptr [00000030h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd000	0x950	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x11000	0x2c00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x88bc38	0x1a48
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xf000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x9364	0x9400	e8a38c5eb0d717d3fb478c7e19f20477	False	0.6147856841216216	data	6.563139352016593	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0xb000	0x24c	0x400	5d98c64569668b0235ae89005918165a	False	0.3046875	data	2.7373065622921344	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0xc000	0xe88	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xd000	0x950	0xa00	bb5485bf968b970e5ea81292af2acdba	False	0.414453125	data	4.430733069799036	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xe000	0x8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xf000	0x18	0x200	9ba824905bf9c7922b6fc87a38b74366	False	0.052734375	data	0.2044881574398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x10000	0x8b4	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x11000	0x2c00	0x2c00	c8b70628c08dacef6e3c4870d6a9f23e	False	0.3328302556818182	data	4.527154480221984	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x11354	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Dutch	Netherlands	0.5675675675675675
RT_ICON	0x1147c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	Dutch	Netherlands	0.4486994219653179
RT_ICON	0x119e4	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Dutch	Netherlands	0.4637096774193548
RT_ICON	0x11ccc	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	Dutch	Netherlands	0.3935018050541516
RT_STRING	0x12574	0x2f2	data			0.35543766578249336
RT_STRING	0x12868	0x30c	data			0.3871794871794872
RT_STRING	0x12b74	0x2ce	data			0.42618384401114207
RT_STRING	0x12e44	0x68	data			0.75
RT_STRING	0x12eac	0xb4	data			0.6277777777777778
RT_STRING	0x12f60	0xae	data			0.5344827586206896
RT_RCDATA	0x13010	0x2c	data			1.2045454545454546
RT_GROUP_ICON	0x1303c	0x3e	data	English	United States	0.8387096774193549
RT_VERSION	0x1307c	0x4b8	COM executable for DOS	English	United States	0.3344370860927152
RT_MANIFEST	0x13534	0x5a4	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.42590027700831024

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, WideCharToMultiByte, TlsSetValue, TlsGetValue, MultiByteToWideChar, GetModuleHandleA, GetLastError, GetCommandLineA, WriteFile, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetSystemTime, GetFileType, ExitProcess, CreateFileA, CloseHandle
user32.dll	MessageBoxA
oleaut32.dll	VariantChangeTypeEx, VariantCopyInd, VariantClear, SysStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA
kernel32.dll	WriteFile, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, Sleep, SizeofResource, SetLastError, SetFilePointer, SetErrorMode, SetEndOfFile, RemoveDirectoryA, ReadFile, LockResource, LoadResource, LoadLibraryA, IsDBCSLeadByte, GetWindowsDirectoryA, GetVersionExA, GetUserDefaultLangID, GetSystemInfo, GetSystemDefaultLCID, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeProcess, GetEnvironmentVariableA, GetCurrentProcess, GetCommandLineA, GetACP, InterlockedExchange, FormatMessageA, FindResourceA, DeleteFileA, CreateProcessA, CreateFileA, CreateDirectoryA, CloseHandle
user32.dll	TranslateMessage, SetWindowLongA, PeekMessageA, MsgWaitForMultipleObjects, MessageBoxA, LoadStringA, ExitWindowsEx, DispatchMessageA, DestroyWindow, CreateWindowExA, CallWindowProcA, CharPrevA
comctl32.dll	InitCommonControls
advapi32.dll	AdjustTokenPrivileges

Possible Origin

Language of compilation system	Country where language is spoken	Map
Dutch	Netherlands
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 16:58:06.262907982 CET	49915	80	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:06.268697977 CET	80	49915	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:06.268809080 CET	49915	80	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:06.269777060 CET	49915	80	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:06.275378942 CET	80	49915	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:07.109765053 CET	80	49915	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:07.113111973 CET	49921	443	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:07.113152027 CET	443	49921	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:07.113334894 CET	49921	443	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:07.113486052 CET	49921	443	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:07.113502026 CET	443	49921	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:07.192919970 CET	49915	80	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:07.226910114 CET	80	49915	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:07.226988077 CET	49915	80	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:07.992438078 CET	443	49921	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:07.992582083 CET	49921	443	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:07.997845888 CET	49921	443	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:07.997859001 CET	443	49921	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:07.998087883 CET	443	49921	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:07.998140097 CET	49921	443	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:08.001452923 CET	49921	443	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:08.017810106 CET	49915	80	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:08.023252010 CET	80	49915	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:08.477693081 CET	49928	80	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:08.483076096 CET	80	49928	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:08.483166933 CET	49928	80	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:08.484103918 CET	49928	80	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:08.489578009 CET	80	49928	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:09.317945957 CET	80	49928	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:09.321659088 CET	49933	443	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:09.321687937 CET	443	49933	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:09.321779966 CET	49933	443	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:09.333846092 CET	49933	443	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:09.333862066 CET	443	49933	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:09.364865065 CET	49928	80	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:09.437561035 CET	80	49928	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:09.437661886 CET	49928	80	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:10.177403927 CET	443	49933	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:10.177541971 CET	49933	443	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:10.177990913 CET	49933	443	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:10.177998066 CET	443	49933	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:10.178139925 CET	49933	443	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:10.179524899 CET	49928	80	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:10.185012102 CET	80	49928	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:10.305924892 CET	49939	80	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:10.311453104 CET	80	49939	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:10.311521053 CET	49939	80	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:10.313683987 CET	49939	80	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:10.319257021 CET	80	49939	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:11.153893948 CET	80	49939	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:11.170835018 CET	49945	443	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:11.170871019 CET	443	49945	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:11.170942068 CET	49945	443	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:11.172338963 CET	49945	443	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:11.172348022 CET	443	49945	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:11.208540916 CET	49939	80	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:11.272866011 CET	80	49939	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:11.272995949 CET	49939	80	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:12.021594048 CET	443	49945	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:12.021656990 CET	49945	443	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:12.022048950 CET	49945	443	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:12.022066116 CET	443	49945	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:12.022370100 CET	49945	443	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:12.023361921 CET	49939	80	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:12.028939962 CET	80	49939	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:12.114260912 CET	49951	80	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:12.440874100 CET	80	49951	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:12.440962076 CET	49951	80	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:12.442065001 CET	49951	80	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:12.447560072 CET	80	49951	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:13.286956072 CET	80	49951	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:13.291567087 CET	49957	443	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:13.291616917 CET	443	49957	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:13.291713953 CET	49957	443	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:13.291913986 CET	49957	443	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:13.291924000 CET	443	49957	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:13.333544016 CET	49951	80	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:13.406924009 CET	80	49951	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:13.407032013 CET	49951	80	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:14.153090954 CET	443	49957	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:14.153199911 CET	49957	443	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:14.153536081 CET	49957	443	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:14.153548002 CET	443	49957	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:14.153649092 CET	49957	443	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:14.154844999 CET	49951	80	192.168.2.5	65.9.66.84
Oct 30, 2024 16:58:14.160202026 CET	80	49951	65.9.66.84	192.168.2.5
Oct 30, 2024 16:58:27.588076115 CET	49994	80	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:27.593462944 CET	80	49994	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:27.593530893 CET	49994	80	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:27.594381094 CET	49994	80	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:27.599817038 CET	80	49994	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:28.628958941 CET	80	49994	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:28.630316019 CET	80	49994	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:28.630393028 CET	49994	80	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:28.630403042 CET	80	49994	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:28.630439997 CET	49994	80	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:28.632875919 CET	49995	443	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:28.632904053 CET	443	49995	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:28.632978916 CET	49995	443	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:28.633112907 CET	49995	443	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:28.633126974 CET	443	49995	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:29.477541924 CET	443	49995	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:29.477629900 CET	49995	443	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:29.478230953 CET	49995	443	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:29.478240967 CET	443	49995	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:29.478389978 CET	49995	443	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:29.478393078 CET	443	49995	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:29.478441954 CET	49995	443	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:29.479763031 CET	49994	80	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:29.485383034 CET	80	49994	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:29.607661963 CET	49996	80	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:29.613166094 CET	80	49996	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:29.613400936 CET	49996	80	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:29.614396095 CET	49996	80	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:29.619841099 CET	80	49996	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:30.446577072 CET	80	49996	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:30.450289965 CET	49997	443	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:30.450321913 CET	443	49997	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:30.450390100 CET	49997	443	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:30.450529099 CET	49997	443	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:30.450541019 CET	443	49997	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:30.489854097 CET	49996	80	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:30.572948933 CET	80	49996	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:30.573034048 CET	49996	80	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:31.292285919 CET	443	49997	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:31.292432070 CET	49997	443	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:31.292826891 CET	49997	443	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:31.292839050 CET	443	49997	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:31.292958975 CET	49997	443	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:31.294203997 CET	49996	80	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:31.299519062 CET	80	49996	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:31.369019985 CET	49998	80	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:31.374610901 CET	80	49998	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:31.374696970 CET	49998	80	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:31.375678062 CET	49998	80	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:31.381014109 CET	80	49998	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:32.204783916 CET	80	49998	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:32.208282948 CET	49999	443	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:32.208343983 CET	443	49999	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:32.208422899 CET	49999	443	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:32.208605051 CET	49999	443	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:32.208625078 CET	443	49999	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:32.255639076 CET	49998	80	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:32.324404001 CET	80	49998	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:32.324482918 CET	49998	80	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:33.056402922 CET	443	49999	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:33.056569099 CET	49999	443	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:33.056994915 CET	49999	443	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:33.057007074 CET	443	49999	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:33.057137012 CET	49999	443	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:33.058271885 CET	49998	80	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:33.063725948 CET	80	49998	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:33.133497000 CET	50000	80	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:33.139131069 CET	80	50000	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:33.139220953 CET	50000	80	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:33.140016079 CET	50000	80	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:33.145344973 CET	80	50000	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:33.968961954 CET	80	50000	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:33.972255945 CET	50001	443	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:33.972301960 CET	443	50001	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:33.972395897 CET	50001	443	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:33.974309921 CET	50001	443	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:33.974323988 CET	443	50001	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:34.021059036 CET	50000	80	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:34.088640928 CET	80	50000	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:34.088705063 CET	50000	80	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:34.821316957 CET	443	50001	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:34.821392059 CET	50001	443	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:34.825154066 CET	50001	443	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:34.825165033 CET	443	50001	65.9.66.107	192.168.2.5
Oct 30, 2024 16:58:34.825268030 CET	50001	443	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:34.850488901 CET	50000	80	192.168.2.5	65.9.66.107
Oct 30, 2024 16:58:34.855950117 CET	80	50000	65.9.66.107	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 16:57:56.760685921 CET	56162	53	192.168.2.5	1.1.1.1
Oct 30, 2024 16:57:56.798024893 CET	53	56162	1.1.1.1	192.168.2.5
Oct 30, 2024 16:58:05.677694082 CET	56797	53	192.168.2.5	1.1.1.1
Oct 30, 2024 16:58:05.804199934 CET	53	56797	1.1.1.1	192.168.2.5
Oct 30, 2024 16:58:06.243360043 CET	63383	53	192.168.2.5	1.1.1.1
Oct 30, 2024 16:58:06.252377033 CET	53	63383	1.1.1.1	192.168.2.5
Oct 30, 2024 16:58:08.214833021 CET	63658	53	192.168.2.5	1.1.1.1
Oct 30, 2024 16:58:08.240667105 CET	53	63658	1.1.1.1	192.168.2.5
Oct 30, 2024 16:58:08.261063099 CET	58616	53	192.168.2.5	1.1.1.1
Oct 30, 2024 16:58:08.313143015 CET	53	58616	1.1.1.1	192.168.2.5
Oct 30, 2024 16:58:08.328507900 CET	57208	53	192.168.2.5	1.1.1.1
Oct 30, 2024 16:58:08.354501009 CET	53	57208	1.1.1.1	192.168.2.5
Oct 30, 2024 16:58:14.162930965 CET	53952	53	192.168.2.5	1.1.1.1
Oct 30, 2024 16:58:14.177217007 CET	53	53952	1.1.1.1	192.168.2.5
Oct 30, 2024 16:58:14.185138941 CET	55376	53	192.168.2.5	1.1.1.1
Oct 30, 2024 16:58:14.226819038 CET	53	55376	1.1.1.1	192.168.2.5
Oct 30, 2024 16:58:14.235162973 CET	62661	53	192.168.2.5	1.1.1.1
Oct 30, 2024 16:58:14.252624035 CET	53	62661	1.1.1.1	192.168.2.5
Oct 30, 2024 16:58:16.911119938 CET	62286	53	192.168.2.5	1.1.1.1
Oct 30, 2024 16:58:17.035631895 CET	53	62286	1.1.1.1	192.168.2.5
Oct 30, 2024 16:58:24.956726074 CET	57150	53	192.168.2.5	1.1.1.1
Oct 30, 2024 16:58:24.991597891 CET	53	57150	1.1.1.1	192.168.2.5
Oct 30, 2024 16:58:27.562947035 CET	51183	53	192.168.2.5	1.1.1.1
Oct 30, 2024 16:58:27.580851078 CET	53	51183	1.1.1.1	192.168.2.5
Oct 30, 2024 16:58:29.487251997 CET	54938	53	192.168.2.5	1.1.1.1
Oct 30, 2024 16:58:29.505378008 CET	53	54938	1.1.1.1	192.168.2.5
Oct 30, 2024 16:58:29.513526917 CET	49886	53	192.168.2.5	1.1.1.1
Oct 30, 2024 16:58:29.535346031 CET	53	49886	1.1.1.1	192.168.2.5
Oct 30, 2024 16:58:29.543807983 CET	55559	53	192.168.2.5	1.1.1.1
Oct 30, 2024 16:58:29.561161041 CET	53	55559	1.1.1.1	192.168.2.5
Oct 30, 2024 16:58:34.878112078 CET	49602	53	192.168.2.5	1.1.1.1
Oct 30, 2024 16:58:34.915891886 CET	53	49602	1.1.1.1	192.168.2.5
Oct 30, 2024 16:58:34.925713062 CET	62794	53	192.168.2.5	1.1.1.1
Oct 30, 2024 16:58:34.966917038 CET	53	62794	1.1.1.1	192.168.2.5
Oct 30, 2024 16:58:34.974634886 CET	56914	53	192.168.2.5	1.1.1.1
Oct 30, 2024 16:58:34.991583109 CET	53	56914	1.1.1.1	192.168.2.5
Oct 30, 2024 16:58:38.216120005 CET	58902	53	192.168.2.5	1.1.1.1
Oct 30, 2024 16:58:38.271272898 CET	53	58902	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 30, 2024 16:57:56.760685921 CET	192.168.2.5	1.1.1.1	0x68ec	Standard query (0)	stats.mbamupdates.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:05.677694082 CET	192.168.2.5	1.1.1.1	0x9b26	Standard query (0)	stats.mbamupdates.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:06.243360043 CET	192.168.2.5	1.1.1.1	0x4f73	Standard query (0)	data-cdn.mbamupdates.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:08.214833021 CET	192.168.2.5	1.1.1.1	0xe57e	Standard query (0)	edge.data-cdn.mbamupdates.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:08.261063099 CET	192.168.2.5	1.1.1.1	0x9ad6	Standard query (0)	hw.data-cdn.mbamupdates.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:08.328507900 CET	192.168.2.5	1.1.1.1	0x9743	Standard query (0)	llnw.data-cdn.mbamupdates.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:14.162930965 CET	192.168.2.5	1.1.1.1	0x1975	Standard query (0)	edge.data-cdn.mbamupdates.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:14.185138941 CET	192.168.2.5	1.1.1.1	0x84a3	Standard query (0)	hw.data-cdn.mbamupdates.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:14.235162973 CET	192.168.2.5	1.1.1.1	0x1c23	Standard query (0)	llnw.data-cdn.mbamupdates.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:16.911119938 CET	192.168.2.5	1.1.1.1	0x103f	Standard query (0)	stats.mbamupdates.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:24.956726074 CET	192.168.2.5	1.1.1.1	0x2932	Standard query (0)	stats.mbamupdates.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:27.562947035 CET	192.168.2.5	1.1.1.1	0x138d	Standard query (0)	data-cdn.mbamupdates.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:29.487251997 CET	192.168.2.5	1.1.1.1	0x9229	Standard query (0)	edge.data-cdn.mbamupdates.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:29.513526917 CET	192.168.2.5	1.1.1.1	0xb56	Standard query (0)	hw.data-cdn.mbamupdates.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:29.543807983 CET	192.168.2.5	1.1.1.1	0xe722	Standard query (0)	llnw.data-cdn.mbamupdates.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:34.878112078 CET	192.168.2.5	1.1.1.1	0x2bdc	Standard query (0)	edge.data-cdn.mbamupdates.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:34.925713062 CET	192.168.2.5	1.1.1.1	0xa145	Standard query (0)	hw.data-cdn.mbamupdates.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:34.974634886 CET	192.168.2.5	1.1.1.1	0x5103	Standard query (0)	llnw.data-cdn.mbamupdates.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:38.216120005 CET	192.168.2.5	1.1.1.1	0xbbde	Standard query (0)	stats.mbamupdates.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 30, 2024 16:57:56.798024893 CET	1.1.1.1	192.168.2.5	0x68ec	No error (0)	stats.mbamupdates.com	legacy-telemetry.malwarebytes.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 16:58:05.804199934 CET	1.1.1.1	192.168.2.5	0x9b26	No error (0)	stats.mbamupdates.com	legacy-telemetry.malwarebytes.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 16:58:06.252377033 CET	1.1.1.1	192.168.2.5	0x4f73	No error (0)	data-cdn.mbamupdates.com		65.9.66.84	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:06.252377033 CET	1.1.1.1	192.168.2.5	0x4f73	No error (0)	data-cdn.mbamupdates.com		65.9.66.85	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:06.252377033 CET	1.1.1.1	192.168.2.5	0x4f73	No error (0)	data-cdn.mbamupdates.com		65.9.66.107	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:06.252377033 CET	1.1.1.1	192.168.2.5	0x4f73	No error (0)	data-cdn.mbamupdates.com		65.9.66.47	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:08.240667105 CET	1.1.1.1	192.168.2.5	0xe57e	Name error (3)	edge.data-cdn.mbamupdates.com	none	none	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:08.313143015 CET	1.1.1.1	192.168.2.5	0x9ad6	Name error (3)	hw.data-cdn.mbamupdates.com	none	none	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:08.354501009 CET	1.1.1.1	192.168.2.5	0x9743	Name error (3)	llnw.data-cdn.mbamupdates.com	none	none	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:14.177217007 CET	1.1.1.1	192.168.2.5	0x1975	Name error (3)	edge.data-cdn.mbamupdates.com	none	none	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:14.226819038 CET	1.1.1.1	192.168.2.5	0x84a3	Name error (3)	hw.data-cdn.mbamupdates.com	none	none	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:14.252624035 CET	1.1.1.1	192.168.2.5	0x1c23	Name error (3)	llnw.data-cdn.mbamupdates.com	none	none	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:17.035631895 CET	1.1.1.1	192.168.2.5	0x103f	No error (0)	stats.mbamupdates.com	legacy-telemetry.malwarebytes.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 16:58:24.991597891 CET	1.1.1.1	192.168.2.5	0x2932	No error (0)	stats.mbamupdates.com	legacy-telemetry.malwarebytes.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 16:58:27.580851078 CET	1.1.1.1	192.168.2.5	0x138d	No error (0)	data-cdn.mbamupdates.com		65.9.66.107	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:27.580851078 CET	1.1.1.1	192.168.2.5	0x138d	No error (0)	data-cdn.mbamupdates.com		65.9.66.47	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:27.580851078 CET	1.1.1.1	192.168.2.5	0x138d	No error (0)	data-cdn.mbamupdates.com		65.9.66.85	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:27.580851078 CET	1.1.1.1	192.168.2.5	0x138d	No error (0)	data-cdn.mbamupdates.com		65.9.66.84	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:29.505378008 CET	1.1.1.1	192.168.2.5	0x9229	Name error (3)	edge.data-cdn.mbamupdates.com	none	none	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:29.535346031 CET	1.1.1.1	192.168.2.5	0xb56	Name error (3)	hw.data-cdn.mbamupdates.com	none	none	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:29.561161041 CET	1.1.1.1	192.168.2.5	0xe722	Name error (3)	llnw.data-cdn.mbamupdates.com	none	none	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:34.915891886 CET	1.1.1.1	192.168.2.5	0x2bdc	Name error (3)	edge.data-cdn.mbamupdates.com	none	none	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:34.966917038 CET	1.1.1.1	192.168.2.5	0xa145	Name error (3)	hw.data-cdn.mbamupdates.com	none	none	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:34.991583109 CET	1.1.1.1	192.168.2.5	0x5103	Name error (3)	llnw.data-cdn.mbamupdates.com	none	none	A (IP address)	IN (0x0001)	false
Oct 30, 2024 16:58:38.271272898 CET	1.1.1.1	192.168.2.5	0xbbde	No error (0)	stats.mbamupdates.com	legacy-telemetry.malwarebytes.com		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

data-cdn.mbamupdates.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49915	65.9.66.84	80	5440	C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 16:58:06.269777060 CET	213	OUT	GET /v1/config/chicalogic/version.chk HTTP/1.1 Accept-Encoding: gzip Connection: Close Host: data-cdn.mbamupdates.com User-Agent: mbam - chicalogic_trial (scanner) - base:1.75.0.1300 - rules:v2013.04.04.07
Oct 30, 2024 16:58:07.109765053 CET	601	IN	HTTP/1.1 301 Moved Permanently Server: CloudFront Date: Wed, 30 Oct 2024 15:58:06 GMT Content-Type: text/html Content-Length: 167 Connection: close Location: https://data-cdn.mbamupdates.com/v1/config/chicalogic/version.chk X-Cache: Redirect from cloudfront Via: 1.1 cae542650fb32c773cc494fc6e7e71e6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-C1 X-Amz-Cf-Id: RwDeUTmEDQY8g-_8QNMAWuJOrNIJeqkKUJB0NNhfh_gH0x3RUAjzPQ== Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>CloudFront</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49928	65.9.66.84	80	5440	C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 16:58:08.484103918 CET	211	OUT	GET /v1/news/chicalogic/version.chk HTTP/1.1 Accept-Encoding: gzip Connection: Close Host: data-cdn.mbamupdates.com User-Agent: mbam - chicalogic_trial (scanner) - base:1.75.0.1300 - rules:v2013.04.04.07
Oct 30, 2024 16:58:09.317945957 CET	599	IN	HTTP/1.1 301 Moved Permanently Server: CloudFront Date: Wed, 30 Oct 2024 15:58:09 GMT Content-Type: text/html Content-Length: 167 Connection: close Location: https://data-cdn.mbamupdates.com/v1/news/chicalogic/version.chk X-Cache: Redirect from cloudfront Via: 1.1 120ade321ed0e3697c81eb1eb19b5f62.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-C1 X-Amz-Cf-Id: gX1pBN0L5qOw-8JRuoRlWw5kfT9q_YMWuQ6RY_PBwmq8t4cOt6AwDg== Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>CloudFront</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49939	65.9.66.84	80	5440	C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 16:58:10.313683987 CET	213	OUT	GET /v1/custom/chicalogic/version.chk HTTP/1.1 Accept-Encoding: gzip Connection: Close Host: data-cdn.mbamupdates.com User-Agent: mbam - chicalogic_trial (scanner) - base:1.75.0.1300 - rules:v2013.04.04.07
Oct 30, 2024 16:58:11.153893948 CET	601	IN	HTTP/1.1 301 Moved Permanently Server: CloudFront Date: Wed, 30 Oct 2024 15:58:11 GMT Content-Type: text/html Content-Length: 167 Connection: close Location: https://data-cdn.mbamupdates.com/v1/custom/chicalogic/version.chk X-Cache: Redirect from cloudfront Via: 1.1 36d9e1bd4f00d39c57a56679dc44e264.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-C1 X-Amz-Cf-Id: 0gc7n3i0exkkZ7vNK4_GAoMUbdOAtlGAdJ3kMe0XGaF5yOHNTAKfWQ== Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>CloudFront</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49951	65.9.66.84	80	5440	C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 16:58:12.442065001 CET	221	OUT	GET /v0/clients/chicalogic/mbam.check.program HTTP/1.1 Accept-Encoding: gzip Connection: Close Host: data-cdn.mbamupdates.com User-Agent: mbam - chicalogic_trial (scanner) - base:1.75.0.1300 - rules:v2013.04.04.07
Oct 30, 2024 16:58:13.286956072 CET	609	IN	HTTP/1.1 301 Moved Permanently Server: CloudFront Date: Wed, 30 Oct 2024 15:58:13 GMT Content-Type: text/html Content-Length: 167 Connection: close Location: https://data-cdn.mbamupdates.com/v0/clients/chicalogic/mbam.check.program X-Cache: Redirect from cloudfront Via: 1.1 95e0c26862caa0a0aa5e9580919524f8.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-C1 X-Amz-Cf-Id: 0pl4kPGhdyPZ7Zv2xOItIyL_q_0-yMP7IZOOzBv3sA4CBgKSbwaHpA== Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>CloudFront</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49994	65.9.66.107	80	3472	C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 16:58:27.594381094 CET	213	OUT	GET /v1/config/chicalogic/version.chk HTTP/1.1 Accept-Encoding: gzip Connection: Close Host: data-cdn.mbamupdates.com User-Agent: mbam - chicalogic_trial (scanner) - base:1.75.0.1300 - rules:v2013.04.04.07
Oct 30, 2024 16:58:28.628958941 CET	601	IN	HTTP/1.1 301 Moved Permanently Server: CloudFront Date: Wed, 30 Oct 2024 15:58:28 GMT Content-Type: text/html Content-Length: 167 Connection: close Location: https://data-cdn.mbamupdates.com/v1/config/chicalogic/version.chk X-Cache: Redirect from cloudfront Via: 1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-C1 X-Amz-Cf-Id: sZmqCTCGdETUb6pxVxGHq1lTkgEd6wRL52p8wQaYoYfKh6qTyA0DiA== Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>CloudFront</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49996	65.9.66.107	80	3472	C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 16:58:29.614396095 CET	211	OUT	GET /v1/news/chicalogic/version.chk HTTP/1.1 Accept-Encoding: gzip Connection: Close Host: data-cdn.mbamupdates.com User-Agent: mbam - chicalogic_trial (scanner) - base:1.75.0.1300 - rules:v2013.04.04.07
Oct 30, 2024 16:58:30.446577072 CET	599	IN	HTTP/1.1 301 Moved Permanently Server: CloudFront Date: Wed, 30 Oct 2024 15:58:30 GMT Content-Type: text/html Content-Length: 167 Connection: close Location: https://data-cdn.mbamupdates.com/v1/news/chicalogic/version.chk X-Cache: Redirect from cloudfront Via: 1.1 2fc0d20914c32e5cd76477ed042298d0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-C1 X-Amz-Cf-Id: JL44E_jV1YbmPixQwhwmn2w5DY8Qa2ZIcBcMB5FlIOTUeyvw-9Wjvg== Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>CloudFront</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49998	65.9.66.107	80	3472	C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 16:58:31.375678062 CET	213	OUT	GET /v1/custom/chicalogic/version.chk HTTP/1.1 Accept-Encoding: gzip Connection: Close Host: data-cdn.mbamupdates.com User-Agent: mbam - chicalogic_trial (scanner) - base:1.75.0.1300 - rules:v2013.04.04.07
Oct 30, 2024 16:58:32.204783916 CET	601	IN	HTTP/1.1 301 Moved Permanently Server: CloudFront Date: Wed, 30 Oct 2024 15:58:32 GMT Content-Type: text/html Content-Length: 167 Connection: close Location: https://data-cdn.mbamupdates.com/v1/custom/chicalogic/version.chk X-Cache: Redirect from cloudfront Via: 1.1 b3dc72c60418e8887de31f772538f118.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-C1 X-Amz-Cf-Id: qBT2PM10OVQHLQ1zMkEWN8M3jFSTxOGD_zxFqw29RVegebmDzkeCzg== Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>CloudFront</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	50000	65.9.66.107	80	3472	C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 16:58:33.140016079 CET	221	OUT	GET /v0/clients/chicalogic/mbam.check.program HTTP/1.1 Accept-Encoding: gzip Connection: Close Host: data-cdn.mbamupdates.com User-Agent: mbam - chicalogic_trial (scanner) - base:1.75.0.1300 - rules:v2013.04.04.07
Oct 30, 2024 16:58:33.968961954 CET	609	IN	HTTP/1.1 301 Moved Permanently Server: CloudFront Date: Wed, 30 Oct 2024 15:58:33 GMT Content-Type: text/html Content-Length: 167 Connection: close Location: https://data-cdn.mbamupdates.com/v0/clients/chicalogic/mbam.check.program X-Cache: Redirect from cloudfront Via: 1.1 6def1f0ddc805dce17407cce01d5b32c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-C1 X-Amz-Cf-Id: E-khktZr2EkGV8rDfDZd6p1_uhFmm6TmZfj8Ir5Kr9jnMwQbEbmPvA== Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>CloudFront</center></body></html>

Target ID:	0
Start time:	11:57:01
Start date:	30/10/2024
Path:	C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe"
Imagebase:	0x400000
File size:	8'967'808 bytes
MD5 hash:	1870FBE03E739325C142EACBE1667FF3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:57:01
Start date:	30/10/2024
Path:	C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-LBG9E.tmp\chica-pc-shield-1-75-0-1300-en-win.tmp" /SL5="$20430,8630815,54272,C:\Users\user\Desktop\chica-pc-shield-1-75-0-1300-en-win.exe"
Imagebase:	0x400000
File size:	712'264 bytes
MD5 hash:	C2BE7988C8762E314534B2908C4D6E49
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 4%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:57:40
Start date:	30/10/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\mbamext.dll"
Imagebase:	0x7ff7c4160000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:57:42
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\ssubtmr6.dll"
Imagebase:	0xb40000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:57:42
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\vbalsgrid6.ocx"
Imagebase:	0xb40000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:57:47
Start date:	30/10/2024
Path:	C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe" /starttrial
Imagebase:	0x400000
File size:	973'448 bytes
MD5 hash:	064E37783673E0094DAE704513F29393
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: thequickbrow_APT1, Description: unknown, Source: 00000009.00000003.2529281722.0000000009BA5000.00000004.00000020.00020000.00000000.sdmp, Author: AlienVault Labs Rule: xtremrat, Description: Xtrem RAT v3.5, Source: 00000009.00000003.2546777163.000000000C828000.00000004.00000020.00020000.00000000.sdmp, Author: Jean-Philippe Teissier / @Jipe_ Rule: xtremrat, Description: Xtrem RAT v3.5, Source: 00000009.00000003.2545861202.000000000D4FA000.00000004.00000020.00020000.00000000.sdmp, Author: Jean-Philippe Teissier / @Jipe_ Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: clearlog, Description: Detects Fireball malware - file clearlog.dll, Source: 00000009.00000003.2556561426.0000000008334000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:57:47
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	regsvr32.exe /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\ssubtmr6.dll"
Imagebase:	0xb40000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:57:48
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	regsvr32.exe /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\vbalsgrid6.ocx"
Imagebase:	0xb40000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	11:57:54
Start date:	30/10/2024
Path:	C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe" /install /silent
Imagebase:	0x5b0000
File size:	788'040 bytes
MD5 hash:	9CC7642A4825E87C9EACB29391279F43
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	11:57:54
Start date:	30/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	11:57:56
Start date:	30/10/2024
Path:	C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe"
Imagebase:	0x8e0000
File size:	418'376 bytes
MD5 hash:	C56F757EB2A6D9B850FAD5F075008A57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	11:57:57
Start date:	30/10/2024
Path:	C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe" /update
Imagebase:	0x400000
File size:	973'448 bytes
MD5 hash:	064E37783673E0094DAE704513F29393
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GhostRat, Description: Yara detected GhostRat, Source: 0000000F.00000003.2652428311.0000000004663000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 0000000F.00000003.2652428311.0000000004663000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: APT9002Strings, Description: 9002 Identifying Strings, Source: 0000000F.00000003.2652428311.0000000004663000.00000004.00000020.00020000.00000000.sdmp, Author: Seth Hardy Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 0000000F.00000003.2648389472.0000000008271000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: clearlog, Description: Detects Fireball malware - file clearlog.dll, Source: 0000000F.00000003.2648389472.0000000008271000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	11:57:57
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	regsvr32.exe /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\ssubtmr6.dll"
Imagebase:	0xb40000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	11:57:57
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	regsvr32.exe /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\vbalsgrid6.ocx"
Imagebase:	0xb40000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	11:58:16
Start date:	30/10/2024
Path:	C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcs.exe"
Imagebase:	0x400000
File size:	973'448 bytes
MD5 hash:	064E37783673E0094DAE704513F29393
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: xtremrat, Description: Xtrem RAT v3.5, Source: 00000012.00000003.2839561000.000000000CFD9000.00000004.00000020.00020000.00000000.sdmp, Author: Jean-Philippe Teissier / @Jipe_ Rule: xtremrat, Description: Xtrem RAT v3.5, Source: 00000012.00000003.2839681114.000000000D42B000.00000004.00000020.00020000.00000000.sdmp, Author: Jean-Philippe Teissier / @Jipe_ Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000012.00000003.2843530652.000000000847A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: clearlog, Description: Detects Fireball malware - file clearlog.dll, Source: 00000012.00000003.2843530652.000000000847A000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	11:58:16
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	regsvr32.exe /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\ssubtmr6.dll"
Imagebase:	0xb40000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	11:58:17
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	regsvr32.exe /s "C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\vbalsgrid6.ocx"
Imagebase:	0xb40000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	23%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.5%
Total number of Nodes:	1451
Total number of Limit Nodes:	26

Executed Functions

Function 00409B30 Relevance: 7.6, APIs: 5, Instructions: 78
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 00409B42
VirtualQuery.KERNEL32(00400000,?,0000001C,?), ref: 00409B4D
VirtualProtect.KERNEL32(?,?,00000040,?,00400000,?,0000001C,?), ref: 00409B8E
VirtualProtect.KERNEL32(?,?,?,?,?,?,00000040,?,00400000,?,0000001C,?), ref: 00409BC0
VirtualQuery.KERNEL32(?,?,0000001C,00400000,?,0000001C,?), ref: 00409BD0

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Virtual$ProtectQuery$InfoSystem
String ID:
API String ID: 2441996862-0
Opcode ID: 9fe1c1492d4e2c4f54cecc4c125b8c20c153f3aea56d010d52fe367946264e59
Instruction ID: 3002c4020e31fcb34e6ffc2d5983d7aa910ebdc8277ab133fd4bc27d875cdae8
Opcode Fuzzy Hash: 9fe1c1492d4e2c4f54cecc4c125b8c20c153f3aea56d010d52fe367946264e59
Instruction Fuzzy Hash: F4219DB12003046BD7709AA99C85E5777E9EB85370F04082BFA89E32D3D239FC40C669

Function 0040520C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052D7,?,00000000,004053B6), ref: 0040522A

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 08facca5f8c818d7ae0117448837c5e97f15c9e55cb3aedc2694e0bc5091a832
Instruction ID: 1248db9972fbf410c55bf070b604c98f5d62b90992f8f49b6b6440a9954d2c50
Opcode Fuzzy Hash: 08facca5f8c818d7ae0117448837c5e97f15c9e55cb3aedc2694e0bc5091a832
Instruction Fuzzy Hash: E2E0927170021427D710A9A99C86AEB725CEB58310F0002BFB904E73C6EDB49E804AED

Function 0040457C Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 27
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,00409C60), ref: 00404582
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040458F
GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 004045A5
GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 004045BB
SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,00409C60), ref: 004045C6

Strings

SetSearchPathMode, xrefs: 0040459F
SetDllDirectoryW, xrefs: 00404589
kernel32.dll, xrefs: 0040457D
SetProcessDEPPolicy, xrefs: 004045B5

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressProc$HandleModulePolicyProcess
String ID: SetDllDirectoryW$SetProcessDEPPolicy$SetSearchPathMode$kernel32.dll
API String ID: 3256987805-3653653586
Opcode ID: 5152b1c660b0fef0348360efae9d442e0d6811f491f57bfacbbc157bf84edc67
Instruction ID: 1f393095ee8ecda9e1e01b6ca7d440447e938bbc9796bcd5dbe8d266940e5f64
Opcode Fuzzy Hash: 5152b1c660b0fef0348360efae9d442e0d6811f491f57bfacbbc157bf84edc67
Instruction Fuzzy Hash: 5FE02DD03813013AEA5032F20D83B2B20884AD0B49B2414377F25B61C3EDBDDA40587E

Function 0040A0E7 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32 ref: 0040A0F4

Part of subcall function 00409648: GetLastError.KERNEL32(00000000,004096EB,?,0040B240,?,020F0EAC), ref: 0040966C

CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040A131
SetWindowLongA.USER32(00020430,000000FC,00409918), ref: 0040A148
RemoveDirectoryA.KERNEL32(00000000,0040A287,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A234
DestroyWindow.USER32(00020430,0040A287,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A248

Strings

STATIC, xrefs: 0040A12A
/SL5="$%x,%d,%d,, xrefs: 0040A188
InnoSetupLdrWindow, xrefs: 0040A125

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Window$ErrorLast$CreateDestroyDirectoryLongRemove
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 3757039580-3001827809
Opcode ID: 92d7a146f7fa7ea583be229cf1972f4387f7e731d45899e9009fd1a518b8a977
Instruction ID: f6a9afe5b3848034850d92184c83b7d566fc641e007638e18ad9d31f508a71de
Opcode Fuzzy Hash: 92d7a146f7fa7ea583be229cf1972f4387f7e731d45899e9009fd1a518b8a977
Instruction Fuzzy Hash: 3B411071600204DFD710EBA9EE86B9977A4EB45304F10467EF514B73E2C7B89811CB9D

Function 004090A4 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,0040913D,?,?,?,?,00000000,?,00409C74), ref: 004090C4
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004090CA
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,0040913D,?,?,?,?,00000000,?,00409C74), ref: 004090DE
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004090E4

Strings

kernel32.dll, xrefs: 004090BF, 004090D9
Wow64RevertWow64FsRedirection, xrefs: 004090D4
Wow64DisableWow64FsRedirection, xrefs: 004090BA
shell32.dll, xrefs: 00409110

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: acfb4439f313785c2c2b120c37d6defef782ad7ac64c67e7eba3e924cf2abd75
Instruction ID: 4a4222b704d734fa8d0781b40c04fe9f9c76e7b4f133337d95099c0c8a01123f
Opcode Fuzzy Hash: acfb4439f313785c2c2b120c37d6defef782ad7ac64c67e7eba3e924cf2abd75
Instruction Fuzzy Hash: 20017170748342AEFB00BB72DD4AB163A68E785704F50457BF5407A2D3DABD4C04DA6D

Function 0040A0D5 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040A131
SetWindowLongA.USER32(00020430,000000FC,00409918), ref: 0040A148

Part of subcall function 00406B7C: GetCommandLineA.KERNEL32(00000000,00406BC0,?,?,?,?,00000000,?,0040A1B9,?), ref: 00406B94

Part of subcall function 004099A4: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A9C,020F0EAC,00409A90,00000000,00409A77), ref: 00409A14
Part of subcall function 004099A4: CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A9C,020F0EAC,00409A90,00000000), ref: 00409A28
Part of subcall function 004099A4: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409A41
Part of subcall function 004099A4: GetExitCodeProcess.KERNEL32(?,0040B240), ref: 00409A53
Part of subcall function 004099A4: CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A9C,020F0EAC,00409A90), ref: 00409A5C

RemoveDirectoryA.KERNEL32(00000000,0040A287,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A234
DestroyWindow.USER32(00020430,0040A287,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A248

Strings

STATIC, xrefs: 0040A12A
/SL5="$%x,%d,%d,, xrefs: 0040A188
InnoSetupLdrWindow, xrefs: 0040A125

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Window$CloseCreateHandleProcess$CodeCommandDestroyDirectoryExitLineLongMultipleObjectsRemoveWait
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 3586484885-3001827809
Opcode ID: a64027cc69530ce26e0d020b421cb23cd984c73ff13cd53596b8d38fe4c4ed4c
Instruction ID: bf8877be64b1eb53a955be5febe4cb156f3d413c702a3b20994545be7baf65d7
Opcode Fuzzy Hash: a64027cc69530ce26e0d020b421cb23cd984c73ff13cd53596b8d38fe4c4ed4c
Instruction Fuzzy Hash: 75411A71604204DFD714EBA9EE86B5A77A4EB49304F10427EE514B73E1CBB8A810CB9D

Function 004099A4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A9C,020F0EAC,00409A90,00000000,00409A77), ref: 00409A14
CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A9C,020F0EAC,00409A90,00000000), ref: 00409A28
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409A41
GetExitCodeProcess.KERNEL32(?,0040B240), ref: 00409A53
CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A9C,020F0EAC,00409A90), ref: 00409A5C

Part of subcall function 00409648: GetLastError.KERNEL32(00000000,004096EB,?,0040B240,?,020F0EAC), ref: 0040966C

Strings

D, xrefs: 004099EE

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitLastMultipleObjectsWait
String ID: D
API String ID: 3356880605-2746444292
Opcode ID: 752074f715f169f8c9b0a2dfdb1d62babdf7ca20371da5ab86507c15e851728d
Instruction ID: 6ea97129cf5aa135a7f7046e3a99eae43c862e8aca722617c6144c18eae127a8
Opcode Fuzzy Hash: 752074f715f169f8c9b0a2dfdb1d62babdf7ca20371da5ab86507c15e851728d
Instruction Fuzzy Hash: 3A1142B17442486EDB10EBE68C42FAEB7ACEF49714F50017BB604F72C2DA785D048A69

Function 004019DC Relevance: 9.1, APIs: 6, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.KERNEL32(0040C41C,00000000,00401AB4), ref: 00401A09
LocalFree.KERNEL32(00000000,00000000,00401AB4), ref: 00401A1B
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00401AB4), ref: 00401A3A
LocalFree.KERNEL32(00000000,00000000,00000000,00008000,00000000,00000000,00401AB4), ref: 00401A79
RtlLeaveCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AA4
RtlDeleteCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AAE

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: 2760f6fc436d2282df077fa3fe2c561b0ff429e9c23b98cc44d100e589fe962f
Instruction ID: 5447b05044442752c1d56c7733342563ab4b4f61826a3093f511f794066d9233
Opcode Fuzzy Hash: 2760f6fc436d2282df077fa3fe2c561b0ff429e9c23b98cc44d100e589fe962f
Instruction Fuzzy Hash: 91116330341280DAD711ABA59EE2F623668B785748F44437EF444B62F2C67C9840CA9D

Function 00403D02 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00403D9D
ExitProcess.KERNEL32 ref: 00403DE5

Strings

Runtime error at 00000000, xrefs: 00403D96, 00403DA9
Error, xrefs: 00403D91

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000
API String ID: 1220098344-2970929446
Opcode ID: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
Instruction ID: db3008c0e6bc5d60e05df0545d3e9f81ce91e923819fa2a9fb93000da4b6b716
Opcode Fuzzy Hash: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
Instruction Fuzzy Hash: B521F830A04341CAE714EFA59AD17153E98AB49349F04837BD500B73E3C77C8A45C76E

Function 00401918 Relevance: 6.0, APIs: 4, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlInitializeCriticalSection.KERNEL32(0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
RtlEnterCriticalSection.KERNEL32(0040C41C,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
LocalAlloc.KERNEL32(00000000,00000FF8,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
RtlLeaveCriticalSection.KERNEL32(0040C41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: 38709c719971e1168baf9cdc3c67f999ad3db3ab521e9349fb3b390a12b3c6f3
Instruction ID: 093a8b970c40f4dda7bd37408b901a2e20e4e29fb74a5496b56404d4d89a3717
Opcode Fuzzy Hash: 38709c719971e1168baf9cdc3c67f999ad3db3ab521e9349fb3b390a12b3c6f3
Instruction Fuzzy Hash: CC0161B0684240DEE715ABA999E6B353AA4E786744F10427FF080F62F2C67C4450CB9D

Function 00409E47 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 117
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 00409EAB

Strings

.tmp, xrefs: 00409EF1
y@, xrefs: 00409FB4

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Message
String ID: .tmp$y@
API String ID: 2030045667-2396523267
Opcode ID: 025cb7c8070ceb0a973f57dc2423f3e96cefce6b80174f3a3145c26c436c6efd
Instruction ID: 436c98ae07f88f71ec52beeb6e72a39fdb1c754e3b127fd60db974180cd34f4e
Opcode Fuzzy Hash: 025cb7c8070ceb0a973f57dc2423f3e96cefce6b80174f3a3145c26c436c6efd
Instruction Fuzzy Hash: 7541AC30600200DFC715EF25DE96A5A77A5EB49304B50463AF804B73E2CBB9AC05CBAD

Function 00409E62 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 00409EAB

Strings

.tmp, xrefs: 00409EF1
y@, xrefs: 00409FB4

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Message
String ID: .tmp$y@
API String ID: 2030045667-2396523267
Opcode ID: cf567291c84692d100e5ec609b282d55b3c5af0b5f3d357f2e8f357a6d06844b
Instruction ID: effdcd9541676c6323f3fad609c54d18bb0bf767b5f2530b550772909ae59cb2
Opcode Fuzzy Hash: cf567291c84692d100e5ec609b282d55b3c5af0b5f3d357f2e8f357a6d06844b
Instruction Fuzzy Hash: 1F418D70610204DFC715EF25DED6A5A77A5EB49308B50463AF804B73E2CBB9AC05CBAD

Function 00409330 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,0040941F,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409376
GetLastError.KERNEL32(00000000,00000000,?,00000000,0040941F,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040937F

Strings

.tmp, xrefs: 0040935F

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: 7ba2b511fbcbba0bdafc57409f78771f2ffb69bdc1885ec5b7c8c3418ce725e0
Instruction ID: 229665e4fb482f752e04f7b041ef1ce89d659938bfc828767b82506ffacbf3f4
Opcode Fuzzy Hash: 7ba2b511fbcbba0bdafc57409f78771f2ffb69bdc1885ec5b7c8c3418ce725e0
Instruction Fuzzy Hash: 7C213774A04208ABDB05EFA1C8429DFB7B9EF88304F50457BE901B73C2DA7C9E059A65

Function 004094D8 Relevance: 5.0, APIs: 4, Instructions: 45
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,?,0000000D,?,0040A220,000000FA,00000032,0040A287), ref: 004094F7
Sleep.KERNEL32(?,?,?,?,0000000D,?,0040A220,000000FA,00000032,0040A287), ref: 00409507
GetLastError.KERNEL32(?,?,?,0000000D,?,0040A220,000000FA,00000032,0040A287), ref: 0040951A
GetLastError.KERNEL32(?,?,?,0000000D,?,0040A220,000000FA,00000032,0040A287), ref: 00409524

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 597fcf42490b874720d4ad81cf19761f51130dad350fd41d24dc31ad960abd38
Instruction ID: cd4a420f7ace5638a97e0bdb8a1e9fccbb234b9240edd4770f97938e6011a3cc
Opcode Fuzzy Hash: 597fcf42490b874720d4ad81cf19761f51130dad350fd41d24dc31ad960abd38
Instruction Fuzzy Hash: 16F0967360451477CA35A5AF9D81A5F634DDAD1354B10813BE945F3283C538DD0142A9

Function 00407749 Relevance: 3.3, APIs: 2, Instructions: 284
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004076DF

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 43d3196ec1ce5242573e8f450cfa6a0a1bc6604aabb0088ea34051851cbbaa4a
Instruction ID: 20d0a63744b7af467993d3e8aec565234b7be2d060ba20bf9fd199bb98bd5a4e
Opcode Fuzzy Hash: 43d3196ec1ce5242573e8f450cfa6a0a1bc6604aabb0088ea34051851cbbaa4a
Instruction Fuzzy Hash: 8251D12294D2910FC7126B7849685A53FE0FE5331132E92FBC5C1AB1A3D27CA847D35B

Function 00401FD4 Relevance: 3.1, APIs: 2, Instructions: 122COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0040C41C,00000000,00402148), ref: 00402017

Part of subcall function 00401918: RtlInitializeCriticalSection.KERNEL32(0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
Part of subcall function 00401918: RtlEnterCriticalSection.KERNEL32(0040C41C,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
Part of subcall function 00401918: LocalAlloc.KERNEL32(00000000,00000FF8,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
Part of subcall function 00401918: RtlLeaveCriticalSection.KERNEL32(0040C41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CriticalSection$Enter$AllocInitializeLeaveLocal
String ID:
API String ID: 296031713-0
Opcode ID: e41243de7c80276a36dcdd2c2c0e451bb1a6f3055e5ddec7aea90b49354f7273
Instruction ID: b272be6629c35a549fc4f1c5a19e6e0df2414f51bb24a7fd7fb800939d1160d0
Opcode Fuzzy Hash: e41243de7c80276a36dcdd2c2c0e451bb1a6f3055e5ddec7aea90b49354f7273
Instruction Fuzzy Hash: D4419CB2A40711DFDB108F69DEC562A77A0FB58314B25837AD984B73E1D378A842CB48

Function 00408FBC Relevance: 3.0, APIs: 2, Instructions: 42fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,00000000,00409019,?,0000000D,00000000), ref: 00408FF3
GetLastError.KERNEL32(00000000,00000000,00409019,?,0000000D,00000000), ref: 00408FFB

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: 51b14d3c2f7fde5c1a6bb776c84878c326085b2b0be15ffc15f9635c9f9f5f18
Instruction ID: 1f0403e6899a51d1d5356f81b6020870d4ad1054c4e625117792cee712869c3b
Opcode Fuzzy Hash: 51b14d3c2f7fde5c1a6bb776c84878c326085b2b0be15ffc15f9635c9f9f5f18
Instruction Fuzzy Hash: 16F0C871A04704ABCB01DF759D4159DB3E8DB8831475045BBF814F3682EA385E108599

Function 0040A282 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

RemoveDirectoryA.KERNEL32(00000000,0040A287,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A234
DestroyWindow.USER32(00020430,0040A287,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A248

Part of subcall function 004094D8: Sleep.KERNEL32(?,?,?,?,0000000D,?,0040A220,000000FA,00000032,0040A287), ref: 004094F7
Part of subcall function 004094D8: GetLastError.KERNEL32(?,?,?,0000000D,?,0040A220,000000FA,00000032,0040A287), ref: 0040951A
Part of subcall function 004094D8: GetLastError.KERNEL32(?,?,?,0000000D,?,0040A220,000000FA,00000032,0040A287), ref: 00409524

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ErrorLast$DestroyDirectoryRemoveSleepWindow
String ID:
API String ID: 2192421792-0
Opcode ID: cfb4816e8e93690030a7db02d377f330bfa753c6875f065e2bcd958c08ae31af
Instruction ID: 660582e0dfefc282ab61bc82749075141bf2bb6394dcfcd8a4149d52366551bd
Opcode Fuzzy Hash: cfb4816e8e93690030a7db02d377f330bfa753c6875f065e2bcd958c08ae31af
Instruction Fuzzy Hash: EDF03C71601200DBD724EB69EEC9B1632A4A785349F14463FA504B63F1CBBC9CA1CBDE

Function 00406FA0 Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008000), ref: 00406FAA
LoadLibraryA.KERNEL32(00000000,00000000,00406FF4,?,00000000,00407012,?,00008000), ref: 00406FD9

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 9b48b29771c4fc6652b627c4d055133170331230f079557c80f3f4e2880abe46
Instruction ID: 292e1fc4e19851716b0ab93d2d43454b233f1d25ff8a05a0d03104374ea2dcbc
Opcode Fuzzy Hash: 9b48b29771c4fc6652b627c4d055133170331230f079557c80f3f4e2880abe46
Instruction Fuzzy Hash: D6F08270A14704BEDB129FB68C5282ABBECEB4DB0475349BAF914A26D2E53C5C209568

Function 0040766C Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000), ref: 0040768B
GetLastError.KERNEL32(?,?,?,00000000), ref: 00407693

Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,020F03AC,?,00409CCE,00000001,00000000,00000002,00000000,0040A2C5,?,00000000,0040A2FC), ref: 0040748F

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: cf8b3d77442686d6cce32677ffa2556d95a4d660bd32a6059a32509021572d83
Instruction ID: 64daf3b7b2b4cd691f255a674f922558070816022eb0a012369b73df1192a31e
Opcode Fuzzy Hash: cf8b3d77442686d6cce32677ffa2556d95a4d660bd32a6059a32509021572d83
Instruction Fuzzy Hash: B2E092766081016FD600D55EC881B9B37DCDFC5364F104536B654EB2D1D679EC108776

Function 0040762C Relevance: 3.0, APIs: 2, Instructions: 30fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 00407643
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 00407652

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 1b4aea639ae4b78e93b9ef79541d7064bf1f98a27d237b51b731e51654b8bdcb
Instruction ID: e2f452503b48da12a69c10a9d1416f2aa512a4714c212e67fea7d8588799396e
Opcode Fuzzy Hash: 1b4aea639ae4b78e93b9ef79541d7064bf1f98a27d237b51b731e51654b8bdcb
Instruction Fuzzy Hash: 69E012A1A081106ADB24A66E9CC5F6B6BDCCBC5724F14457BF504DB382D678DC0487BB

Function 004075C4 Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000001), ref: 004075DB
GetLastError.KERNEL32(?,00000000,?,00000001), ref: 004075E7

Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,020F03AC,?,00409CCE,00000001,00000000,00000002,00000000,0040A2C5,?,00000000,0040A2FC), ref: 0040748F

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 7730a1f6a5d1c383143cef2e1ec1cb69b5af0836910a757b2920ce96cbe13b7f
Instruction ID: 74cf86129294d2faf5969c20f66175129728110ffa3c668ef2bae8a95e28f18b
Opcode Fuzzy Hash: 7730a1f6a5d1c383143cef2e1ec1cb69b5af0836910a757b2920ce96cbe13b7f
Instruction Fuzzy Hash: C4E04FB1600210AFDB10EEB98D81B9676D89F48364F0485B6EA14DF2C6D274DC00C766

Function 00401430 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,00401739), ref: 0040145F
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00401739), ref: 00401486

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: efc6f27fa4c1f0416fcf42a0cb9c981ca4ea103f0f96f52908972bf4ed8d2b74
Instruction ID: 29306f1da17679ce7d7d3cecb65679b0075e6f6f2ddca0a826851c871ac90975
Opcode Fuzzy Hash: efc6f27fa4c1f0416fcf42a0cb9c981ca4ea103f0f96f52908972bf4ed8d2b74
Instruction Fuzzy Hash: 57F02772B0032057DB206A6A0CC1B636AC59F85B90F1541BBFA4CFF3F9D2B98C0042A9

Function 00405280 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,004053B6), ref: 0040529F

Part of subcall function 00404CDC: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00404CF9

Part of subcall function 0040520C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052D7,?,00000000,004053B6), ref: 0040522A

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: ef449c44a2a61a26d18614e24c7ade2666283ce56a0d8fcdc2eeed56ad2c4646
Instruction ID: b95c725f163960c8622ba1b0af82130980b93a97e76f79286a035b518bc8de08
Opcode Fuzzy Hash: ef449c44a2a61a26d18614e24c7ade2666283ce56a0d8fcdc2eeed56ad2c4646
Instruction Fuzzy Hash: 90314F75E01509ABCB00DF95C8C19EEB379FF84304F158577E815BB286E739AE068B98

Function 00407576 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 004075B8

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c8aa5b1e1f382d9b7ab40d46c96f796d669d4b8c7333918930cf1677525ebce7
Instruction ID: d860c9bcffbd3325f9178b4d72e9b59b5a3ff3896166b15a891a1a6cde46a7a7
Opcode Fuzzy Hash: c8aa5b1e1f382d9b7ab40d46c96f796d669d4b8c7333918930cf1677525ebce7
Instruction Fuzzy Hash: 6EE06D713442082EE3409AEC6C51FA277DCD309354F008032B988DB342D5719D108BE8

Function 00407578 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 004075B8

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3bd7282c13d8f152a8301508d2aa72b6e2817799d08f3caede8a9fdcd0036c45
Instruction ID: d44512077142226ebef1615cfdb59f208ea4aebd3ed4d24446e2b73eb7949d4a
Opcode Fuzzy Hash: 3bd7282c13d8f152a8301508d2aa72b6e2817799d08f3caede8a9fdcd0036c45
Instruction Fuzzy Hash: A7E06D713442082ED2409AEC6C51F92779C9309354F008022B988DB342D5719D108BE8

Function 004069DC Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00406A24,?,?,?,?,00000000,?,00406A39,00406D67,00000000,00406DAC,?,?,?), ref: 00406A07

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2f6b808c0a98facf9b4219f47e50352985dbcf5de86cc118cb6830f30f21a29b
Instruction ID: ccd219c895c276d3a4f2ed408fb3af00451e62210c6f1137e8185e88dac79a2a
Opcode Fuzzy Hash: 2f6b808c0a98facf9b4219f47e50352985dbcf5de86cc118cb6830f30f21a29b
Instruction Fuzzy Hash: A0E0ED30300304BBD301FBA6CC42E4ABBECDB8A708BA28476B400B2682D6786E108428

Function 004076C8 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004076DF

Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,020F03AC,?,00409CCE,00000001,00000000,00000002,00000000,0040A2C5,?,00000000,0040A2FC), ref: 0040748F

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 8d2af3ab7a63a8387ab01b8eb17bee2761ee08039256abb6018552f25082062b
Instruction ID: d11fc940c1eb4d9ab9bd5ee1403c634941755763b259216c6d34bff68e3e8731
Opcode Fuzzy Hash: 8d2af3ab7a63a8387ab01b8eb17bee2761ee08039256abb6018552f25082062b
Instruction Fuzzy Hash: 6DE0ED766081106BD710A65AD880EAB67DCDFC5764F00407BF904DB291D574AC049676

Function 00407284 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00409127,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 004072A3

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 7ef42d69529baecca532a801bf1eab389dc79dba057db81877db687b261eaad4
Instruction ID: 7b38442d06f496379890204edef453c821f476d6c52b93f329ea0e63e965d40b
Opcode Fuzzy Hash: 7ef42d69529baecca532a801bf1eab389dc79dba057db81877db687b261eaad4
Instruction Fuzzy Hash: 17E0D8A0B8830136F22414544C87B77220E47C0700F10807E7700ED3C6D6BEA906815F

Function 004076AC Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,02128000,0040A08C,00000000), ref: 004076B3

Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,020F03AC,?,00409CCE,00000001,00000000,00000002,00000000,0040A2C5,?,00000000,0040A2FC), ref: 0040748F

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: 3c9e02bda174eefd6a6752df40b73b0cbe28e66d981a9881f8e50d89b6fd2d40
Instruction ID: f788b2e916ece263959a2b362e6cc5638f15ca068e5e6b6e193a7bb405067b9b
Opcode Fuzzy Hash: 3c9e02bda174eefd6a6752df40b73b0cbe28e66d981a9881f8e50d89b6fd2d40
Instruction Fuzzy Hash: BEC04CA1A1410047CB40A6BE89C1A1666D85A4821530485B6B908DB297D679E8004666

Function 00406FFB Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00407019), ref: 0040700C

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 070e151ae7371931e812c23e1680e2574253ea8634671ff6451d3f815f7c1847
Instruction ID: c47f2f618e2971e07f5b1abb1c43dc6c143ad8b034d1ddbdae76011a93498253
Opcode Fuzzy Hash: 070e151ae7371931e812c23e1680e2574253ea8634671ff6451d3f815f7c1847
Instruction Fuzzy Hash: 54B09B76A1C2415DE705DAD5745153863D4D7C47143A14977F104D35C0D53DA4144519

Function 00407017 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00407019), ref: 0040700C

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 258b7047379ce46b8540a294da6ad57472ce1849ceeb23a1b4b516eeda09cad2
Instruction ID: a55afa0689d716a84ca499c05243e055e04a08b2ab071a0afeb25d409e08decd
Opcode Fuzzy Hash: 258b7047379ce46b8540a294da6ad57472ce1849ceeb23a1b4b516eeda09cad2
Instruction Fuzzy Hash: FFA022A8C08000B2CE00E2E08080A3C23283A88308BC08BA2320CB20C0C03CE008020B

Function 00406970 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,?,0040696C,?,00406649,?,?,00406D87,00000000,00406DAC,?,?,?,?,00000000,00000000), ref: 00406972

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 4f55c7aa95ee0cc6def6f8b84b07f7a00b4eea213dcaa2411b48aa5a82a0c27b
Instruction ID: 57bb655d476c0b104ac503b4dc16dcc9cc7d9309af7e6782790f501f1b0aeff9
Opcode Fuzzy Hash: 4f55c7aa95ee0cc6def6f8b84b07f7a00b4eea213dcaa2411b48aa5a82a0c27b
Instruction Fuzzy Hash:

Function 00407F10 Relevance: 1.3, APIs: 1, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00407FA0

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 636722d4ca057b68616df378e1b8a5bd7f337355b9f7c137ab23b8dc1cafdb71
Instruction ID: 1e7236936b067224bcb0a7c190bcfb18a105a15b1652d3161176e1d0ad605fa4
Opcode Fuzzy Hash: 636722d4ca057b68616df378e1b8a5bd7f337355b9f7c137ab23b8dc1cafdb71
Instruction Fuzzy Hash: 43116371A042059BDB00EF19C881B5B7794AF44359F05807AF958AB2C6DB38E800CBAA

Function 00401658 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00004000,?,0000000C,?,-00000008,00003FFB,004018BF), ref: 004016B2

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: a2f32dd8ef58eb042d1926e7c5d87192c2fb778a874e681f692e1318d4ea2181
Instruction ID: 63c8255cdd02620dd55efc6405714c3c0a63becca9b218cdeda95617091702f1
Opcode Fuzzy Hash: a2f32dd8ef58eb042d1926e7c5d87192c2fb778a874e681f692e1318d4ea2181
Instruction Fuzzy Hash: 3601A7726442148BC310AF28DDC093A77D5EB85364F1A4A7ED985B73A1D23B6C0587A8

Function 00407548 Relevance: 1.3, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00407558

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: fc6098dcd6b1504a072b68d3feaaa537492281b052079d944a979dec092e75e7
Instruction ID: e7ddd8f09f86228f97b62737e097d00c20d119481f2284b048c56b7aa048eabb
Opcode Fuzzy Hash: fc6098dcd6b1504a072b68d3feaaa537492281b052079d944a979dec092e75e7
Instruction Fuzzy Hash: 41D05E82B00A6017D615F2BE4D8869692D85F89685B08843AF654E77D1D67CEC00838D

Function 00407EB8 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,00407E9D), ref: 00407ECF

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: c7bedad96efb848ea9f674ed311898bb29a23f2a16fc3a9de009753beeeb9dd9
Instruction ID: 622015b425f940adf6dc1d0f89e873b9c6d17cfe6f0c2733970da1323f12c917
Opcode Fuzzy Hash: c7bedad96efb848ea9f674ed311898bb29a23f2a16fc3a9de009753beeeb9dd9
Instruction Fuzzy Hash: 3ED0E9B17553055BDB90EEB98CC1B0237D8BB48610F5044B66904EB296E674E8009654

Non-executed Functions

Function 00409448 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 00409457
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 0040945D
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 00409476
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 0040949D
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 004094A2
ExitWindowsEx.USER32(00000002,00000000), ref: 004094B3

Strings

SeShutdownPrivilege, xrefs: 0040946F

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 5d5c4cc2167cea31fe6e778ad900630fb502c4628614430f67a63468396a48bc
Instruction ID: 55e16e97e4c30333ef6e9d7cb44a764448f3c494fd9ead6bbbdf5d5bb2f9c1eb
Opcode Fuzzy Hash: 5d5c4cc2167cea31fe6e778ad900630fb502c4628614430f67a63468396a48bc
Instruction Fuzzy Hash: 61F012B069830179E610AAB18D07F6762885BC4B18F50493ABB15FA1C3D7BDD809466F

Function 00409BEC Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,00002B67,0000000A), ref: 00409BF6
SizeofResource.KERNEL32(00000000,00000000,?,00409CE6,00000000,0040A27D,?,00000001,00000000,00000002,00000000,0040A2C5,?,00000000,0040A2FC), ref: 00409C09
LoadResource.KERNEL32(00000000,00000000,00000000,00000000,?,00409CE6,00000000,0040A27D,?,00000001,00000000,00000002,00000000,0040A2C5,?,00000000), ref: 00409C1B
LockResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00409CE6,00000000,0040A27D,?,00000001,00000000,00000002,00000000,0040A2C5), ref: 00409C2C

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: ce7c2a79786de0a8682d58b31ceb4174bbddb2d24ae6ad16542ef9ae896a3e40
Instruction ID: ed04ed1443b666af2c347742ca0221af59beed1f1180006ed42e296f861e82c7
Opcode Fuzzy Hash: ce7c2a79786de0a8682d58b31ceb4174bbddb2d24ae6ad16542ef9ae896a3e40
Instruction Fuzzy Hash: ECE07EA0B483562AFA6076FB08C2B2A018C4BA671DF40003BB701B92C3DEBD8C14856E

Function 00405258 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0040545A,?,?,?,00000000,0040560C), ref: 0040526B

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: b79b605a6dbd2dbd76dc5df923bc970e8acc9169766131cf64cabc826e101d13
Instruction ID: 1db3d1c1bb6fab5f91442dea8a08a829cd161d84d3a7e1f0c2fe21aaaafd944f
Opcode Fuzzy Hash: b79b605a6dbd2dbd76dc5df923bc970e8acc9169766131cf64cabc826e101d13
Instruction Fuzzy Hash: 9ED02EA230E2006AE210808B2C84EBB4A9CCEC53A0F00007FF648C3242D2208C029B76

Function 004026C4 Relevance: 1.5, APIs: 1, Instructions: 20timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 004026CE

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: SystemTime
String ID:
API String ID: 2656138-0
Opcode ID: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
Instruction ID: 69442b1fa125f02c17f5f00667ba5619268a94e84ed87230136e9e38920861ba
Opcode Fuzzy Hash: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
Instruction Fuzzy Hash: 14E04F21E0010A82C704ABA5CD435EDF7AEAB95600B044272A418E92E0F631C251C748

Function 00405CF4 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,004065F0,00000000,004065FE,?,?,?,?,?,00409C6A), ref: 00405D02

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 804cda8d473c4c61bcc63f12479ba9190822d5c554409fc9a119c77cb0a2aa37
Instruction ID: 4c33b40dd65743d8d98a5ffd827b1eb297e5dd4f71424004bfe2d5ab9b26ea54
Opcode Fuzzy Hash: 804cda8d473c4c61bcc63f12479ba9190822d5c554409fc9a119c77cb0a2aa37
Instruction Fuzzy Hash: 00C0126040070186D7109B31DC02B1672D4AB44310F4405396DA4963C2E73C80018A6E

Function 0040840C Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cb438cf7f0ff76753a1d16800e3023f3e313fbbfbb21f985cf38b771b24bb28
Instruction ID: 7dc6dc86846b3232beed044054ddb30c9891ac2fec336679fba6e94018ae2b4c
Opcode Fuzzy Hash: 7cb438cf7f0ff76753a1d16800e3023f3e313fbbfbb21f985cf38b771b24bb28
Instruction Fuzzy Hash: C032D775E00219DFCB14CF99CA80AADB7B2BF88314F24816AD855B7385DB34AE42CF55

Function 00407024 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,00407129,?,00000000,004098D0), ref: 0040704D
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00407053
RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,00407129,?,00000000,004098D0), ref: 004070A1

Strings

kernel32.dll, xrefs: 00407048
.DEFAULT\Control Panel\International, xrefs: 00407078
Control Panel\Desktop\ResourceLocale, xrefs: 004070B0
GetUserDefaultUILanguage, xrefs: 00407043
Locale, xrefs: 00407090

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 4190037839-2401316094
Opcode ID: 84283e8ecd5f01446eeee6c4ca3ac4597d6d061694d9d4138b3ca6e7d0b19e25
Instruction ID: c068e7fb85b52830e378cef5638f1cf195f9e270113e5aa630163df598a56aa7
Opcode Fuzzy Hash: 84283e8ecd5f01446eeee6c4ca3ac4597d6d061694d9d4138b3ca6e7d0b19e25
Instruction Fuzzy Hash: 72214170E04209ABDB10EAB5CC55A9E77A9EB48304F60847BA510FB3C1D7BCAE01875E

Function 00403A97 Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B1E
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B42
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B5E
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00403B7F
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00403BA8
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00403BB2
GetStdHandle.KERNEL32(000000F5), ref: 00403BD2
GetFileType.KERNEL32(?,000000F5), ref: 00403BE9
CloseHandle.KERNEL32(?,?,000000F5), ref: 00403C04
GetLastError.KERNEL32(000000F5), ref: 00403C1E

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction ID: 6684f6b4d1923fa93cc5777a7ebe0ca766b8c5f16b1f456132d2f0a6dbb27d3d
Opcode Fuzzy Hash: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction Fuzzy Hash: 444194302042009EF7305F258805B237DEDEB4571AF208A3FA1D6BA6E1E77DAE419B5D

Function 004053C4 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,0040560C,?,?,?,?,00000000,00000000,00000000,?,004065EB,00000000,004065FE), ref: 004053DE

Part of subcall function 0040520C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052D7,?,00000000,004053B6), ref: 0040522A

Part of subcall function 00405258: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0040545A,?,?,?,00000000,0040560C), ref: 0040526B

Strings

m/d/yy, xrefs: 004054AD
AMPM, xrefs: 004055A9
mmmm d, yyyy, xrefs: 004054CF
:mm:ss, xrefs: 004055DA
:mm, xrefs: 004055C0

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: 2becd82198b95216644133442ecc563e5ef80f5327bc31795fb041598c227e39
Instruction ID: cc137df54ae1fcbb63b87987e69a719e9c27c4b31815d0debc5c9b1d2781c89a
Opcode Fuzzy Hash: 2becd82198b95216644133442ecc563e5ef80f5327bc31795fb041598c227e39
Instruction Fuzzy Hash: F8515374B00548ABDB00EBA59891A5F7769DB88304F50D5BBB515BB3C6CA3DCA058F1C

Function 004036B8 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 004036F2
SysAllocStringLen.OLEAUT32(?,00000000), ref: 004036FD
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403710
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 0040371A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403729

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: 759139aa8138bb4f1b890a81a570935fc2f09484a8ccbcda4eb7e9d11bc9ffe5
Instruction ID: 1285967c487f36a4f1f77a8b8e1f1fe351824cacfdb80e5859a13ebcd08b75b2
Opcode Fuzzy Hash: 759139aa8138bb4f1b890a81a570935fc2f09484a8ccbcda4eb7e9d11bc9ffe5
Instruction Fuzzy Hash: 17F068A13442543AF56075A75C43FAB198CCB45BAEF10457FF704FA2C2D8B89D0492BD

Function 00406E10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,00406F48,?,00000000,004098D0,00000000), ref: 00406E4C
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,70000000,?,?,00000000,00000000,00000000,?,00000000,00406F48,?,00000000), ref: 00406EBC

Strings

)q@, xrefs: 00406F3F, 00406E98, 00406EA8, 00406F04, 00406F28, 00406F18, 00406EEF

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: QueryValue
String ID: )q@
API String ID: 3660427363-2284170586
Opcode ID: 32d2d681139902fa63b50b1e86c1c6042aee641263ad409bd5d16b68eaa8278f
Instruction ID: 22a93fbabe645b78fd14ced98f65bd4bcb22fe3fd6f8222f7fa8e6a3c98f8dfc
Opcode Fuzzy Hash: 32d2d681139902fa63b50b1e86c1c6042aee641263ad409bd5d16b68eaa8278f
Instruction Fuzzy Hash: E6415E31D0021AAFDB21DF95C881BAFB7B8EB04704F56447AE901F7280D738AF108B99

Function 004030DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00409C56), ref: 004030E3
GetCommandLineA.KERNEL32(00000000,00409C56), ref: 004030EE

Strings

U1hd.@, xrefs: 00403103

Memory Dump Source

Source File: 00000000.00000002.2795554773.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2795520483.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795589664.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2795629951.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CommandHandleLineModule
String ID: U1hd.@
API String ID: 2123368496-2904493091
Opcode ID: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
Instruction ID: 0f926add87520dc699e98d27074396f9fab16295c11a520b4b5863bd90c7cb52
Opcode Fuzzy Hash: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
Instruction Fuzzy Hash: 03C01274541300CAD328AFF69E8A304B990A385349F40823FA608BA2F1CA7C4201EBDD

Analysis Process: chica-pc-shield-1-75-0-1300-en-win.tmpPID: 6460, Parent PID: 2704COMMON

Execution Graph

Execution Coverage:	15.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	108

Executed Functions

Function 0048DA5C Relevance: 138.4, APIs: 22, Strings: 56, Instructions: 1883COMMON

Download Yara Rule

Strings

STRINGCHANGE, xrefs: 0048E1FB
INIKEYEXISTS, xrefs: 0048DCB2
FILEORDIREXISTS, xrefs: 0048DB15
ADDBACKSLASH, xrefs: 0048DFD9
PARAMCOUNT, xrefs: 0048DF83
GETSYSNATIVEDIR, xrefs: 0048E1A6
PARAMSTR, xrefs: 0048DFA7
ADDPERIOD, xrefs: 0048EFE9
ISPOWERUSERLOGGEDON, xrefs: 0048EF6C
GETENV, xrefs: 0048DF23
REGVALUEEXISTS, xrefs: 0048E43B
REGDELETEKEYINCLUDINGSUBKEYS, xrefs: 0048E4DD
GETTEMPDIR, xrefs: 0048E1D3
FONTEXISTS, xrefs: 0048EF90
REMOVEQUOTES, xrefs: 0048E0B9
GETSYSTEMDIR, xrefs: 0048E156
REGGETSUBKEYNAMES, xrefs: 0048E638
GETWINDIR, xrefs: 0048E12E
GETCMDTAIL, xrefs: 0048DF5B
SETINISTRING, xrefs: 0048DD56
DELETEINIENTRY, xrefs: 0048DE9B
REGWRITEBINARYVALUE, xrefs: 0048EE68
DIREXISTS, xrefs: 0048DADC
REGWRITEMULTISTRINGVALUE, xrefs: 0048EC8A
DELETEINISECTION, xrefs: 0048DEE9
GETINISTRING, xrefs: 0048DB4E
CONVERTPERCENTSTR, xrefs: 0048E37D
STRINGCHANGEEX, xrefs: 0048E262
REGGETVALUENAMES, xrefs: 0048E6A5
REMOVEBACKSLASH, xrefs: 0048E011
SETINIINT, xrefs: 0048DDC5
USINGWINNT, xrefs: 0048E2D6
GETUILANGUAGE, xrefs: 0048EFC4
ISINISECTIONEMPTY, xrefs: 0048DD0E
REGDELETEKEYIFEMPTY, xrefs: 0048E538
REMOVEBACKSLASHUNLESSROOT, xrefs: 0048E049
FILECOPY, xrefs: 0048E2FA
FILEEXISTS, xrefs: 0048DAA3
GETINIINT, xrefs: 0048DBC2
REGKEYEXISTS, xrefs: 0048E3BE
REGWRITESTRINGVALUE, xrefs: 0048EA92
ISADMINLOGGEDON, xrefs: 0048EF48
REGQUERYBINARYVALUE, xrefs: 0048E973
REGDELETEVALUE, xrefs: 0048E593
SETNTFSCOMPRESSION, xrefs: 0048F062
CHARLENGTH, xrefs: 0048F021
ADDQUOTES, xrefs: 0048E081
SETINIBOOL, xrefs: 0048DE30
REGQUERYMULTISTRINGVALUE, xrefs: 0048E7D4
REGWRITEDWORDVALUE, xrefs: 0048ED94
REGQUERYDWORDVALUE, xrefs: 0048E896
GETSHORTNAME, xrefs: 0048E0F1
REGQUERYSTRINGVALUE, xrefs: 0048E712
GETSYSWOW64DIR, xrefs: 0048E17E
REGWRITEEXPANDSTRINGVALUE, xrefs: 0048EBA9
GETINIBOOL, xrefs: 0048DC47

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID:
String ID: ADDBACKSLASH$ADDPERIOD$ADDQUOTES$CHARLENGTH$CONVERTPERCENTSTR$DELETEINIENTRY$DELETEINISECTION$DIREXISTS$FILECOPY$FILEEXISTS$FILEORDIREXISTS$FONTEXISTS$GETCMDTAIL$GETENV$GETINIBOOL$GETINIINT$GETINISTRING$GETSHORTNAME$GETSYSNATIVEDIR$GETSYSTEMDIR$GETSYSWOW64DIR$GETTEMPDIR$GETUILANGUAGE$GETWINDIR$INIKEYEXISTS$ISADMINLOGGEDON$ISINISECTIONEMPTY$ISPOWERUSERLOGGEDON$PARAMCOUNT$PARAMSTR$REGDELETEKEYIFEMPTY$REGDELETEKEYINCLUDINGSUBKEYS$REGDELETEVALUE$REGGETSUBKEYNAMES$REGGETVALUENAMES$REGKEYEXISTS$REGQUERYBINARYVALUE$REGQUERYDWORDVALUE$REGQUERYMULTISTRINGVALUE$REGQUERYSTRINGVALUE$REGVALUEEXISTS$REGWRITEBINARYVALUE$REGWRITEDWORDVALUE$REGWRITEEXPANDSTRINGVALUE$REGWRITEMULTISTRINGVALUE$REGWRITESTRINGVALUE$REMOVEBACKSLASH$REMOVEBACKSLASHUNLESSROOT$REMOVEQUOTES$SETINIBOOL$SETINIINT$SETINISTRING$SETNTFSCOMPRESSION$STRINGCHANGE$STRINGCHANGEEX$USINGWINNT
API String ID: 0-4234653879
Opcode ID: 0b35161c62076a0aa1b79bef7233e41cfe119bc3bfa0d241014cb232ecee9a80
Instruction ID: d02af680958f845af4f17b62cfc8fb9d1a0ae824f2bdeb6ca06ac61dfeb0c001
Opcode Fuzzy Hash: 0b35161c62076a0aa1b79bef7233e41cfe119bc3bfa0d241014cb232ecee9a80
Instruction Fuzzy Hash: 11D26270B002055BDB14FFBAD8815AEA7B5AF89704F50883FF451A7386DA38ED0A8759

Function 00470584 Relevance: 78.0, APIs: 4, Strings: 40, Instructions: 965COMMON

Download Yara Rule

Strings

Will register the file (a type library) later., xrefs: 004713EF
Dest file exists., xrefs: 00470897
User opted not to overwrite the existing file. Skipping., xrefs: 00470D29
Existing file's SHA-1 hash is different from our file. Proceeding., xrefs: 00470BA0
Failed to read existing file's SHA-1 hash. Proceeding., xrefs: 00470BAC
InUn, xrefs: 0047103B
Version of existing file: (none), xrefs: 00470BD6
Stripped read-only attribute., xrefs: 00470DA3
Incrementing shared file count (64-bit)., xrefs: 00471468
Time stamp of our file: (failed to read), xrefs: 00470883
Incrementing shared file count (32-bit)., xrefs: 00471481
Dest file is protected by Windows File Protection., xrefs: 004707C9
Will register the file (a DLL/OCX) later., xrefs: 004713FB
Skipping due to "onlyifdoesntexist" flag., xrefs: 004708AA
Version of our file: %u.%u.%u.%u, xrefs: 004709CC
Existing file has a later time stamp. Skipping., xrefs: 00470CAB
d&G, xrefs: 004715F0
User opted not to strip the existing file's read-only attribute. Skipping., xrefs: 00470D72
Version of existing file: %u.%u.%u.%u, xrefs: 00470A58
Dest filename: %s, xrefs: 00470770
Same version. Skipping., xrefs: 00470BC1
.tmp, xrefs: 00470E93
Installing the file., xrefs: 00470DE5
Couldn't read time stamp. Skipping., xrefs: 00470C11
Existing file is protected by Windows File Protection. Skipping., xrefs: 00470CC8
Time stamp of existing file: %s, xrefs: 00470907
Time stamp of existing file: (failed to read), xrefs: 00470913
, xrefs: 00470AAB, 00470C7C, 00470CFA
@, xrefs: 0047068C
Version of our file: (none), xrefs: 004709D8
Failed to strip read-only attribute., xrefs: 00470DAF
Skipping due to "onlyifdestfileexists" flag., xrefs: 00470DD6
Non-default bitness: 32-bit, xrefs: 00470797
Non-default bitness: 64-bit, xrefs: 0047078B
-- File entry --, xrefs: 004705D7
Existing file is a newer version. Skipping., xrefs: 00470ADE
Existing file's SHA-1 hash matches our file. Skipping., xrefs: 00470B91
Time stamp of our file: %s, xrefs: 00470877
Uninstaller requires administrator: %s, xrefs: 0047106B
Same time stamp. Skipping., xrefs: 00470C31

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID:
String ID: $-- File entry --$.tmp$@$Couldn't read time stamp. Skipping.$Dest file exists.$Dest file is protected by Windows File Protection.$Dest filename: %s$Existing file has a later time stamp. Skipping.$Existing file is a newer version. Skipping.$Existing file is protected by Windows File Protection. Skipping.$Existing file's SHA-1 hash is different from our file. Proceeding.$Existing file's SHA-1 hash matches our file. Skipping.$Failed to read existing file's SHA-1 hash. Proceeding.$Failed to strip read-only attribute.$InUn$Incrementing shared file count (32-bit).$Incrementing shared file count (64-bit).$Installing the file.$Non-default bitness: 32-bit$Non-default bitness: 64-bit$Same time stamp. Skipping.$Same version. Skipping.$Skipping due to "onlyifdestfileexists" flag.$Skipping due to "onlyifdoesntexist" flag.$Stripped read-only attribute.$Time stamp of existing file: %s$Time stamp of existing file: (failed to read)$Time stamp of our file: %s$Time stamp of our file: (failed to read)$Uninstaller requires administrator: %s$User opted not to overwrite the existing file. Skipping.$User opted not to strip the existing file's read-only attribute. Skipping.$Version of existing file: %u.%u.%u.%u$Version of existing file: (none)$Version of our file: %u.%u.%u.%u$Version of our file: (none)$Will register the file (a DLL/OCX) later.$Will register the file (a type library) later.$d&G
API String ID: 0-1787809831
Opcode ID: 3f03b0dd22833ca56ee06f034c587be6014e775d3e63eebe54e34c4707d9dd89
Instruction ID: 621cd333294344af5d97a5347e8fa1dc6562289eaae78befaee99519ae279b45
Opcode Fuzzy Hash: 3f03b0dd22833ca56ee06f034c587be6014e775d3e63eebe54e34c4707d9dd89
Instruction Fuzzy Hash: 4A927334A0428CDFDB11DFA9C445BDDBBB1AF05308F1481ABE848AB392D7789E45CB59

Function 0042E09C Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 178
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E0D6
GetVersion.KERNEL32(00000000,0042E280,?,00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E0F3
GetModuleHandleA.KERNEL32(advapi32.dll,CheckTokenMembership,00000000,0042E280,?,00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E10C
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042E112
CheckTokenMembership.KERNELBASE(00000000,00000000,?,00000000,0042E280,?,00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E127
FreeSid.ADVAPI32(00000000,0042E287,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E27A

Strings

CheckTokenMembership, xrefs: 0042E102
advapi32.dll, xrefs: 0042E107

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressAllocateCheckFreeHandleInitializeMembershipModuleProcTokenVersion
String ID: CheckTokenMembership$advapi32.dll
API String ID: 2252812187-1888249752
Opcode ID: eb8cfeeb17a0637a24a8010f94cffad8af622f1b0e059c57d1211d1ee7f4eb30
Instruction ID: e5677345bf142a8b1d9111380f95962c8bb8cf61ba8e960ca5c3fd0f127139eb
Opcode Fuzzy Hash: eb8cfeeb17a0637a24a8010f94cffad8af622f1b0e059c57d1211d1ee7f4eb30
Instruction Fuzzy Hash: E351A271B44215EEEB10EAE69C42BBF77ACEB09704F9404BBB901F7281D57C99018B79

Function 00456574 Relevance: 23.0, APIs: 4, Strings: 9, Instructions: 299
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(00499A74,00000000,00000001,00499774,?,00000000,004568E9), ref: 004565B6
CoCreateInstance.OLE32(00499764,00000000,00000001,00499774,?,00000000,004568E9), ref: 004565DC
SysFreeString.OLEAUT32(?), ref: 00456769

Strings

IShellLink::QueryInterface(IID_IPersistFile), xrefs: 00456812
IPersistFile::Save, xrefs: 00456870
IShellLink::QueryInterface(IID_IPropertyStore), xrefs: 004566CB
CoCreateInstance, xrefs: 004565E7
IPropertyStore::SetValue(PKEY_AppUserModel_StartPinOption), xrefs: 004567D8
IPropertyStore::SetValue(PKEY_AppUserModel_ExcludeFromShowInNewInstall), xrefs: 004567A0
IPropertyStore::Commit, xrefs: 004567F1
IPropertyStore::SetValue(PKEY_AppUserModel_PreventPinning), xrefs: 004566FF
IPropertyStore::SetValue(PKEY_AppUserModel_ID), xrefs: 0045674E

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CreateInstance$FreeString
String ID: CoCreateInstance$IPersistFile::Save$IPropertyStore::Commit$IPropertyStore::SetValue(PKEY_AppUserModel_ExcludeFromShowInNewInstall)$IPropertyStore::SetValue(PKEY_AppUserModel_ID)$IPropertyStore::SetValue(PKEY_AppUserModel_PreventPinning)$IPropertyStore::SetValue(PKEY_AppUserModel_StartPinOption)$IShellLink::QueryInterface(IID_IPersistFile)$IShellLink::QueryInterface(IID_IPropertyStore)
API String ID: 308859552-3566394107
Opcode ID: e79d94b7fa80332a8ad5a6f485323860ebed742ecbc364eddad45eb2579c0322
Instruction ID: 566ce70ebd2e7e48b4641fa416f4fd375dd646780ce199d2d8f0499ea0915a3b
Opcode Fuzzy Hash: e79d94b7fa80332a8ad5a6f485323860ebed742ecbc364eddad45eb2579c0322
Instruction Fuzzy Hash: 2DB13170A00104AFDB50DFA9C885BAE7BF8AF09306F55406AF904E7352DB78DD48CB69

Function 00423C0C Relevance: 21.4, APIs: 14, Instructions: 395
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a3816862b514f70ca1b361f81ea91c83852cb9df02cd0e0faeb288ab1859b4
Instruction ID: afb4f91cf4018cf9acc1c9974f14325182323c15c0e0405bd0f9b005e596376e
Opcode Fuzzy Hash: a6a3816862b514f70ca1b361f81ea91c83852cb9df02cd0e0faeb288ab1859b4
Instruction Fuzzy Hash: 03E1AE31700124EFDB04DF69E989AADB7B5FB54300FA440AAE5559B352C73CEE81DB09

Function 0042285C Relevance: 18.3, APIs: 12, Instructions: 255
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageA.USER32(00000000,00000223,00000000,00000000), ref: 004229F4
ShowWindow.USER32(00000000,00000003,00000000,00000223,00000000,00000000,00000000,00422BBE), ref: 00422A04

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: MessageSendShowWindow
String ID:
API String ID: 1631623395-0
Opcode ID: 51b0364919ae9db351a8db8a8757ad53d3501c4eae3ca631765fc17792d96d2d
Instruction ID: 9e9026b6a08d43f4c34b0c014f83afec13b9727198b5f0eb67f7172f0d04fbcb
Opcode Fuzzy Hash: 51b0364919ae9db351a8db8a8757ad53d3501c4eae3ca631765fc17792d96d2d
Instruction Fuzzy Hash: 90915171B04214BFDB11EFA9DA86F9D77F4AB04304F5500BAF504AB392CB78AE419B58

Function 0046727C Relevance: 15.6, APIs: 4, Strings: 4, Instructions: 1649windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004954A8: GetWindowRect.USER32(00000000), ref: 004954BE

LoadBitmapA.USER32(00400000,STOPIMAGE), ref: 0046764B

Part of subcall function 0041D6B0: GetObjectA.GDI32(?,00000018,00467665), ref: 0041D6DB

Part of subcall function 00467058: SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 004670FB
Part of subcall function 00467058: ExtractIconA.SHELL32(00400000,00000000,?), ref: 00467121
Part of subcall function 00467058: ExtractIconA.SHELL32(00400000,00000000,00000027), ref: 00467178

Part of subcall function 00466A18: KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,00467700,00000000,00000000,00000000,0000000C,00000000), ref: 00466A30

Part of subcall function 0049572C: MulDiv.KERNEL32(0000000D,?,0000000D), ref: 00495736

Part of subcall function 0042ED38: GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0042EDA8
Part of subcall function 0042ED38: SHAutoComplete.SHLWAPI(00000000,00000001), ref: 0042EDC5

Part of subcall function 004953F8: GetDC.USER32(00000000), ref: 0049541A
Part of subcall function 004953F8: SelectObject.GDI32(?,00000000), ref: 00495440
Part of subcall function 004953F8: ReleaseDC.USER32(00000000,?), ref: 00495491

Part of subcall function 0049571C: MulDiv.KERNEL32(0000004B,?,00000006), ref: 00495726

GetSystemMenu.USER32(00000000,00000000,0000000C,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,?,?,00000000,?), ref: 004682D5
AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 004682E6
AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 004682FE

Part of subcall function 0042A05C: SendMessageA.USER32(00000000,0000014E,00000000,00000000), ref: 0042A072

Strings

STOPIMAGE, xrefs: 00467640
(Default), xrefs: 004688E7
, xrefs: 0046770D
3!H, xrefs: 00467545, 00467559

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Menu$AppendExtractIconObject$AddressAutoBitmapCallbackCompleteDispatcherFileInfoLoadMessageProcRectReleaseSelectSendSystemUserWindow
String ID: $(Default)$3!H$STOPIMAGE
API String ID: 3231140908-1654834099
Opcode ID: 74ef8a35b9b8fc54da3a310be392b5605cecb2abae3d4e67161a0eb4122d87c7
Instruction ID: b700352d90e143707aa16fa6df3394eb4c79b632d69f0e323bfe47862c193e97
Opcode Fuzzy Hash: 74ef8a35b9b8fc54da3a310be392b5605cecb2abae3d4e67161a0eb4122d87c7
Instruction Fuzzy Hash: 09F2C6386005249FCB00EB59D5D9F9973F1BF49304F1582BAE5049B36ADB74AC46CF8A

Function 00455E0C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetDiskFreeSpaceExA,00000000,00455F4B), ref: 00455E3C
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00455E42
GetDiskFreeSpaceExA.KERNELBASE(00000000,?,?,00000000,00000000,00455F29,?,00000000,kernel32.dll,GetDiskFreeSpaceExA,00000000,00455F4B), ref: 00455E98

Strings

kernel32.dll, xrefs: 00455E37
GetDiskFreeSpaceExA, xrefs: 00455E32

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressDiskFreeHandleModuleProcSpace
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1197914913-3712701948
Opcode ID: 0cf4dfe6aae4aecb46ca130a60c8265bfc072b423f1d49aa537b4760483e04fe
Instruction ID: d81c9a8c7c52065d28d66f53e81ce4f313aa74f068c2efe820cb9bfc493487ae
Opcode Fuzzy Hash: 0cf4dfe6aae4aecb46ca130a60c8265bfc072b423f1d49aa537b4760483e04fe
Instruction Fuzzy Hash: B0418671A04649AFCF01EFA5C8929EEB7B8EF48305F504567F804F7292D67C5E098B68

Function 00474E64 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 99fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00474FCE,?,?,0049C1DC,00000000), ref: 00474EBD
FindNextFileA.KERNEL32(00000000,?,00000000,?,00000000,00474FCE,?,?,0049C1DC,00000000), ref: 00474F9A
FindClose.KERNEL32(00000000,00000000,?,00000000,?,00000000,00474FCE,?,?,0049C1DC,00000000), ref: 00474FA8

Strings

unins???.*, xrefs: 00474EA7
unins, xrefs: 00474F10

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID: unins$unins???.*
API String ID: 3541575487-1009660736
Opcode ID: b649989a6049c3436182c2bb5e84e3edffc312e753dc4685f5b3c678a0cc44ba
Instruction ID: 71c31de5aec6568d3fd02c10b200621d6e733b678e62e08c2b577e25fb21157a
Opcode Fuzzy Hash: b649989a6049c3436182c2bb5e84e3edffc312e753dc4685f5b3c678a0cc44ba
Instruction Fuzzy Hash: 9B3132706005489FCB10EB65CD91ADEB7A9EF85308F51C4B6E50CEB2A2DB389F458F58

Function 0044852C Relevance: 4.7, APIs: 3, Instructions: 151libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32(00000000,00000000,00000008,?,?,00000000,00448709), ref: 0044864C
GetProcAddress.KERNEL32(00000000,00000000), ref: 004486CD

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: bbee7e0047e0021721baff079e26fbf7481f990012d18e41f1f23c4fced0fd86
Instruction ID: 2eaa58f6359003fef9dee836e3db1fa56ae38c906bc4f4c4d93ca6671f7cd4fb
Opcode Fuzzy Hash: bbee7e0047e0021721baff079e26fbf7481f990012d18e41f1f23c4fced0fd86
Instruction Fuzzy Hash: 14515470E00105AFDB40EF95C491AAEBBF9EB45319F11817FE414BB391DA389E05CB99

Function 00452A60 Relevance: 3.0, APIs: 2, Instructions: 45fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00452AC3,?,?,-00000001,00000000), ref: 00452A9D
GetLastError.KERNEL32(00000000,?,00000000,00452AC3,?,?,-00000001,00000000), ref: 00452AA5

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ErrorFileFindFirstLast
String ID:
API String ID: 873889042-0
Opcode ID: 9c675a8f1f28b386d0fa8c71b8ecb41695e84785a8bb79b0d9bc0322d07a8b6a
Instruction ID: 3e58272229af866f17ac5928e9872a720c3be2d4903e778e839a846eb7d55d53
Opcode Fuzzy Hash: 9c675a8f1f28b386d0fa8c71b8ecb41695e84785a8bb79b0d9bc0322d07a8b6a
Instruction Fuzzy Hash: 94F0F971A04604AB8B10EF669D4149EF7ACEB8672571046BBFC14E3282DAB84E0485A8

Function 00408568 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049B4C0,00000001,?,00408633,?,00000000,00408712), ref: 00408586

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 64da881718ef9bfb5c3691e8182369eeaf442f2681d4624e7b5adc518b999176
Instruction ID: 8daab3ef8e56b0da8b8c23f45c5b5388ad46b50bd825570c2d348c61856efc62
Opcode Fuzzy Hash: 64da881718ef9bfb5c3691e8182369eeaf442f2681d4624e7b5adc518b999176
Instruction Fuzzy Hash: BFE0223170021466C311AA2A9C86AEAB34C9758310F00427FB904E73C2EDB89E4042A8

Function 00423B84 Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,?,00424151,?,00000000,0042415C), ref: 00423BAE

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 03c86555d74cd6010afd77b9e61a524e96c156e733cd5bd8e2feacc4387cef90
Instruction ID: a748582893d7571d6ac8bdbe819d0a8fbf5f36db2d3505b6f19a51c7a0bbae16
Opcode Fuzzy Hash: 03c86555d74cd6010afd77b9e61a524e96c156e733cd5bd8e2feacc4387cef90
Instruction Fuzzy Hash: 47F0B979205608AF8B40DF99C588D4ABBE8AB4C260B058195B988CB321C234ED808F90

Function 0045559C Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?), ref: 004555B2

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: c88cbf789a6641c4b706c01e69cacd1b1581240507725cd8c18f4a5e994771e1
Instruction ID: 9f318ec9847dd9a6abcb639c8bc611599857aea0b867fcad4bfaeec6bdb042bf
Opcode Fuzzy Hash: c88cbf789a6641c4b706c01e69cacd1b1581240507725cd8c18f4a5e994771e1
Instruction Fuzzy Hash: 8FD0C27230470473CB00AA689C825AA35CD8B84305F00483E3CC5DA2C3FABDDA485756

Function 0042F520 Relevance: 1.5, APIs: 1, Instructions: 17nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 0042F53C

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 9e43cbcd657a147b44e82c26281af1c584f356d37a2e763e4ec43db1fd6d4cd6
Instruction ID: 7ca9c19e24a5def9c493c34941f9da96f9ca037215ec7a65a90973bf7a04e639
Opcode Fuzzy Hash: 9e43cbcd657a147b44e82c26281af1c584f356d37a2e763e4ec43db1fd6d4cd6
Instruction Fuzzy Hash: FCD09E7120011D7B9B00DE99E840D6B33AD9B88710B909925F945D7642D634ED9197A5

Function 0046EF30 Relevance: 72.2, APIs: 1, Strings: 40, Instructions: 500
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0046ED1C: RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,f`G,?,0049C1DC,?,0046F033,?,00000000,0046F5CE,?,_is1), ref: 0046ED3F

Part of subcall function 0046ED8C: RegSetValueExA.ADVAPI32(?,NoModify,00000000,00000004,00000000,00000004,00000001,?,0046F40A,?,?,00000000,0046F5CE,?,_is1,?), ref: 0046ED9F

RegCloseKey.ADVAPI32(?,0046F5D5,?,_is1,?,Software\Microsoft\Windows\CurrentVersion\Uninstall\,00000000,0046F620,?,?,0049C1DC,00000000), ref: 0046F5C8

Strings

InstallDate, xrefs: 0046F42B
5.5.3-dev (a), xrefs: 0046F026
Inno Setup: Icon Group, xrefs: 0046F085
HelpLink, xrefs: 0046F350
Publisher, xrefs: 0046F2F9
Inno Setup: User Info: Organization, xrefs: 0046F193
DisplayVersion, xrefs: 0046F2DC
Readme, xrefs: 0046F38A
InstallLocation, xrefs: 0046F076
Inno Setup: Deselected Components, xrefs: 0046F11F
DisplayIcon, xrefs: 0046F24B
URLInfoAbout, xrefs: 0046F316
EstimatedSize, xrefs: 0046F545
MinorVersion, xrefs: 0046F469
Inno Setup: Setup Type, xrefs: 0046F0E1
NoModify, xrefs: 0046F3F8
UninstallString, xrefs: 0046F285
_is1, xrefs: 0046EF8C
NoRepair, xrefs: 0046F40C
Inno Setup: No Icons, xrefs: 0046F0A3
Inno Setup: Selected Components, xrefs: 0046F100
Comments, xrefs: 0046F3C4
URLUpdateInfo, xrefs: 0046F36D
Inno Setup: Selected Tasks, xrefs: 0046F147
Inno Setup: User Info: Serial, xrefs: 0046F1A8
MajorVersion, xrefs: 0046F457
HelpTelephone, xrefs: 0046F333
DisplayName, xrefs: 0046F22E
Inno Setup: User Info: Name, xrefs: 0046F17E
Inno Setup: Language, xrefs: 0046F1CF
ModifyPath, xrefs: 0046F3E4
Inno Setup: App Path, xrefs: 0046F056
Contact, xrefs: 0046F3A7
Inno Setup: User, xrefs: 0046F0C2
" /SILENT, xrefs: 0046F2B2
Software\Microsoft\Windows\CurrentVersion\Uninstall\, xrefs: 0046EF86
Inno Setup: Setup Version, xrefs: 0046F021
Inno Setup: Deselected Tasks, xrefs: 0046F166
QuietUninstallString, xrefs: 0046F2BF
RegisterPreviousData, xrefs: 0046F57E

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Value$Close
String ID: " /SILENT$5.5.3-dev (a)$Comments$Contact$DisplayIcon$DisplayName$DisplayVersion$EstimatedSize$HelpLink$HelpTelephone$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: Language$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: Setup Version$Inno Setup: User$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$InstallDate$InstallLocation$MajorVersion$MinorVersion$ModifyPath$NoModify$NoRepair$Publisher$QuietUninstallString$Readme$RegisterPreviousData$Software\Microsoft\Windows\CurrentVersion\Uninstall\$URLInfoAbout$URLUpdateInfo$UninstallString$_is1
API String ID: 3391052094-3291417993
Opcode ID: 350d457f303b3d1a0d7a11843be7ea0c6425cd52b6654b1112e0283e78a0f07e
Instruction ID: e010d7796fb7cf4c28bd3f5a2325ab5f55ea2e17d6efaf78f477242790e958ae
Opcode Fuzzy Hash: 350d457f303b3d1a0d7a11843be7ea0c6425cd52b6654b1112e0283e78a0f07e
Instruction Fuzzy Hash: 49127435A001099FCB14EF56E891ADE73F5EB48304F20817BE840AB365EB79AD05CB5E

Function 004835CC Relevance: 26.3, APIs: 9, Strings: 6, Instructions: 68
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 004835DD
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 004835EA
GetNativeSystemInfo.KERNELBASE(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 004835F8
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00483600
GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 0048360C
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 0048362D
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 00483640
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 00483646
GetSystemInfo.KERNEL32(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 0048365D

Strings

GetSystemWow64DirectoryA, xrefs: 00483627
RegDeleteKeyExA, xrefs: 00483636
GetNativeSystemInfo, xrefs: 004835E4
kernel32.dll, xrefs: 004835D8
IsWow64Process, xrefs: 004835FA
advapi32.dll, xrefs: 0048363B

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressProc$HandleInfoModuleSystem$CurrentNativeProcess
String ID: GetNativeSystemInfo$GetSystemWow64DirectoryA$IsWow64Process$RegDeleteKeyExA$advapi32.dll$kernel32.dll
API String ID: 2230631259-2623177817
Opcode ID: 2d7a3cf76853c6228e04a2cf5e1dcf6059238efe67b1f541d8f916056214c91d
Instruction ID: 881feda35cecc5e02869585bdb0a4ccc1c56b7a648b879ab02fedb7aac1f37a5
Opcode Fuzzy Hash: 2d7a3cf76853c6228e04a2cf5e1dcf6059238efe67b1f541d8f916056214c91d
Instruction Fuzzy Hash: AA118140104341B4D731BB7D4D59BAF1A888B11F5AF140D3BA840753C3FABC8E419B6E

Function 00473660 Relevance: 25.1, APIs: 9, Strings: 5, Instructions: 585
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegDeleteValueA.ADVAPI32(?,00000000,?,00000002,00000000,00000000,00473C59,?,?,?,?,00000000,00473DB3,?,?,0049C1DC), ref: 004737E8
RegCloseKey.ADVAPI32(?,?,00000000,?,00000002,00000000,00000000,00473C59,?,?,?,?,00000000,00473DB3), ref: 004737F1

Part of subcall function 004734B4: GetLastError.KERNEL32(00000000,00000000,00000000,00473588,?,?,0049C1DC,00000000), ref: 00473541

RegDeleteValueA.ADVAPI32(?,00000000,00000000,00473C48,?,?,00000000,00473C59,?,?,?,?,00000000,00473DB3), ref: 0047390F

Part of subcall function 0042DDE4: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DE10

Part of subcall function 004734B4: GetLastError.KERNEL32(00000000,00000000,00000000,00473588,?,?,0049C1DC,00000000), ref: 00473557

Strings

{olddata}, xrefs: 004739A7, 00473A3E
break, xrefs: 00473A7F
olddata, xrefs: 00473A12, 00473A71
Failed to parse "qword" value, xrefs: 00473B9B
Cannot access 64-bit registry keys on this version of Windows, xrefs: 0047373E

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: DeleteErrorLastValue$CloseCreate
String ID: Cannot access 64-bit registry keys on this version of Windows$Failed to parse "qword" value$break$olddata${olddata}
API String ID: 2638610037-3092547568
Opcode ID: 4ba82e80bdfa0cb3500322ce5a18341871dfead2b4573d14df413bd7eb18869f
Instruction ID: 7f3bd94fd46d44511359ad95d92ecab3c9f8cfa7154b5666b27225ceed3cac76
Opcode Fuzzy Hash: 4ba82e80bdfa0cb3500322ce5a18341871dfead2b4573d14df413bd7eb18869f
Instruction Fuzzy Hash: 6C323E74A00248AFCB15DFA9C485BDEBBF4AF08305F048066F904BB362D778AE45DB59

Function 00468C60 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 155
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,37H,?,00000001,?,?,00483733,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(?,00468E7A,?,?,00000001,00000000,00000000,00468E95,?,00000000,00000000,?), ref: 00468E63

Strings

Inno Setup: Deselected Components, xrefs: 00468DA4
Inno Setup: Setup Type, xrefs: 00468D72
%s\%s_is1, xrefs: 00468CDD
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00468CBF
Inno Setup: User Info: Serial, xrefs: 00468E45
Inno Setup: Deselected Tasks, xrefs: 00468DF1
Inno Setup: App Path, xrefs: 00468D22
Inno Setup: Selected Components, xrefs: 00468D82
Inno Setup: User Info: Organization, xrefs: 00468E32
Inno Setup: User Info: Name, xrefs: 00468E1F
Inno Setup: Selected Tasks, xrefs: 00468DCF
Inno Setup: Icon Group, xrefs: 00468D3E
Inno Setup: No Icons, xrefs: 00468D4B

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1093091907
Opcode ID: e39ca5c79a98ef63317efbb1028f085b1a1f7b12764f18e28c99012a72a7f341
Instruction ID: 8852ef8b8ed4446cdca4290267838b31d3b3871daa288d52b71b22c3e2ab6549
Opcode Fuzzy Hash: e39ca5c79a98ef63317efbb1028f085b1a1f7b12764f18e28c99012a72a7f341
Instruction Fuzzy Hash: 5F51B570A006449FCB15DB69D941BDEB7F5EF98304F50856EE840AB391EB38AF01CB69

Function 0047C1C0 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 187
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042D898: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00453DB4,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,00497F85), ref: 0042D8AB

Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7

Part of subcall function 0042D8F0: GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,00453B5A,00000000,00453BFD,?,?,00000000,00000000,00000000,00000000,00000000,?,00453FED,00000000), ref: 0042D90A
Part of subcall function 0042D8F0: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042D910

SHGetKnownFolderPath.SHELL32(00499D30,00008000,00000000,?,00000000,0047C496), ref: 0047C39A
CoTaskMemFree.OLE32(?,0047C3DF), ref: 0047C3D2

Part of subcall function 0042D208: GetEnvironmentVariableA.KERNEL32(00000000,00000000,00000000,?,?,00000000,0042DA3E,00000000,0042DAD0,?,?,?,0049B628,00000000,00000000), ref: 0042D233

Strings

COMMAND.COM, xrefs: 0047C471
Failed to get path of 64-bit Common Files directory, xrefs: 0047C360
SystemDrive, xrefs: 0047C227
ProgramFilesDir, xrefs: 0047C288, 0047C30F
cmd.exe, xrefs: 0047C450
Failed to get path of 64-bit Program Files directory, xrefs: 0047C331
Common Files, xrefs: 0047C2F9
CommonFilesDir, xrefs: 0047C2C2, 0047C33E
\Program Files, xrefs: 0047C2AF

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Directory$AddressEnvironmentFolderFreeHandleKnownModulePathProcSystemTaskVariableWindows
String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
API String ID: 3771764029-544719455
Opcode ID: fae68f7ce1b4accb6bcc686a59b43ab22c0d5fd275f28d015915852254e27fc6
Instruction ID: 69001dd7f3d8357c182f41230515665ceffb17943eaae92fd9498dc9e84a0f9e
Opcode Fuzzy Hash: fae68f7ce1b4accb6bcc686a59b43ab22c0d5fd275f28d015915852254e27fc6
Instruction Fuzzy Hash: 5F616F34A00204ABDB20EBA5D8D2A9E7B69EB44319F90C57FE404A7397C73C9E458F5D

Function 00472A24 Relevance: 19.6, APIs: 4, Strings: 7, Instructions: 337
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042C804: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C828

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00472BDC
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 00472CE3
SHChangeNotify.SHELL32(00000002,00000001,00000000,00000000), ref: 00472CF9
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 00472D1E

Strings

.lnk, xrefs: 00472AB0
target.lnk, xrefs: 00472D68
Desktop.ini, xrefs: 00472D9F
{group}\, xrefs: 00472A7E
Filename: %s, xrefs: 00472B7E
.url, xrefs: 00472AF6
.pif, xrefs: 00472AD3, 00472C67

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ChangeNotify$FullNamePathPrivateProfileStringWrite
String ID: .lnk$.pif$.url$Desktop.ini$Filename: %s$target.lnk${group}\
API String ID: 971782779-3668018701
Opcode ID: f648de025d227944a40b6a1189b07e627bd7fea08cdf46801cba0a0222d819ad
Instruction ID: 2199e5291f6c1fee24e609e14c2fbb33425e4a5dd21fff1bbddffd9c8afea78a
Opcode Fuzzy Hash: f648de025d227944a40b6a1189b07e627bd7fea08cdf46801cba0a0222d819ad
Instruction Fuzzy Hash: 0ED12574A00148AFDB11EFA9D581BDEBBF5AF08304F50806AF904B7391D778AE45CB69

Function 00423874 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 98
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041F3C4: VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041EDA4,?,0042388F,00423C0C,0041EDA4), ref: 0041F3E2

GetClassInfoA.USER32(00400000,0042367C), ref: 0042389F
RegisterClassA.USER32(00499630), ref: 004238B7
GetSystemMetrics.USER32(00000000), ref: 004238D9
GetSystemMetrics.USER32(00000001), ref: 004238E8
SetWindowLongA.USER32(00410460,000000FC,0042368C), ref: 00423944
SendMessageA.USER32(00410460,00000080,00000001,00000000), ref: 00423965
GetSystemMenu.USER32(00410460,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C,0041EDA4), ref: 00423970
DeleteMenu.USER32(00000000,0000F030,00000000,00410460,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C,0041EDA4), ref: 0042397F
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F030,00000000,00410460,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001), ref: 0042398C
DeleteMenu.USER32(00000000,0000F010,00000000,00000000,0000F000,00000000,00000000,0000F030,00000000,00410460,00000000,00000000,00400000,00000000,00000000,00000000), ref: 004239A2

Strings

|6B, xrefs: 00423893, 00423914

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Menu$DeleteSystem$ClassMetrics$AllocInfoLongMessageRegisterSendVirtualWindow
String ID: |6B
API String ID: 183575631-3009739247
Opcode ID: a73a008a7563970272a3625dc9bb64b31da3d68a27a1b0b6dfb252f000dfd8ef
Instruction ID: 5979ac727d64f3fe5c9a0a43452729076f54e0f9e4c251b9a4c28f9d6bed272f
Opcode Fuzzy Hash: a73a008a7563970272a3625dc9bb64b31da3d68a27a1b0b6dfb252f000dfd8ef
Instruction Fuzzy Hash: E63152B17402006AEB10AF69DC82F6A37989B14709F60017BFA44EF2D7C6BDED40876D

Function 0047C9CC Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 95
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000,SHGetFolderPathA), ref: 0047CACE

Strings

shfolder.dll, xrefs: 0047CA31, 0047CA6A
Failed to get version numbers of _shfoldr.dll, xrefs: 0047CA24
SHFOLDERDLL, xrefs: 0047CA0B
Failed to get address of SHGetFolderPath function, xrefs: 0047CADF
shell32.dll, xrefs: 0047CA79
_isetup\_shfoldr.dll, xrefs: 0047C9FE
SHGetFolderPathA, xrefs: 0047CAC3
Failed to load DLL "%s", xrefs: 0047CAB1
9tI, xrefs: 0047CAAC

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressProc
String ID: 9tI$Failed to get address of SHGetFolderPath function$Failed to get version numbers of _shfoldr.dll$Failed to load DLL "%s"$SHFOLDERDLL$SHGetFolderPathA$_isetup\_shfoldr.dll$shell32.dll$shfolder.dll
API String ID: 190572456-2495307774
Opcode ID: e31f5324531c17430eb92328054454a85ae0321ab1aa5061e986742380be4216
Instruction ID: 6cb8ae0fe454569243ffa89843cf59b13e41aa93d1f38be20b841c5ee4678ddc
Opcode Fuzzy Hash: e31f5324531c17430eb92328054454a85ae0321ab1aa5061e986742380be4216
Instruction Fuzzy Hash: BE31FD30A001499BCB00EFA5E5D2AEEB7B5EB44715F50847BE408F7251D738AE45CBAD

Function 0040631C Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,004987A0), ref: 00406322
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040632F
GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 00406345
GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 0040635B
SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,004987A0), ref: 00406366

Strings

kernel32.dll, xrefs: 0040631D
SetDllDirectoryW, xrefs: 00406329
SetSearchPathMode, xrefs: 0040633F
SetProcessDEPPolicy, xrefs: 00406355

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressProc$HandleModulePolicyProcess
String ID: SetDllDirectoryW$SetProcessDEPPolicy$SetSearchPathMode$kernel32.dll
API String ID: 3256987805-3653653586
Opcode ID: fb4db72500fb8039bf9e982fa136c472a352d03826636d66c2b82dec8efce00d
Instruction ID: 935c6a5f7b98c90e27654dc67135d8c1f882d2ad5d8c1b9d0efaf55941893a49
Opcode Fuzzy Hash: fb4db72500fb8039bf9e982fa136c472a352d03826636d66c2b82dec8efce00d
Instruction Fuzzy Hash: 97E02D90380702ACEA1032B20D82F3B144C9B54B69B26543B7D56B51C7D9BDDD7059BD

Function 0041321B Relevance: 14.6, APIs: 6, Strings: 2, Instructions: 633COMMON

Download Yara Rule

APIs

SetWindowLongA.USER32(?,000000FC,?), ref: 00413664
GetWindowLongA.USER32(?,000000F0), ref: 0041366F
GetWindowLongA.USER32(?,000000F4), ref: 00413681
SetWindowLongA.USER32(?,000000F4,?), ref: 00413694
SetPropA.USER32(?,00000000,00000000), ref: 004136AB
SetPropA.USER32(?,00000000,00000000), ref: 004136C2

Strings

yA, xrefs: 004132DE
3A, xrefs: 0041343D

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: LongWindow$Prop
String ID: 3A$yA
API String ID: 3887896539-3278460822
Opcode ID: d9856cee796f57cc1685d9958f98130356579251106e4d85d69cc018d86e5275
Instruction ID: bcb4e109f9bb3244d1d15a250a8b19338fc20a7c4ef9bfc7c396c8b3ff51cb63
Opcode Fuzzy Hash: d9856cee796f57cc1685d9958f98130356579251106e4d85d69cc018d86e5275
Instruction Fuzzy Hash: 8C22D06508E3C05FE31B9B74896A5D57FA0EE13325B1D45DFC4C28B1A3D21E8A8BC71A

Function 004813A0 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 175windowCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000), ref: 0048155D
FreeLibrary.KERNEL32(00000000), ref: 00481571
SendNotifyMessageA.USER32(00020430,00000496,00002710,00000000), ref: 004815E3

Strings

Deinitializing Setup., xrefs: 004813BE
GetCustomSetupExitCode, xrefs: 004813FD
DeinitializeSetup, xrefs: 00481459
Restarting Windows., xrefs: 004815BE
Not restarting Windows because Setup is being run from the debugger., xrefs: 00481592

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: FreeLibrary$MessageNotifySend
String ID: DeinitializeSetup$Deinitializing Setup.$GetCustomSetupExitCode$Not restarting Windows because Setup is being run from the debugger.$Restarting Windows.
API String ID: 3817813901-1884538726
Opcode ID: 7a28e22f49addc96e76f802ca0849d61b7b50c1c5bda5676bed9641229de787a
Instruction ID: cbf35c6ea8e2c35755bf260fcb7ea2de6ee1912f2844d37045d7b21794c51175
Opcode Fuzzy Hash: 7a28e22f49addc96e76f802ca0849d61b7b50c1c5bda5676bed9641229de787a
Instruction Fuzzy Hash: 7E51B034B00200AFD311EB69D8D5B2A77A8EB59708F50887BE801D73B1DB38AC46CB5D

Function 00467058 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 004670FB
ExtractIconA.SHELL32(00400000,00000000,?), ref: 00467121

Part of subcall function 00466F98: DrawIconEx.USER32(00000000,00000000,00000000,00000000,00000020,00000020,00000000,00000000,00000003), ref: 00467030
Part of subcall function 00466F98: DestroyCursor.USER32(00000000), ref: 00467046

ExtractIconA.SHELL32(00400000,00000000,00000027), ref: 00467178
SHGetFileInfo.SHELL32(00000000,00000000,?,00000160,00001000), ref: 004671D9
ExtractIconA.SHELL32(00400000,00000000,?), ref: 004671FF

Strings

c:\directory, xrefs: 004670F6
shell32.dll, xrefs: 0046715C
3!H, xrefs: 00467063

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Icon$Extract$FileInfo$CursorDestroyDraw
String ID: 3!H$c:\directory$shell32.dll
API String ID: 3376378930-1433438913
Opcode ID: 98d177bb41c59d9eda90a867a93fad1e1930e0ff4594ebc68b10a6f6ae3f3113
Instruction ID: eeb72baf5b42853d3f815a5aa99c9586f68c4266b8b4c17a0f013aa805d14d20
Opcode Fuzzy Hash: 98d177bb41c59d9eda90a867a93fad1e1930e0ff4594ebc68b10a6f6ae3f3113
Instruction Fuzzy Hash: C8519E70604244AFDB10DF65DD89FDFB7A8EB48308F5085B7F50897391D638AE81CA59

Function 0042F560 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 90windowregistryCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0042F58F
GetFocus.USER32 ref: 0042F597
RegisterClassA.USER32(004997AC), ref: 0042F5B8
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,0042F68C,88000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0042F5F6
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000), ref: 0042F63C
ShowWindow.USER32(00000000,00000008,00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000,00000000,TWindowDisabler-Window), ref: 0042F64D
SetFocus.USER32(00000000,00000000,0042F66F,?,?,?,00000001,00000000,?,0045822A,00000000,0049B628), ref: 0042F654

Strings

TWindowDisabler-Window, xrefs: 0042F5EF, 0042F635

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Window$CreateFocus$ActiveClassRegisterShow
String ID: TWindowDisabler-Window
API String ID: 3167913817-1824977358
Opcode ID: f7ab43707fc58a8671fa89562680ab341e1c6dac946df8ae77823ce8bb8e6cb4
Instruction ID: c3989f54cd535b42bfd745bd8d6279a550c1ea008e6f4be51b2d228796931bcd
Opcode Fuzzy Hash: f7ab43707fc58a8671fa89562680ab341e1c6dac946df8ae77823ce8bb8e6cb4
Instruction Fuzzy Hash: B021A170740710BAE310EF66AD43F1A76B8EB04B44F91853BF604AB2E1D7B86D0586AD

Function 004728D4 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 67COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00472995,?,?,?,00000008,00000000,00000000,00000000,?,00472BF1,?,?,00000000,00472E60), ref: 004728F8

Part of subcall function 0042CD94: GetPrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0042CE0A

Part of subcall function 00406F50: DeleteFileA.KERNEL32(00000000,0049B628,004982D1,00000000,00498326,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F5B

SetFileAttributesA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00472995,?,?,?,00000008,00000000,00000000,00000000,?,00472BF1), ref: 0047296F
RemoveDirectoryA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00472995,?,?,?,00000008,00000000,00000000,00000000), ref: 00472975

Strings

target.lnk, xrefs: 0047294D
CLSID2, xrefs: 00472922
desktop.ini, xrefs: 0047290C
{0AFACED1-E828-11D1-9187-B532F1E9575D}, xrefs: 00472931
.ShellClassInfo, xrefs: 00472927

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryPrivateProfileRemoveString
String ID: .ShellClassInfo$CLSID2$desktop.ini$target.lnk${0AFACED1-E828-11D1-9187-B532F1E9575D}
API String ID: 884541143-1710247218
Opcode ID: 524c06fc51e9c2653bdcf2676b801e4e9f9d3f0fda8b2bcdedf8bca621ce2dcf
Instruction ID: 462ce40c89e15ce4c06a0e37d2b4e5ea8e3c275fc862558d30a21327f7840796
Opcode Fuzzy Hash: 524c06fc51e9c2653bdcf2676b801e4e9f9d3f0fda8b2bcdedf8bca621ce2dcf
Instruction Fuzzy Hash: 1611D0F07005047BD701E66A8D82BAE72ACDB49724F64807BB508B73C1DBBCAE01865C

Function 004531F0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,004987E6), ref: 00453210
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453216
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,004987E6), ref: 0045322A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453230

Strings

shell32.dll, xrefs: 0045325C
Wow64DisableWow64FsRedirection, xrefs: 00453206
kernel32.dll, xrefs: 0045320B, 00453225
Wow64RevertWow64FsRedirection, xrefs: 00453220

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: 3c9fa4c0e07a2ee3018d2944ff9ca33be98ff08f9077dd36f774f159ffc5baad
Instruction ID: 0cfad7ca53bf4133c716031d63a26ec494c9be7874946ed143d2344feace3e75
Opcode Fuzzy Hash: 3c9fa4c0e07a2ee3018d2944ff9ca33be98ff08f9077dd36f774f159ffc5baad
Instruction Fuzzy Hash: 9F01D870240B04BED3016F63AD12F563A58E755B5BF5044BBFC1496582C77C4A088EAD

Function 00457F9C Relevance: 13.6, APIs: 1, Strings: 8, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7

CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,00458150,?, /s ",?,regsvr32.exe",?,00458150), ref: 004580C2

Strings

Spawning 32-bit RegSvr32: , xrefs: 00458049
/u, xrefs: 00457FFE
0x%x, xrefs: 004580E5
/s ", xrefs: 0045800B
D, xrefs: 00458078
CreateProcess, xrefs: 004580B4
Spawning 64-bit RegSvr32: , xrefs: 00458027
regsvr32.exe", xrefs: 00457FE3

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CloseDirectoryHandleSystem
String ID: /s "$ /u$0x%x$CreateProcess$D$Spawning 32-bit RegSvr32: $Spawning 64-bit RegSvr32: $regsvr32.exe"
API String ID: 2051275411-1862435767
Opcode ID: d175d9da8a76c71ba850d7f7f1134850f14e3b89773ae9d7c64671375ec7c016
Instruction ID: 7b83132b996dcc88cd003ed7b4b9ff56f03cb6cdfa93b787d37915dd879d1aab
Opcode Fuzzy Hash: d175d9da8a76c71ba850d7f7f1134850f14e3b89773ae9d7c64671375ec7c016
Instruction Fuzzy Hash: 4E412670E047086BDB10EFE6C842B8DB7F9AF45305F50407FA804BB292DF789A098B19

Function 00430940 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 23registryclipboardthreadCOMMON

Download Yara Rule

APIs

RegisterClipboardFormatA.USER32(commdlg_help), ref: 00430948
RegisterClipboardFormatA.USER32(commdlg_FindReplace), ref: 00430957
GetCurrentThreadId.KERNEL32 ref: 00430971
GlobalAddAtomA.KERNEL32(00000000), ref: 00430992

Strings

commdlg_FindReplace, xrefs: 00430952
commdlg_help, xrefs: 00430943
WndProcPtr%.8X%.8X, xrefs: 00430983

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ClipboardFormatRegister$AtomCurrentGlobalThread
String ID: WndProcPtr%.8X%.8X$commdlg_FindReplace$commdlg_help
API String ID: 4130936913-2943970505
Opcode ID: 8a088dfdc0b2c62b7d21c5c596ec815df7ae76573c78c741c8a86d6eee6cb681
Instruction ID: 0bd92e6c8c1c5a5b8444157758b44b4e11dae02c37acc47d2edddbd1fb793b69
Opcode Fuzzy Hash: 8a088dfdc0b2c62b7d21c5c596ec815df7ae76573c78c741c8a86d6eee6cb681
Instruction Fuzzy Hash: 22F012B0458340DEE300EB65994271E7BD0EF58718F50467FF498A6392D7795904CB5F

Function 00422E50 Relevance: 12.1, APIs: 8, Instructions: 119windowCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 00422EA4
GetCapture.USER32 ref: 00422EB3
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 00422EB9
ReleaseCapture.USER32 ref: 00422EBE
GetActiveWindow.USER32 ref: 00422ECD
SendMessageA.USER32(00000000,0000B000,00000000,00000000), ref: 00422F4C
SendMessageA.USER32(00000000,0000B001,00000000,00000000), ref: 00422FB0
GetActiveWindow.USER32 ref: 00422FBF

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CaptureMessageSend$ActiveWindow$Release
String ID:
API String ID: 862346643-0
Opcode ID: 9a658c63173933740f838e134dd06879da375375ea41c34b29c7eb91f1edca17
Instruction ID: c6261992695b47722d84ffa44129b55dc5b2a4dad2f70b0012283783c1c7b094
Opcode Fuzzy Hash: 9a658c63173933740f838e134dd06879da375375ea41c34b29c7eb91f1edca17
Instruction Fuzzy Hash: 24417230B00245AFDB10EB69DA86B9E77F1EF44304F5540BAF404AB2A2D778AE40DB49

Function 004767D8 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 200windowCOMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(00000000,COMBOBOX,?), ref: 00476831
SetWindowLongW.USER32(00000000,000000FC,0047678C), ref: 00476858
GetACP.KERNEL32(00000000,00476A70,?,00000000,00476A9A), ref: 00476895
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 004768DB

Strings

COMBOBOX, xrefs: 0047682A
Inno Setup: Language, xrefs: 00476963

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ClassInfoLongMessageSendWindow
String ID: COMBOBOX$Inno Setup: Language
API String ID: 3391662889-4234151509
Opcode ID: a4e4449b3cbe8564ce7ac80a0411ab61b62921b3e55361c0809f1fed2a0e8f54
Instruction ID: d76c004897552a3cc8e54786408815dd89bb54d04f8b08ddd0f07c4dae0e4e58
Opcode Fuzzy Hash: a4e4449b3cbe8564ce7ac80a0411ab61b62921b3e55361c0809f1fed2a0e8f54
Instruction Fuzzy Hash: 99813F706006059FCB10DF69C885AAAB7F2FB09304F16C0BAE909E7762D738ED45CB59

Function 00455010 Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 154COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,0045522C,0045522C,?,0045522C,00000000), ref: 004551BA
CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,0045522C,0045522C,?,0045522C), ref: 004551C7

Part of subcall function 00454F7C: WaitForInputIdle.USER32(?,00000032), ref: 00454FA8
Part of subcall function 00454F7C: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00454FCA
Part of subcall function 00454F7C: GetExitCodeProcess.KERNEL32(?,?), ref: 00454FD9
Part of subcall function 00454F7C: CloseHandle.KERNEL32(?,00455006,00454FFF,?,?,?,00000000,?,?,004551DB,?,?,?,00000044,00000000,00000000), ref: 00454FF9

Strings

COMMAND.COM" /C , xrefs: 00455124
D, xrefs: 00455158
cmd.exe" /C ", xrefs: 004550ED
.cmd, xrefs: 004550BB
.bat, xrefs: 004550A0

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CloseHandleWait$CodeErrorExitIdleInputLastMultipleObjectsProcess
String ID: .bat$.cmd$COMMAND.COM" /C $D$cmd.exe" /C "
API String ID: 854858120-615399546
Opcode ID: 87637bfe1c403b0336740b264e509fa12eda090332999a1b9478a3c957ce749b
Instruction ID: 058baa7e90e176347c833b132b7c272bf8058e823d6e061bdbf2f6311869cd9e
Opcode Fuzzy Hash: 87637bfe1c403b0336740b264e509fa12eda090332999a1b9478a3c957ce749b
Instruction Fuzzy Hash: 41516D34B0074DABCF10EFA5D852BDEBBB9AF44305F50447BB804B7292D7789A098B59

Function 0042368C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 96windowCOMMON

Download Yara Rule

APIs

LoadIconA.USER32(00400000,MAINICON), ref: 0042371C
GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 00423749
OemToCharA.USER32(?,?), ref: 0042375C
CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 0042379C

Strings

MAINICON, xrefs: 00423711
2, xrefs: 004236EA

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Char$FileIconLoadLowerModuleName
String ID: 2$MAINICON
API String ID: 3935243913-3181700818
Opcode ID: a0d1a492a3e1df344d79b5ede7937f80cf878dadafa44837ceada302c6d607ca
Instruction ID: 339a64ebbf2375270c19ef2cfa2d714624ee8dcb7e06b01b5ae6522dc3b50067
Opcode Fuzzy Hash: a0d1a492a3e1df344d79b5ede7937f80cf878dadafa44837ceada302c6d607ca
Instruction Fuzzy Hash: 243181B0A042549ADF10EF29D8C57C67BA8AF14308F4441BAE844DB393D7BED988CB59

Function 00418F38 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55threadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000), ref: 00418F3D
GlobalAddAtomA.KERNEL32(00000000), ref: 00418F5E
GetCurrentThreadId.KERNEL32 ref: 00418F79
GlobalAddAtomA.KERNEL32(00000000), ref: 00418F9A

Part of subcall function 004230C8: GetDC.USER32(00000000), ref: 0042311E
Part of subcall function 004230C8: EnumFontsA.GDI32(00000000,00000000,00423068,00410460,00000000,?,?,00000000,?,00418FD3,00000000,?,?,?,00000001), ref: 00423131
Part of subcall function 004230C8: GetDeviceCaps.GDI32(00000000,0000005A), ref: 00423139
Part of subcall function 004230C8: ReleaseDC.USER32(00000000,00000000), ref: 00423144

Part of subcall function 0042368C: LoadIconA.USER32(00400000,MAINICON), ref: 0042371C
Part of subcall function 0042368C: GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 00423749
Part of subcall function 0042368C: OemToCharA.USER32(?,?), ref: 0042375C
Part of subcall function 0042368C: CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 0042379C

Part of subcall function 0041F118: GetVersion.KERNEL32(?,00418FF0,00000000,?,?,?,00000001), ref: 0041F126
Part of subcall function 0041F118: SetErrorMode.KERNEL32(00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F142
Part of subcall function 0041F118: LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F14E
Part of subcall function 0041F118: SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F15C
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F18C
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F1B5
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F1CA
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F1DF
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F1F4
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F209
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F21E
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F233
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F248
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F25D

Strings

Delphi%.8X, xrefs: 00418F4F
ControlOfs%.8X%.8X, xrefs: 00418F8B

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressProc$AtomCharCurrentErrorGlobalLoadMode$CapsDeviceEnumFileFontsIconLibraryLowerModuleNameProcessReleaseThreadVersion
String ID: ControlOfs%.8X%.8X$Delphi%.8X
API String ID: 316262546-2767913252
Opcode ID: b417f06b73a7dba032b12b865c8ed9bc6bb92a8bfb887f153b822e9fb73695be
Instruction ID: d883a59e21ed3b4d0722d018b4a025de81f9e45e1fd093e44b5ebaba0e30331f
Opcode Fuzzy Hash: b417f06b73a7dba032b12b865c8ed9bc6bb92a8bfb887f153b822e9fb73695be
Instruction Fuzzy Hash: AC115E706142419AD740FF76A94235A7BE1DF64308F40943FF448A7391DB3DA9448B5F

Function 0041363C Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowLongA.USER32(?,000000FC,?), ref: 00413664
GetWindowLongA.USER32(?,000000F0), ref: 0041366F
GetWindowLongA.USER32(?,000000F4), ref: 00413681
SetWindowLongA.USER32(?,000000F4,?), ref: 00413694
SetPropA.USER32(?,00000000,00000000), ref: 004136AB
SetPropA.USER32(?,00000000,00000000), ref: 004136C2

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: LongWindow$Prop
String ID:
API String ID: 3887896539-0
Opcode ID: 7846fecbe383e6d7fdaea4169180c186d89bab15e88d328ea810806c298c4441
Instruction ID: 06abc153636d574f2b9d5b42ed2ef1d3d1989bf2b09c04f5b7aa0ee96fd2bcf7
Opcode Fuzzy Hash: 7846fecbe383e6d7fdaea4169180c186d89bab15e88d328ea810806c298c4441
Instruction Fuzzy Hash: 1011C975100244BFEF00DF9DDC84EDA37E8EB19364F144666B958DB2A2D738DD908B68

Function 00401A90 Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0049B420,00000000,00401B68), ref: 00401ABD
LocalFree.KERNEL32(00000000,00000000,00401B68), ref: 00401ACF
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00401B68), ref: 00401AEE
LocalFree.KERNEL32(00000000,00000000,00000000,00008000,00000000,00000000,00401B68), ref: 00401B2D
RtlLeaveCriticalSection.KERNEL32(0049B420,00401B6F), ref: 00401B58
RtlDeleteCriticalSection.KERNEL32(0049B420,00401B6F), ref: 00401B62

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: 49a09b6a13b56db9203ce39fe96f4178c1f7b5105776856b2d284d5d8bbe2f88
Instruction ID: 79795942c165c44483fb09e1962e32eaca51f8de38df00e9c029d8aa05623ce8
Opcode Fuzzy Hash: 49a09b6a13b56db9203ce39fe96f4178c1f7b5105776856b2d284d5d8bbe2f88
Instruction Fuzzy Hash: 3B118E30A003405AEB15AB65BE85B263BA5D761B08F44407BF80067BF3D77C5850E7AE

Function 00472030 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 272fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,00472201,?,00000000,?,0049C1DC,00000000,004723F1,?,00000000,?,00000000,?,004725BD), ref: 004721DD
FindClose.KERNEL32(000000FF,00472208,00472201,?,00000000,?,0049C1DC,00000000,004723F1,?,00000000,?,00000000,?,004725BD,?), ref: 004721FB
FindNextFileA.KERNEL32(000000FF,?,00000000,00472323,?,00000000,?,0049C1DC,00000000,004723F1,?,00000000,?,00000000,?,004725BD), ref: 004722FF
FindClose.KERNEL32(000000FF,0047232A,00472323,?,00000000,?,0049C1DC,00000000,004723F1,?,00000000,?,00000000,?,004725BD,?), ref: 0047231D

Strings

d&G, xrefs: 004723E3, 00472347, 00472371, 0047237F, 004723B1, 0047235E, 00472109, 004721AC, 00472144, 0047215B, 00472169, 00472120, 00472129, 004721AF

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Find$CloseFileNext
String ID: d&G
API String ID: 2066263336-2616847865
Opcode ID: 3135acd49bdd9f7c940886891253c872025377feb8fdbabe8a22e46f2ad5dbf6
Instruction ID: 608184e9d730796bd638f0aed621da03a149468e2f0a896b3490ab0ad4e323f3
Opcode Fuzzy Hash: 3135acd49bdd9f7c940886891253c872025377feb8fdbabe8a22e46f2ad5dbf6
Instruction Fuzzy Hash: 76C13B3090424D9FCF11DFA5C981ADEBBB9FF48304F5085AAE818A3391D7789A46CF64

Function 004556D8 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 142registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,37H,?,00000001,?,?,00483733,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,0045586F,?,00000000,004558AF), ref: 004557B5

Strings

PendingFileRenameOperations, xrefs: 00455754
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00455738
WININIT.INI, xrefs: 004557E4
PendingFileRenameOperations2, xrefs: 00455784

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager$WININIT.INI
API String ID: 47109696-2199428270
Opcode ID: 61bab1fbce8125a1ef0a6b7e628570c1d80a2c4d95d385196e5e328981673cec
Instruction ID: 0fa1da25f67206326559771d92c7e47b52ca8d856d575cc5f046ac455f5bab2a
Opcode Fuzzy Hash: 61bab1fbce8125a1ef0a6b7e628570c1d80a2c4d95d385196e5e328981673cec
Instruction Fuzzy Hash: FF51A974E006089FDB10EF61DC51AEEB7B9EF44305F50857BEC04A7292DB78AE49CA58

Function 0047C6E8 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 101COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,0047C83E,?,?,00000000,0049B628,00000000,00000000,?,00498119,00000000,004982C2,?,00000000), ref: 0047C77B
GetLastError.KERNEL32(00000000,00000000,00000000,0047C83E,?,?,00000000,0049B628,00000000,00000000,?,00498119,00000000,004982C2,?,00000000), ref: 0047C784

Strings

\_setup64.tmp, xrefs: 0047C7F6
Created temporary directory: , xrefs: 0047C71D
_isetup, xrefs: 0047C766

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: Created temporary directory: $\_setup64.tmp$_isetup
API String ID: 1375471231-2952887711
Opcode ID: cdb850062fff62b3483cb9d455793b2ffcb5a285f05f3e3c93654b2d8917781d
Instruction ID: 5d4e87a35204cb1efdaf7da8c531a93990ce3b0e97e2adc2e7d4826ba5d250a1
Opcode Fuzzy Hash: cdb850062fff62b3483cb9d455793b2ffcb5a285f05f3e3c93654b2d8917781d
Instruction Fuzzy Hash: 62410774A001099BDB00FFA5D882ADEB7B5EB44309F50557FE81477392DB389E058A5D

Function 00423A84 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00423A1C), ref: 00423AA8
GetWindow.USER32(?,00000003), ref: 00423ABD
GetWindowLongA.USER32(?,000000EC), ref: 00423ACC
SetWindowPos.USER32(00000000,\AB,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,004241AB,?,?,00423D73), ref: 00423B02

Strings

\AB, xrefs: 00423AF2, 00423AF6

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Window$EnumLongWindows
String ID: \AB
API String ID: 4191631535-3948367934
Opcode ID: e93388bd3fff79c24eeb181f990f23eef1eb1c1e13edb1a8516a489dd705de31
Instruction ID: 3ad81c14f5822e14e615a382c86082b2427cd388a5bf15486a3129e996868218
Opcode Fuzzy Hash: e93388bd3fff79c24eeb181f990f23eef1eb1c1e13edb1a8516a489dd705de31
Instruction Fuzzy Hash: D6115E70700610ABDB109F28E885F5677E8EB08715F10026AF994AB2E3C378ED41CB59

Function 00457ED0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,00000001,00000000,000000FF,000000FF), ref: 00457F00
GetExitCodeProcess.KERNEL32(?,?), ref: 00457F21
CloseHandle.KERNEL32(?,00457F54), ref: 00457F47

Strings

GetExitCodeProcess, xrefs: 00457F2A
MsgWaitForMultipleObjects, xrefs: 00457F0D

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CloseCodeExitHandleMultipleObjectsProcessWait
String ID: GetExitCodeProcess$MsgWaitForMultipleObjects
API String ID: 2573145106-3235461205
Opcode ID: 4448aa6085b3b7c488e18254bdbfc71c8710c610067728cd4fa77b4d45ab329b
Instruction ID: 50a764ba55142cb249135573a30d7c63c7411ebd48bfbac2c50c8ab338f63295
Opcode Fuzzy Hash: 4448aa6085b3b7c488e18254bdbfc71c8710c610067728cd4fa77b4d45ab329b
Instruction Fuzzy Hash: 2301D632608204AFDB10EB99EC42E2E73A8EB49715F5040B7FC10D73C2D63C9E04961D

Function 0042DE44 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32registrylibraryloaderCOMMON

Download Yara Rule

APIs

RegDeleteKeyA.ADVAPI32(00000000,00000000), ref: 0042DE50
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,?,00000000,0042DFEB,00000000,0042E003,?,?,?,?,00000006,?,00000000,00497439), ref: 0042DE6B
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042DE71

Strings

advapi32.dll, xrefs: 0042DE66
RegDeleteKeyExA, xrefs: 0042DE61

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressDeleteHandleModuleProc
String ID: RegDeleteKeyExA$advapi32.dll
API String ID: 588496660-1846899949
Opcode ID: ed1542cdc99e60fdc1e6205037aed1b156b4601bf62b1d4fa5b097ff81e7402e
Instruction ID: e7246de0df94fba710dd2820c0ca51643d5dd29c3ac0bea476bad59fd0e01b91
Opcode Fuzzy Hash: ed1542cdc99e60fdc1e6205037aed1b156b4601bf62b1d4fa5b097ff81e7402e
Instruction Fuzzy Hash: 73E06DF1B41B30AAD72022657C8ABA33729DB75365F658437F105AD19183FC2C50CE9D

Function 0046B9E8 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 320COMMON

Download Yara Rule

Strings

NextButtonClick, xrefs: 0046BB24
PrepareToInstall failed: %s, xrefs: 0046BD46
Need to restart Windows? %s, xrefs: 0046BD6D

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID:
String ID: Need to restart Windows? %s$NextButtonClick$PrepareToInstall failed: %s
API String ID: 0-2329492092
Opcode ID: a39060279f72b48284e08eff57eab896bb1f01eada22d25c9f6c632c2855073d
Instruction ID: aedd5239c298be2547da2a839ccd7c469dbbdea3d5c90e64bceb31d433ef37a4
Opcode Fuzzy Hash: a39060279f72b48284e08eff57eab896bb1f01eada22d25c9f6c632c2855073d
Instruction Fuzzy Hash: 12D11C34A00108DFCB00EB99C585AEE77F5EF49304F6445BAE404EB352D779AE81CB9A

Function 00482BD4 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 226COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?,?,00000000,00482F25), ref: 00482CF8
SHChangeNotify.SHELL32(08000000,00000000,00000000,00000000), ref: 00482D96

Strings

, xrefs: 00482E53
Need to restart Windows? %s, xrefs: 00482DD3

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ActiveChangeNotifyWindow
String ID: $Need to restart Windows? %s
API String ID: 1160245247-4200181552
Opcode ID: 85e9d30413544076e55be9a72f517eb79e25aba56188ef4e592797f601b59bdf
Instruction ID: 1aeb2d584ff8c62d9bd57db574d113adc6e4e0e514ad05e5719deb60ea54066a
Opcode Fuzzy Hash: 85e9d30413544076e55be9a72f517eb79e25aba56188ef4e592797f601b59bdf
Instruction Fuzzy Hash: BF918E346042449FDB10FB69D985BAE7BF4AF59308F4484BBE8009B362C7B8AD45CB5D

Function 0046F9B8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

Part of subcall function 0042C804: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C828

GetLastError.KERNEL32(00000000,0046FBB5,?,?,0049C1DC,00000000), ref: 0046FA92
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 0046FB0C
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 0046FB31

Strings

Creating directory: %s, xrefs: 0046FA7A

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ChangeNotify$ErrorFullLastNamePath
String ID: Creating directory: %s
API String ID: 2451617938-483064649
Opcode ID: 171113a9a74995553e8e25c276a788ed0e76067d8c0b988a536185a582d1a31f
Instruction ID: eb76e5a5c62baf7f93a74a30aafa38496d2f7a5b2612fa3441d7b1df4e24bdef
Opcode Fuzzy Hash: 171113a9a74995553e8e25c276a788ed0e76067d8c0b988a536185a582d1a31f
Instruction Fuzzy Hash: E0515574E00248ABDB01DFA5D592BDEB7F5AF49304F50847AE850B7382D7786E08CB59

Function 00454DD4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 102libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,SfcIsFileProtected), ref: 00454E82
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,00454F48), ref: 00454EEC

Strings

sfc.dll, xrefs: 00454E44
SfcIsFileProtected, xrefs: 00454E7C

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressByteCharMultiProcWide
String ID: SfcIsFileProtected$sfc.dll
API String ID: 2508298434-591603554
Opcode ID: 8ad70f115c2cd82e4055ec905d7ce046a45a54d0b91e2e8387ca62de9b03e25d
Instruction ID: 0183ab2a96bad10459dc7acb776d15a29b7b4c70eaa7773bbc3cb8db3249cf06
Opcode Fuzzy Hash: 8ad70f115c2cd82e4055ec905d7ce046a45a54d0b91e2e8387ca62de9b03e25d
Instruction Fuzzy Hash: 1A419771A042189BEB20DB59DC85B9DB7B8EB4430DF5041B7E908A7293D7785F88CE1C

Function 00452510 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

74D31520.VERSION(00000000,?,?,?,004974DC), ref: 00452530
74D31500.VERSION(00000000,?,00000000,?,00000000,004525AB,?,00000000,?,?,?,004974DC), ref: 0045255D
74D31540.VERSION(?,004525D4,?,?,00000000,?,00000000,?,00000000,004525AB,?,00000000,?,?,?,004974DC), ref: 00452577

Strings

%E, xrefs: 004525BB, 00452583

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: D31500D31520D31540
String ID: %E
API String ID: 1003763464-175436132
Opcode ID: f18440ec30d6a8502c14f0dca7f1c7caee1af709ad5b943411f89d38bbe9f821
Instruction ID: f5dca5bfdad9659449235e2d7a4f424f1fde127461be4d93bb02e754cc996b3f
Opcode Fuzzy Hash: f18440ec30d6a8502c14f0dca7f1c7caee1af709ad5b943411f89d38bbe9f821
Instruction Fuzzy Hash: D2218331A00608BFDB01DAA989519AFB7FCEB4A300F554477F800E7242E6B9AE04C765

Function 0044B38C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0044B401
SelectObject.GDI32(?,00000000), ref: 0044B424
ReleaseDC.USER32(00000000,?), ref: 0044B457

Strings

3!H, xrefs: 0044B394

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ObjectReleaseSelect
String ID: 3!H
API String ID: 1831053106-770989722
Opcode ID: 727807454f8ff094e28708ba5fb35fd06b71b478ae961844f5fd952962583580
Instruction ID: 242bcfed98594cbdcf51f2854abe94a1ec69c13560e3a72339b9f4254961cc58
Opcode Fuzzy Hash: 727807454f8ff094e28708ba5fb35fd06b71b478ae961844f5fd952962583580
Instruction Fuzzy Hash: 62216570A04248AFEB15DFA6C841B9F7BB9DB49304F11806AF904A7682D778D940CB59

Function 00404D2A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00404DC5
ExitProcess.KERNEL32 ref: 00404E0D

Strings

Runtime error at 00000000, xrefs: 00404DBE, 00404DD1
Error, xrefs: 00404DB9

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000
API String ID: 1220098344-2970929446
Opcode ID: 4aa0907dffceb0697d192a833af99b379258e6819ee5eddde657f3822e72bbb6
Instruction ID: e2df0dcbf1ce8e07228a8ae3c957e3f7be2bf5582065763199918d440bd3f461
Opcode Fuzzy Hash: 4aa0907dffceb0697d192a833af99b379258e6819ee5eddde657f3822e72bbb6
Instruction Fuzzy Hash: 8E219560A442414ADB11A779BA8571B3B91D7E5348F04817BE710A73E3C77C8C4487ED

Function 0044B0C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0044B14C,?,3!H,?,?), ref: 0044B11E
DrawTextW.USER32(?,?,00000000,?,?), ref: 0044B131
DrawTextA.USER32(?,00000000,00000000,?,?), ref: 0044B165

Strings

3!H, xrefs: 0044B0C8

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: DrawText$ByteCharMultiWide
String ID: 3!H
API String ID: 65125430-770989722
Opcode ID: a99cfc9a03c86f724ad29982784cb728f5a8acb1e514b76901035c2484111296
Instruction ID: fec6fabf6d030a51aab30bc406273ff78954f96defe81b00f374268ef7e1f253
Opcode Fuzzy Hash: a99cfc9a03c86f724ad29982784cb728f5a8acb1e514b76901035c2484111296
Instruction Fuzzy Hash: 2A11CBB27046047FEB00DB6A9C91D6F77ECDB49750F10817BF504D72D0D6399E018669

Function 0042ED38 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 55libraryloaderCOMMON

Download Yara Rule

APIs

SHAutoComplete.SHLWAPI(00000000,00000001), ref: 0042EDC5

Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7

Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD

GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0042EDA8

Strings

shlwapi.dll, xrefs: 0042ED73
SHAutoComplete, xrefs: 0042EDA2

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressAutoCompleteDirectoryErrorLibraryLoadModeProcSystem
String ID: SHAutoComplete$shlwapi.dll
API String ID: 395431579-1506664499
Opcode ID: 03dbd901aa7110cc9683d5c1b3267e8c75712ceaaa91c95a5190d29b40c4bd10
Instruction ID: e807f919b0f5f47641bb36d66eaae5ab4e0d2818c3cb02d7dc2bc8906116ae4e
Opcode Fuzzy Hash: 03dbd901aa7110cc9683d5c1b3267e8c75712ceaaa91c95a5190d29b40c4bd10
Instruction Fuzzy Hash: 3311A330B00319BBD711EB62FD85B8E7BA8DB55704F90447BF40066291DBB8AE05C65D

Function 00455A10 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 41registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,37H,?,00000001,?,?,00483733,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(?,00455A7B,?,00000001,00000000), ref: 00455A6E

Strings

PendingFileRenameOperations2, xrefs: 00455A4F
PendingFileRenameOperations, xrefs: 00455A40
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00455A1C

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager
API String ID: 47109696-2115312317
Opcode ID: 4024932538ae5887f481c00a5b26e89126044ce8d3803db75db9ed78d0794b1f
Instruction ID: e9356c19d9a7d2c1b22529064790e486fb2be540b5bf165494b3782c633fa2c0
Opcode Fuzzy Hash: 4024932538ae5887f481c00a5b26e89126044ce8d3803db75db9ed78d0794b1f
Instruction Fuzzy Hash: A3F0F671304A08BFDB04D661DC62A3B739CE744725FB08167F800CB682EA7CBD04915C

Function 0047F840 Relevance: 6.1, APIs: 4, Instructions: 147fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,?,?,?,00000000,0047FA39,?,00000000,00000000,?,?,00480C8F,?,?,00000000), ref: 0047F8E6
FindClose.KERNEL32(000000FF,000000FF,?,?,?,?,00000000,0047FA39,?,00000000,00000000,?,?,00480C8F,?,?), ref: 0047F8F3
FindNextFileA.KERNEL32(000000FF,?,00000000,0047FA0C,?,?,?,?,00000000,0047FA39,?,00000000,00000000,?,?,00480C8F), ref: 0047F9E8
FindClose.KERNEL32(000000FF,0047FA13,0047FA0C,?,?,?,?,00000000,0047FA39,?,00000000,00000000,?,?,00480C8F,?), ref: 0047FA06

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: 060517e770f88c230472ebc85a875130a4459b0d8e7052b4c0965d551127201c
Instruction ID: b33153c689731431f5f6758ffa131ff439c11241547dfb1f23eae018cdad53b3
Opcode Fuzzy Hash: 060517e770f88c230472ebc85a875130a4459b0d8e7052b4c0965d551127201c
Instruction Fuzzy Hash: 29511D71A00659AFCB21EF65CC45ADEB7B8EF48315F1084BAA818B7341D7389F898F54

Function 00421274 Relevance: 6.1, APIs: 4, Instructions: 127windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(00000000), ref: 00421361
SetMenu.USER32(00000000,00000000), ref: 0042137E
SetMenu.USER32(00000000,00000000), ref: 004213B3
SetMenu.USER32(00000000,00000000), ref: 004213CF

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Menu
String ID:
API String ID: 3711407533-0
Opcode ID: 011238806e8749de4259267c2425fab43e1a23b2a7ed20fe69ece2c0c4e48eae
Instruction ID: 68e231870b0c3442489bede8fdcf2aa1db34e154331db007d9f14f65c1163b63
Opcode Fuzzy Hash: 011238806e8749de4259267c2425fab43e1a23b2a7ed20fe69ece2c0c4e48eae
Instruction Fuzzy Hash: 4641AE3070425447EB20EA3AA9857AB36925B20308F4841BFFC40DF7A3CA7CDD45839D

Function 00416B42 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,?,?,?), ref: 00416B84
SetTextColor.GDI32(?,00000000), ref: 00416B9E
SetBkColor.GDI32(?,00000000), ref: 00416BB8
CallWindowProcA.USER32(?,?,?,?,?), ref: 00416BE0

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Color$CallMessageProcSendTextWindow
String ID:
API String ID: 601730667-0
Opcode ID: 072521f5090f240ceba025e33949739ce14f97652003165ca459573163e57643
Instruction ID: 4ea48ea5c9b96bae81565ca4ce64eb356f32bd46963e120bc97d04dec40f2685
Opcode Fuzzy Hash: 072521f5090f240ceba025e33949739ce14f97652003165ca459573163e57643
Instruction Fuzzy Hash: BC115171705604AFD710EE6ECC84E8777ECEF49310715887EB959CB612C638F8418B69

Function 00454F7C Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32(?,00000032), ref: 00454FA8
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00454FCA
GetExitCodeProcess.KERNEL32(?,?), ref: 00454FD9
CloseHandle.KERNEL32(?,00455006,00454FFF,?,?,?,00000000,?,?,004551DB,?,?,?,00000044,00000000,00000000), ref: 00454FF9

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Wait$CloseCodeExitHandleIdleInputMultipleObjectsProcess
String ID:
API String ID: 4071923889-0
Opcode ID: dd50dfeadc934d49718674b70b7762dca81241f06e47b37901a5315ac1615649
Instruction ID: ea90b2abd28d60bbe0c33bbe6d7a83e36ef454db8471bda6b5c19e9a906557d9
Opcode Fuzzy Hash: dd50dfeadc934d49718674b70b7762dca81241f06e47b37901a5315ac1615649
Instruction Fuzzy Hash: B9012D31A006097FEB1097AA8C02F6FBBECDF49764F610127F904D72C2C5788D409A78

Function 004230C8 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0042311E
EnumFontsA.GDI32(00000000,00000000,00423068,00410460,00000000,?,?,00000000,?,00418FD3,00000000,?,?,?,00000001), ref: 00423131
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00423139
ReleaseDC.USER32(00000000,00000000), ref: 00423144

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CapsDeviceEnumFontsRelease
String ID:
API String ID: 2698912916-0
Opcode ID: ae3b46bdf4144dece9088701a44aa945a4d7eb571b2044da6dc5baa79edeb2ca
Instruction ID: a9d24610abdaa6694e735d00c6d38f20457f2ac5f1468c421a1b182fb2ef8db9
Opcode Fuzzy Hash: ae3b46bdf4144dece9088701a44aa945a4d7eb571b2044da6dc5baa79edeb2ca
Instruction Fuzzy Hash: 8D01CC716042102AE700BF6A5C82B9B3AA49F01319F40027BF808AA3C6DA7E980547AE

Function 004019CC Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.KERNEL32(0049B420,00000000,00401A82,?,?,0040222E,02188000,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
RtlEnterCriticalSection.KERNEL32(0049B420,0049B420,00000000,00401A82,?,?,0040222E,02188000,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
LocalAlloc.KERNEL32(00000000,00000FF8,0049B420,00000000,00401A82,?,?,0040222E,02188000,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
RtlLeaveCriticalSection.KERNEL32(0049B420,00401A89,00000000,00401A82,?,?,0040222E,02188000,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: 0890baa5a0d1e935d96baa81f1570a556114ff82a35d0c7734bdeeb6470e0ce7
Instruction ID: 91310e2de28581c92a9b529d79901d52005bdf0b1253609ef7109df0d78d257f
Opcode Fuzzy Hash: 0890baa5a0d1e935d96baa81f1570a556114ff82a35d0c7734bdeeb6470e0ce7
Instruction Fuzzy Hash: D001A1706482409EE719AB69BA467253FD4D795B48F11803BF840A6BF3C77C4440EBAD

Function 0047C89C Relevance: 6.0, APIs: 4, Instructions: 35sleepCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0047C8BD
GetLastError.KERNEL32 ref: 0047C8C7
GetTickCount.KERNEL32 ref: 0047C8D1
Sleep.KERNEL32(00000032), ref: 0047C8E1

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ErrorLast$CountSleepTick
String ID:
API String ID: 2227064392-0
Opcode ID: 4409c29a9a25c0ad308f5e955a5ec1cd053a298abf52c98fd3bc106dc91571a3
Instruction ID: fb8ccce0602981b24cccf543ece47fad641bfa2f8f4142a34fcf790c278cb350
Opcode Fuzzy Hash: 4409c29a9a25c0ad308f5e955a5ec1cd053a298abf52c98fd3bc106dc91571a3
Instruction Fuzzy Hash: 99E0ED6235919086C62132BF18C25AF4948CBC2326B29453FE088D6282C8584C0AA73F

Function 0040626C Relevance: 6.0, APIs: 4, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

GlobalHandle.KERNEL32 ref: 0040626F
GlobalUnlock.KERNEL32(00000000), ref: 00406276
GlobalReAlloc.KERNEL32(00000000,00000000), ref: 0040627B
GlobalLock.KERNEL32(00000000), ref: 00406281

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Global$AllocHandleLockUnlock
String ID:
API String ID: 2167344118-0
Opcode ID: cbc5b304f88c7a08b053d0b09bd11fc9f2d944e51c7d356257a26bde9ab667b0
Instruction ID: 5df08fd8dc2b017785a639aa93036e57be915985ffe03f20f856cac12e18577c
Opcode Fuzzy Hash: cbc5b304f88c7a08b053d0b09bd11fc9f2d944e51c7d356257a26bde9ab667b0
Instruction Fuzzy Hash: 0BB009C4810A01BEEC0473B24C0BE3F245CD88172C3904A6F3448BA183987C9C405A3A

Function 0045C13C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 0045092C: SetEndOfFile.KERNEL32(?,?,0045C21A,00000000,0045C3A5,?,00000000,00000002,00000002), ref: 00450933

FlushFileBuffers.KERNEL32(?), ref: 0045C371

Strings

NumRecs range exceeded, xrefs: 0045C26E
EndOffset range exceeded, xrefs: 0045C2A5

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: File$BuffersFlush
String ID: EndOffset range exceeded$NumRecs range exceeded
API String ID: 3593489403-659731555
Opcode ID: 8303768bd48e0fc2fa6ee4afa8e648be89b1656b816eebee7fc537c11c154369
Instruction ID: 92b39deb1d727bbe453e199d504f681136ca2c8dc81762a7a316b3574306949e
Opcode Fuzzy Hash: 8303768bd48e0fc2fa6ee4afa8e648be89b1656b816eebee7fc537c11c154369
Instruction Fuzzy Hash: 8C617234A002588FDB25DF25C881AD9B7B5EF49305F0084DAED88AB352D774AEC8CF54

Function 004830DC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00483266,?,00000000,004832A7,?,?,?,?,00000000,00000000,00000000,?,0046BC71), ref: 00483115
SetActiveWindow.USER32(?,00000000,00483266,?,00000000,004832A7,?,?,?,?,00000000,00000000,00000000,?,0046BC71), ref: 00483127

Strings

Will not restart Windows automatically., xrefs: 00483246

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Window$ActiveForeground
String ID: Will not restart Windows automatically.
API String ID: 307657957-4169339592
Opcode ID: 91e6c9f49964e5799d5a8281bce09450ffeb408f9a54e11e665e42baf201208a
Instruction ID: 8a7042837739e321d77f655c2f69457931782f300a0f77f956dc7f734a8b2175
Opcode Fuzzy Hash: 91e6c9f49964e5799d5a8281bce09450ffeb408f9a54e11e665e42baf201208a
Instruction Fuzzy Hash: 6A413634204280AFE711FFA4ED9AB6D7BE49B55F05F5448F7E8404B3A2C2BC5A019B5E

Function 00498788 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

Part of subcall function 00403344: GetModuleHandleA.KERNEL32(00000000,00498796), ref: 0040334B
Part of subcall function 00403344: GetCommandLineA.KERNEL32(00000000,00498796), ref: 00403356

Part of subcall function 0040631C: GetModuleHandleA.KERNEL32(kernel32.dll,?,004987A0), ref: 00406322
Part of subcall function 0040631C: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040632F
Part of subcall function 0040631C: GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 00406345
Part of subcall function 0040631C: GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 0040635B
Part of subcall function 0040631C: SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,004987A0), ref: 00406366

Part of subcall function 004063C4: 6F541CD0.COMCTL32(004987A5), ref: 004063C4

Part of subcall function 00410764: GetCurrentThreadId.KERNEL32 ref: 004107B2

Part of subcall function 00419040: GetVersion.KERNEL32(004987BE), ref: 00419040

Part of subcall function 0044F744: GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,004987D2), ref: 0044F77F
Part of subcall function 0044F744: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044F785

Part of subcall function 0044FC10: GetVersionExA.KERNEL32(0049B790,004987D7), ref: 0044FC1F

Part of subcall function 004531F0: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,004987E6), ref: 00453210
Part of subcall function 004531F0: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453216
Part of subcall function 004531F0: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,004987E6), ref: 0045322A
Part of subcall function 004531F0: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453230

Part of subcall function 00456F8C: GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 00456FB0

Part of subcall function 004644CC: LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,004987FA), ref: 004644DB
Part of subcall function 004644CC: GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 004644E1

Part of subcall function 0046CCC8: GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 0046CCDD

Part of subcall function 004787A8: GetModuleHandleA.KERNEL32(kernel32.dll,?,00498804), ref: 004787AE
Part of subcall function 004787A8: GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 004787BB
Part of subcall function 004787A8: GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 004787CB

Part of subcall function 00483AD8: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 00483BC7

Part of subcall function 00495790: RegisterClipboardFormatA.USER32(QueryCancelAutoPlay), ref: 004957A9

SetErrorMode.KERNEL32(00000001,00000000,0049884C), ref: 0049881E

Part of subcall function 00498548: GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,00498828,00000001,00000000,0049884C), ref: 00498552
Part of subcall function 00498548: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00498558

Part of subcall function 004244D4: SendMessageA.USER32(?,0000B020,00000000,?), ref: 004244F3

Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC

ShowWindow.USER32(?,00000005,00000000,0049884C), ref: 0049887F

Part of subcall function 00482118: SetActiveWindow.USER32(?), ref: 004821C6

Strings

Setup, xrefs: 00498865

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressProc$HandleModule$Window$Version$ActiveClipboardCommandCurrentErrorF541FormatLibraryLineLoadMessageModePolicyProcessRegisterSendShowTextThread
String ID: Setup
API String ID: 291738113-3839654196
Opcode ID: ac60a49be437ebb45cc5134b6cac54189cf8131719c63685879d854b47d4e96c
Instruction ID: e6cb1ecab586e882d6092fc32a61e4d3e54d1174c3ade86a22a5c589b5456c94
Opcode Fuzzy Hash: ac60a49be437ebb45cc5134b6cac54189cf8131719c63685879d854b47d4e96c
Instruction Fuzzy Hash: 9E31D8712045009FE601BBBBED5392D3B98DF8A718BA2447FF80496553DE3D5850867F

Function 0042DC00 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,0042DD38), ref: 0042DC3C
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,70000000,?,?,00000000,?,00000000,?,00000000,0042DD38), ref: 0042DCAC

Strings

t8H, xrefs: 0042DD2F, 0042DC88, 0042DC98, 0042DCF4, 0042DD18, 0042DD08, 0042DCDF

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: QueryValue
String ID: t8H
API String ID: 3660427363-3273747655
Opcode ID: 11a0b535a4667ef867bfe347ec5791e6c3ab33c895bd2caafeaf893bc9faecd5
Instruction ID: 5bd1c55a509b6dee259ffcee94d68868fe84ce326e73fb4cf6662c4527ef549e
Opcode Fuzzy Hash: 11a0b535a4667ef867bfe347ec5791e6c3ab33c895bd2caafeaf893bc9faecd5
Instruction Fuzzy Hash: 9D414171E00529ABDB11DF95D881BAFB7B8EB04704F918466E810F7241D778AE00CBA5

Function 00478A20 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 86registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,37H,?,00000001,?,?,00483733,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(?,00478B06,?,?,00000001,00000000,00000000,00478B21), ref: 00478AEF

Strings

Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00478A7A
%s\%s_is1, xrefs: 00478A98

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1598650737
Opcode ID: 786c54be934108f786759ad76196cefc8fa07037b31cfb1517f2fa762e4dd4f1
Instruction ID: bc4647fd19b1406f2c24edaffaa7e5f79ca482a4abc40f74c7f03d766005c666
Opcode Fuzzy Hash: 786c54be934108f786759ad76196cefc8fa07037b31cfb1517f2fa762e4dd4f1
Instruction Fuzzy Hash: 68216470B403446FDB11DBA9CC5569EBBE8EB8D714F90847BF404E7381DA78AE01CA59

Function 00453A24 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,00453B13,?,?,00000000,0049B628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00453A6A
GetLastError.KERNEL32(00000000,00000000,?,00000000,00453B13,?,?,00000000,0049B628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00453A73

Strings

.tmp, xrefs: 00453A53

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: e73f07324749ba3b6bb8051b413134030b115f0023a9ed500ac47b5e556ef56f
Instruction ID: ea6adcadec8e2c01cafa1ba510acc1338588d6ec7b4e1cf88163bb5bfef62d35
Opcode Fuzzy Hash: e73f07324749ba3b6bb8051b413134030b115f0023a9ed500ac47b5e556ef56f
Instruction Fuzzy Hash: A9213575A002089BDB01EFA1C8429DEB7B8EF49305F50457BE801B7343DA3CAF058B69

Function 00483AD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 004835CC: GetModuleHandleA.KERNEL32(kernel32.dll), ref: 004835DD
Part of subcall function 004835CC: GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 004835EA
Part of subcall function 004835CC: GetNativeSystemInfo.KERNELBASE(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 004835F8
Part of subcall function 004835CC: GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00483600
Part of subcall function 004835CC: GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 0048360C
Part of subcall function 004835CC: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 0048362D
Part of subcall function 004835CC: GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 00483640
Part of subcall function 004835CC: GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 00483646

Part of subcall function 004838F8: GetVersionExA.KERNEL32(?,00483B0A,00000000,00483BDF,?,?,?,?,?,00498809), ref: 00483906
Part of subcall function 004838F8: GetVersionExA.KERNEL32(0000009C,?,00483B0A,00000000,00483BDF,?,?,?,?,?,00498809), ref: 00483958

Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD

GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 00483BC7

Strings

SHGetKnownFolderPath, xrefs: 00483BB2
shell32.dll, xrefs: 00483BBC

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressProc$HandleModuleVersion$CurrentErrorInfoLibraryLoadModeNativeProcessSystem
String ID: SHGetKnownFolderPath$shell32.dll
API String ID: 3869789854-2936008475
Opcode ID: c38c32ac8e21e1ef1c7c8d60e58cbfd2e67055f6aaa6ab8a85d379c1cf1e926e
Instruction ID: 8d754446f8ced7e828df75db08f564e36c275066a6fcf3a280b0d464572047f3
Opcode Fuzzy Hash: c38c32ac8e21e1ef1c7c8d60e58cbfd2e67055f6aaa6ab8a85d379c1cf1e926e
Instruction Fuzzy Hash: E92130B06103506EC300BF7E59A661A3BA5EB5470C380893FF800EB3D2D77E68159B6E

Function 0042DD64 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,Inno Setup: No Icons,00000000,00000000,00000000,00000000), ref: 0042DD78
RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,Inno Setup: No Icons,00000000,00000000,00000000), ref: 0042DDB8

Strings

Inno Setup: No Icons, xrefs: 0042DD76

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Value$EnumQuery
String ID: Inno Setup: No Icons
API String ID: 1576479698-2016326496
Opcode ID: 36a0b08f46d91d09f38f531e186592c2a543f82488f0210131226a48688c00be
Instruction ID: 8d080c6700cf8453afd411d185ff7d2dd707f59376968ad674d2e7d16536e1ed
Opcode Fuzzy Hash: 36a0b08f46d91d09f38f531e186592c2a543f82488f0210131226a48688c00be
Instruction Fuzzy Hash: 1B012B33B55B7179FB3045256D01F7B57889B82B60F64013BF942EA2C0D6999C04936E

Function 0047C12C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,0047C480,00000000,0047C496), ref: 0047C18E

Strings

RegisteredOwner, xrefs: 0047C16B
RegisteredOrganization, xrefs: 0047C17D

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Close
String ID: RegisteredOrganization$RegisteredOwner
API String ID: 3535843008-1113070880
Opcode ID: 1e88217f8c6a686059b1cc8b17c331cad9b4eafb174e051ef77faac6cc91a5cf
Instruction ID: a98586ebc1dd8f6eb838f640b3930df9694dcbabcd7376c76b2eb4b88a119760
Opcode Fuzzy Hash: 1e88217f8c6a686059b1cc8b17c331cad9b4eafb174e051ef77faac6cc91a5cf
Instruction Fuzzy Hash: E0F09020704204AFE704DA69DDD2BAA3369D781304FE4803FA1049B347C6789E019B5C

Function 0046ED1C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,f`G,?,0049C1DC,?,0046F033,?,00000000,0046F5CE,?,_is1), ref: 0046ED3F

Strings

Inno Setup: Setup Version, xrefs: 0046ED3D
f`G, xrefs: 0046ED21

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Value
String ID: Inno Setup: Setup Version$f`G
API String ID: 3702945584-3457340433
Opcode ID: 9a0f65d316a07bbae5ca4561441a268b34a40409bea15b003c9f9f243cfcc325
Instruction ID: f83a235de8ae442e911721d8788902edd6b0ca45a2d8472f1444dbca35bd6270
Opcode Fuzzy Hash: 9a0f65d316a07bbae5ca4561441a268b34a40409bea15b003c9f9f243cfcc325
Instruction Fuzzy Hash: 87E06D753012043FD710AA2B9C89F5BBBDCDF88365F10443AB908DB392D578DD0081A8

Function 00475128 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,0047535F), ref: 0047514D
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,0047535F), ref: 00475164

Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,00497F85,00000000), ref: 0045349F

Strings

CreateFile, xrefs: 00475159

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: CreateFile
API String ID: 2528220319-823142352
Opcode ID: ef990a5663e5edb92589d8d491dd3746fed10db6247803fa66726950be21a5ee
Instruction ID: 546d462a2e4641071e1b60047c6a955c4a835f73968c03783858e9aa75523f0b
Opcode Fuzzy Hash: ef990a5663e5edb92589d8d491dd3746fed10db6247803fa66726950be21a5ee
Instruction Fuzzy Hash: 99E039306403047BEA10EA69CCC6F4A77989B04769F108152FA48AF2E2C5B9EC408658

Function 0046DFBC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28comCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,0046E052), ref: 0046DFC6
CoCreateInstance.OLE32(00499B98,00000000,00000001,00499BA8,?,?,0046E052), ref: 0046DFE2

Strings

8m, xrefs: 0046DFFB, 0046E007

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CreateInstanceVersion
String ID: 8m
API String ID: 1462612201-1963270409
Opcode ID: 3176ce1499194bff4308d94f2f95d7c7f74a03190291877a43d24721a6d06f51
Instruction ID: 9d7e53e8e12081409dd358e1503977a6d7c63d54aec5d731c24cc192de25bb62
Opcode Fuzzy Hash: 3176ce1499194bff4308d94f2f95d7c7f74a03190291877a43d24721a6d06f51
Instruction Fuzzy Hash: 04F0A0352862109EEB20ABAADC49B4A37C4BB20318F44047BE04487291E3ED9850871F

Function 0042DE1C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,37H,?,00000001,?,?,00483733,?,00000001,00000000), ref: 0042DE38

Strings

37H, xrefs: 0042DE32, 0042DE35
System\CurrentControlSet\Control\Windows, xrefs: 0042DE36

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Open
String ID: 37H$System\CurrentControlSet\Control\Windows
API String ID: 71445658-295213744
Opcode ID: a11f376e1d034aeb0d9ae53f60934921bcd728bb93d306f1768079d63b1ffdfe
Instruction ID: 60e43675bb36a9eef4a15598a1848ca3f705ecc445ee8c9fe52fc6b05f1352bb
Opcode Fuzzy Hash: a11f376e1d034aeb0d9ae53f60934921bcd728bb93d306f1768079d63b1ffdfe
Instruction Fuzzy Hash: 29D09E72950128BB9B009A89DC41DFB775DDB15760F45441BF9049B141C5B4AC5197E4

Function 00456F8C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 11libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00456F1C: CoInitialize.OLE32(00000000), ref: 00456F22

Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD

GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 00456FB0

Strings

shell32.dll, xrefs: 00456FA5
SHCreateItemFromParsingName, xrefs: 00456F9B

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressErrorInitializeLibraryLoadModeProc
String ID: SHCreateItemFromParsingName$shell32.dll
API String ID: 2906209438-2320870614
Opcode ID: 8c9e14898829cb5443ed632762dd3065d85b0c82af61ba438ad016217d0fb5e8
Instruction ID: 2fc726b4a9e056db7c29aceefe67fc8584a8af6d4be502d82461f9bcaeee1902
Opcode Fuzzy Hash: 8c9e14898829cb5443ed632762dd3065d85b0c82af61ba438ad016217d0fb5e8
Instruction Fuzzy Hash: 19C08CA1F0020052C700B3FB740261F2C049B4035FB82803FB900A768BCF3D8C084B6E

Function 0046CCC8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD

GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 0046CCDD

Strings

SHPathPrepareForWriteA, xrefs: 0046CCC8
shell32.dll, xrefs: 0046CCD2

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressErrorLibraryLoadModeProc
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 2492108670-2683653824
Opcode ID: 6f7a6060dbea8608123eb84315140fc27ddd0186f719612547a4ad5d942bf35b
Instruction ID: 42ebcd9fb95d62c415b6bc32f22e3161900c204dd3e918c1883918c963b40904
Opcode Fuzzy Hash: 6f7a6060dbea8608123eb84315140fc27ddd0186f719612547a4ad5d942bf35b
Instruction Fuzzy Hash: ECB092A070170086CA00BBAA6892A2A2805AB81319B50803B7188AB685EA3C88004B6F

Function 004817C8 Relevance: 4.6, APIs: 3, Instructions: 98windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000,00000000,00481900), ref: 00481898
AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 004818A9
AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 004818C1

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Menu$Append$System
String ID:
API String ID: 1489644407-0
Opcode ID: 801fc58b86e0da2840a0eeeb4eb862893eccaa6a476f937b0111c0bf968b749f
Instruction ID: fb7e7424c8280285121f5e03216e1827cf579b611b3bd4e8529c9af7391f4121
Opcode Fuzzy Hash: 801fc58b86e0da2840a0eeeb4eb862893eccaa6a476f937b0111c0bf968b749f
Instruction Fuzzy Hash: 8831A3307043441AD721FB7A9C83BAE3AA89F11718F54587FF800962E3CA7C9D0A879D

Function 004243FC Relevance: 4.6, APIs: 3, Instructions: 59windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00424412
TranslateMessage.USER32(?), ref: 0042448F
DispatchMessageA.USER32(?), ref: 00424499

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: d4f7142ddfb2041a0388c754ad29f8297397d1c5d5a6fc901d04af05902ad934
Instruction ID: 8eae6dca0d2455523dd27ca57e4683f6da326f6f2f90499d04ddbfd693f83f9d
Opcode Fuzzy Hash: d4f7142ddfb2041a0388c754ad29f8297397d1c5d5a6fc901d04af05902ad934
Instruction Fuzzy Hash: E3116D303043205AEB20FA24A941B9F73D4DFC5758F80481EFC99972C2D77D9D49879A

Function 00416644 Relevance: 4.5, APIs: 3, Instructions: 39COMMON

Download Yara Rule

APIs

SetPropA.USER32(00000000,00000000), ref: 0041666A
SetPropA.USER32(00000000,00000000), ref: 0041667F
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,00000000,00000000,?,00000000,00000000), ref: 004166A6

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Prop$Window
String ID:
API String ID: 3363284559-0
Opcode ID: 7d8f8f86b8da0dfbd786005ea8c9fba063c8ea21b0325804e592c04f17898ad0
Instruction ID: 6913c5f2d07602d921388148e43cadd8ab2d6729f30613f48e4cae6714e3bc13
Opcode Fuzzy Hash: 7d8f8f86b8da0dfbd786005ea8c9fba063c8ea21b0325804e592c04f17898ad0
Instruction Fuzzy Hash: ACF01271701210ABDB10AB599C85FA732DCAB09714F16057AB905EF286C778DC40C7A8

Function 0041EE54 Relevance: 4.5, APIs: 3, Instructions: 27windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0041EE64
IsWindowEnabled.USER32(?), ref: 0041EE6E
EnableWindow.USER32(?,00000000), ref: 0041EE94

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Window$EnableEnabledVisible
String ID:
API String ID: 3234591441-0
Opcode ID: 495d6a49dc4b54b7e424eeae3cce025a94256eba33976185de8149e812397146
Instruction ID: 3b4cb379701a2ac24b7d0c87bf9454d2e26b3d0fb89a85d5a5a22e513a73856b
Opcode Fuzzy Hash: 495d6a49dc4b54b7e424eeae3cce025a94256eba33976185de8149e812397146
Instruction Fuzzy Hash: EAE06DB5100301AAE301AB2BDC81B5B7A9CAB54350F05843BA9089B292D63ADC408B7C

Function 00482F6C Relevance: 4.5, APIs: 3, Instructions: 25threadCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,?,?,00482FD1,?,004830B6,?,?,00000000), ref: 00482F72
GetWindowThreadProcessId.USER32(00000000,?), ref: 00482F84
GetCurrentProcessId.KERNEL32(00000000,?,00000000,00000000,?,?,00482FD1,?,004830B6,?,?,00000000), ref: 00482F8D

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ProcessWindow$CurrentForegroundThread
String ID:
API String ID: 3477312055-0
Opcode ID: 53227ee51045fa378d488872e8cf5f628c4f53fe8c6b675cba760793569b590d
Instruction ID: ac944b23caf919ac87e9cfc51a9a52cc41904222b668436948df8c862bf8793a
Opcode Fuzzy Hash: 53227ee51045fa378d488872e8cf5f628c4f53fe8c6b675cba760793569b590d
Instruction Fuzzy Hash: 83D0C233505A2A6E6611F5E55D818AFB36CC900358714013BFA04A3281D7689E04C6BD

Function 00469DF4 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 232COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?), ref: 00469F05

Strings

PrepareToInstall, xrefs: 00469EAF, 00469F56

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ActiveWindow
String ID: PrepareToInstall
API String ID: 2558294473-1101760603
Opcode ID: 03b5a7062135bc08ac6c9968637263e6280f008c3cc91eb0c5f3a53be5c2b00e
Instruction ID: b32d1113f626b33c33e5dda37d046e006f4720943d575063500f121db1088002
Opcode Fuzzy Hash: 03b5a7062135bc08ac6c9968637263e6280f008c3cc91eb0c5f3a53be5c2b00e
Instruction Fuzzy Hash: 6AA11934A00109DFCB00EF99D986EDEB7F5AF89344F5540B6E404AB366D738AE41CB99

Function 0046C394 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

/:*?"<>|, xrefs: 0046C530, 0046C547

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID:
String ID: /:*?"<>|
API String ID: 0-4078764451
Opcode ID: baeae3b569e444952e8f67b7659cb196a0efbe3f78f9fc9a052d5160d9971c3e
Instruction ID: b81ff51e3587532d40105836ffa36bb77379fe4d4ab3fc563c1df1324d87f448
Opcode Fuzzy Hash: baeae3b569e444952e8f67b7659cb196a0efbe3f78f9fc9a052d5160d9971c3e
Instruction Fuzzy Hash: 4471C670B002546AEB20EB59DCD2BBE77A19F40308F108167F541BB292EA79AD45875F

Function 00482118 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?), ref: 004821C6

Strings

InitializeWizard, xrefs: 0048215F

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ActiveWindow
String ID: InitializeWizard
API String ID: 2558294473-2356795471
Opcode ID: deadc8968076f8caea13905e5e163463e25b816dffd795125141a152398972e1
Instruction ID: 7d063ebd7b47e6a5ec4ad634c4b3a20d6578b94924e779883e75661c6baae00a
Opcode Fuzzy Hash: deadc8968076f8caea13905e5e163463e25b816dffd795125141a152398972e1
Instruction Fuzzy Hash: EC119434205200DFD701EBA9EE8AB5977D4EB58318F60043BF5008B3A1D7796C41D75D

Function 0047C8F0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0047C93A

Strings

Failed to remove temporary directory: , xrefs: 0047C953

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CountTick
String ID: Failed to remove temporary directory:
API String ID: 536389180-3544197614
Opcode ID: dc8948da4a4a7ae9023587f3da3a2e6f7f3b241635aa5e5e9c389959d50d6392
Instruction ID: 4760cced9017b54e13c9f61f972d9509a01cb90d2ec48e282b59cce5c1cf7d6e
Opcode Fuzzy Hash: dc8948da4a4a7ae9023587f3da3a2e6f7f3b241635aa5e5e9c389959d50d6392
Instruction Fuzzy Hash: 3601F5B0604300BBEB21EB72DCC3B9A3798DB04708F60847FB904A6192DA7C9D44C91C

Function 0047C048 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,37H,?,00000001,?,?,00483733,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,?,?,0047C294,00000000,0047C496), ref: 0047C08D

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0047C05D

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CloseOpen
String ID: Software\Microsoft\Windows\CurrentVersion
API String ID: 47109696-1019749484
Opcode ID: 4557a8a00227220340c3e4977130da833b2a1323f27f77b3f73a7f4a79cd4b82
Instruction ID: 7780268eed0c8f4662378fdb42213bb4dbf55a51eddc9185eecb2e6195c6093a
Opcode Fuzzy Hash: 4557a8a00227220340c3e4977130da833b2a1323f27f77b3f73a7f4a79cd4b82
Instruction Fuzzy Hash: AEF08971700514A7DA10A5EA5D82B9F97DD8B84718F20403FF608DB242D97A9D0242AC

Function 0046ED8C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,NoModify,00000000,00000004,00000000,00000004,00000001,?,0046F40A,?,?,00000000,0046F5CE,?,_is1,?), ref: 0046ED9F

Strings

NoModify, xrefs: 0046ED9D

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Value
String ID: NoModify
API String ID: 3702945584-1699962838
Opcode ID: b27336c5fecbb1443f888c6773f82653806ca827597cc1e8ae363085aea7e5d6
Instruction ID: ce951061c90f104f5223ccf2311ea7346df234e4a3633a8a799f5004e5bcc4b2
Opcode Fuzzy Hash: b27336c5fecbb1443f888c6773f82653806ca827597cc1e8ae363085aea7e5d6
Instruction Fuzzy Hash: 8FE04FB4600304BFEB04DB55CD4AF6B77ECDB48710F104459BA049B2C1F674EE00C668

Function 00454100 Relevance: 3.2, APIs: 2, Instructions: 200fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,00454346,?,00000000,004543BA,?,?,-00000001,00000000,?,0047C94F,00000000,0047C89C,00000000), ref: 00454322
FindClose.KERNEL32(000000FF,0045434D,00454346,?,00000000,004543BA,?,?,-00000001,00000000,?,0047C94F,00000000,0047C89C,00000000,00000000), ref: 00454340

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: a2d2c427da41bec08c4131e075aeae3070bf8721d9ab0642b01b3075f7050549
Instruction ID: 54d7d993b90550b5414970fc4389b15b7902a372ed294bc13edf2f45dfba5a61
Opcode Fuzzy Hash: a2d2c427da41bec08c4131e075aeae3070bf8721d9ab0642b01b3075f7050549
Instruction Fuzzy Hash: BE817430A0424D9FCF11DFA5C8457EFBB74AF49309F1440A6EC546B3A2D3399A8ACB58

Function 0047DFBC Relevance: 3.2, APIs: 2, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetACP.KERNEL32(?,?,00000001,00000000,0047E29B,?,-0000001A,00480151,-00000010,?,00000004,0000001B,00000000,0048049E,?,0045DA40), ref: 0047E032

Part of subcall function 0042E31C: GetDC.USER32(00000000), ref: 0042E32B
Part of subcall function 0042E31C: EnumFontsA.GDI32(?,00000000,0042E308,00000000,00000000,0042E374,?,00000000,00000000,00480505,?,?,00000001,00000000,00000002,00000000), ref: 0042E356
Part of subcall function 0042E31C: ReleaseDC.USER32(00000000,?), ref: 0042E36E

SendNotifyMessageA.USER32(00020430,00000496,00002711,-00000001), ref: 0047E202

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: EnumFontsMessageNotifyReleaseSend
String ID:
API String ID: 2649214853-0
Opcode ID: e069609ba70995731fce56cf8c0ca3ad2046ca999320bde79dabfce6c78656cc
Instruction ID: d64b11983fe8068f8d25d91e2f6d6775ebb50eb4b37eaa3905fc54ead9bc7a6e
Opcode Fuzzy Hash: e069609ba70995731fce56cf8c0ca3ad2046ca999320bde79dabfce6c78656cc
Instruction Fuzzy Hash: D85189346001108BC710FF67D98169A37E9EB58309B90C67BA4099B3A7D77CDD46C79E

Function 00402088 Relevance: 3.1, APIs: 2, Instructions: 122COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0049B420,00000000,004021FC), ref: 004020CB

Part of subcall function 004019CC: RtlInitializeCriticalSection.KERNEL32(0049B420,00000000,00401A82,?,?,0040222E,02188000,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
Part of subcall function 004019CC: RtlEnterCriticalSection.KERNEL32(0049B420,0049B420,00000000,00401A82,?,?,0040222E,02188000,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
Part of subcall function 004019CC: LocalAlloc.KERNEL32(00000000,00000FF8,0049B420,00000000,00401A82,?,?,0040222E,02188000,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
Part of subcall function 004019CC: RtlLeaveCriticalSection.KERNEL32(0049B420,00401A89,00000000,00401A82,?,?,0040222E,02188000,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CriticalSection$Enter$AllocInitializeLeaveLocal
String ID:
API String ID: 296031713-0
Opcode ID: ebf89ec9946ffca36a0132b944b47ea39fd8c2f47339ecb3e8f74b5db6fcd291
Instruction ID: 30adadd309813d1a6846ca6b4958dbaac508113c784b73a5bb8d11bfdb372a30
Opcode Fuzzy Hash: ebf89ec9946ffca36a0132b944b47ea39fd8c2f47339ecb3e8f74b5db6fcd291
Instruction Fuzzy Hash: 3941E3B2E00304DFDB10CF69EE8521A77A4F7A8324B15417FD854A77E2D3789801DB88

Function 0042DEC0 Relevance: 3.1, APIs: 2, Instructions: 111registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,0042DFD6,?,?,00000008,00000000,00000000,0042E003), ref: 0042DF6C
RegCloseKey.ADVAPI32(?,0042DFDD,?,00000000,00000000,00000000,00000000,00000000,0042DFD6,?,?,00000008,00000000,00000000,0042E003), ref: 0042DFD0

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CloseEnum
String ID:
API String ID: 2818636725-0
Opcode ID: e77826d40a5e4f632c8342fe42b5bbba14c0f7fcc87f12accc1dd26e8e9f799a
Instruction ID: d62689c7b7995b9893119ef97773413105dd68debc8ff02f2d4f9d8a28cc91ff
Opcode Fuzzy Hash: e77826d40a5e4f632c8342fe42b5bbba14c0f7fcc87f12accc1dd26e8e9f799a
Instruction Fuzzy Hash: DD31B270F04258AEDB11DFA6DD42BAEBBB9EB49304F91407BE501E6280D6785E01CA2D

Function 00476264 Relevance: 3.1, APIs: 2, Instructions: 89timeCOMMON

Download Yara Rule

APIs

LocalFileTimeToFileTime.KERNEL32(?,?,?,00000000,00000000,0047635B,?,00000000,0047636C,?,00000000,004763B5), ref: 0047632C
SetFileTime.KERNEL32(?,00000000,00000000,?,?,?,?,00000000,00000000,0047635B,?,00000000,0047636C,?,00000000,004763B5), ref: 00476340

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: FileTime$Local
String ID:
API String ID: 791338737-0
Opcode ID: 6c6a2467c40a63664237c32457b7bb5c1565228ee1ed6a70e795839eeaf50b2b
Instruction ID: ef619fc15b639f47a17469def826feda9b5326419f2168b57c95aa5c70508a69
Opcode Fuzzy Hash: 6c6a2467c40a63664237c32457b7bb5c1565228ee1ed6a70e795839eeaf50b2b
Instruction Fuzzy Hash: FC31B530B04645AFCB11DFA5C892EAFBBB9EB09704F41847AFD04A7391D6799900CB55

Function 004527E8 Relevance: 3.1, APIs: 2, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,?,?,00458150,00000000,00458138,?,?,?,00000000,00452862,?,?,?,00000001), ref: 0045283C
GetLastError.KERNEL32(00000000,00000000,?,?,00458150,00000000,00458138,?,?,?,00000000,00452862,?,?,?,00000001), ref: 00452844

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CreateErrorLastProcess
String ID:
API String ID: 2919029540-0
Opcode ID: 32d7980bd8ec2bee900e92c865b72ef71cfaa45d55aa0c85c0401d49ed696f28
Instruction ID: fcc055d8c1a696a2a0db1e32a085008d871673fec5534948229a16d4440eefa6
Opcode Fuzzy Hash: 32d7980bd8ec2bee900e92c865b72ef71cfaa45d55aa0c85c0401d49ed696f28
Instruction Fuzzy Hash: A2113C72600208AF8B40DEA9DD41D9F77ECEB4E310B114567FD18D3241D678EE148B68

Function 0040ADD8 Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00400000,00000000,0000000A), ref: 0040ADF2
FreeResource.KERNEL32(00000000,00400000,00000000,0000000A,F0E80040,00000000,?,?,0040AF4F,00000000,0040AF67,?,?,?,00000000), ref: 0040AE03

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Resource$FindFree
String ID:
API String ID: 4097029671-0
Opcode ID: fb2794c8357d1ecacf77e813736bb8f48658a636536de766f5b2d30593d93c64
Instruction ID: 3d7a77417cef7b3885e8747e4544195f2de945da78ee84bb1155330bb8f828e3
Opcode Fuzzy Hash: fb2794c8357d1ecacf77e813736bb8f48658a636536de766f5b2d30593d93c64
Instruction Fuzzy Hash: 0301F771300700AFD700FF69EC52E1B77EDDB46714710807AF500AB3D1D639AC10966A

Function 0041EEA4 Relevance: 3.0, APIs: 2, Instructions: 49threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0041EEF3
EnumThreadWindows.USER32(00000000,0041EE54,00000000), ref: 0041EEF9

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Thread$CurrentEnumWindows
String ID:
API String ID: 2396873506-0
Opcode ID: 30aad164e0a195eeb96462141dc827bf49acbc8680001675c00c89b7ac155170
Instruction ID: bcaa23655132f8f2785c0a842f21b48ac99b37e3223c43442b01e3940dbd0cdf
Opcode Fuzzy Hash: 30aad164e0a195eeb96462141dc827bf49acbc8680001675c00c89b7ac155170
Instruction Fuzzy Hash: 31015B76A04604BFD706CF6BEC1199ABBE8E789720B22887BEC04D3690E7355C10DF18

Function 00452C80 Relevance: 3.0, APIs: 2, Instructions: 48fileCOMMON

Download Yara Rule

APIs

MoveFileA.KERNEL32(00000000,00000000), ref: 00452CC2
GetLastError.KERNEL32(00000000,00000000,00000000,00452CE8), ref: 00452CCA

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ErrorFileLastMove
String ID:
API String ID: 55378915-0
Opcode ID: 92f277caa9c3c56662d1ce6f28aaa0531c95695199337b3952b9b7b9e7465d28
Instruction ID: 1f9035ddd188b097fe3d15476f32cd7793c58c8f4df07880d9fc6ba60e4ff235
Opcode Fuzzy Hash: 92f277caa9c3c56662d1ce6f28aaa0531c95695199337b3952b9b7b9e7465d28
Instruction Fuzzy Hash: 9401D671A04208AB8712EB799D4149EB7ECEB8A32575045BBFC04E3243EA785E048558

Function 00452770 Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,004527CF), ref: 004527A9
GetLastError.KERNEL32(00000000,00000000,00000000,004527CF), ref: 004527B1

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 4f51abd24ab49e498324db0d830057948f0c156f87ca6c4ec52d10be1f4c5d92
Instruction ID: e3b373b60118a844676bb749001e6832c3b26a50706decb61b3ae2e0e224b701
Opcode Fuzzy Hash: 4f51abd24ab49e498324db0d830057948f0c156f87ca6c4ec52d10be1f4c5d92
Instruction Fuzzy Hash: 40F02871A00308BBCB01EF759D4259EB7E8EB4E311B2045B7FC04E3642E6B94E04859C

Function 00452908 Relevance: 3.0, APIs: 2, Instructions: 42fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,00000000,00452965,?,-00000001,?), ref: 0045293F
GetLastError.KERNEL32(00000000,00000000,00452965,?,-00000001,?), ref: 00452947

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: 8e20ab251d088d0bfaf69feb7d17608973a6f06366ba1158c9466a0d895ab982
Instruction ID: a1d21d86fbcf93c7076efe682877c1f84c37cf58088428800e153654eea74c02
Opcode Fuzzy Hash: 8e20ab251d088d0bfaf69feb7d17608973a6f06366ba1158c9466a0d895ab982
Instruction Fuzzy Hash: 05F0C2B2B04608ABDB01EFB59D414AEB7E8EB4E315B6045B7FC04E3742E6B85E148598

Function 00452E10 Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

RemoveDirectoryA.KERNEL32(00000000,00000000,00452E6D,?,-00000001,00000000), ref: 00452E47
GetLastError.KERNEL32(00000000,00000000,00452E6D,?,-00000001,00000000), ref: 00452E4F

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: f20199e737e539a63e7b44ed2747663bd9db8366f39d7150388d1a26e91210d5
Instruction ID: a8b2bafe79397aca91686f8656b478e2385adfe3b855dfce5f6cc0b9ba314abc
Opcode Fuzzy Hash: f20199e737e539a63e7b44ed2747663bd9db8366f39d7150388d1a26e91210d5
Instruction Fuzzy Hash: 70F0FC71A04708AFCF01EF759D4249EB7E8DB4E31575049B7FC14E3642E7785E048598

Function 0042323C Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F00), ref: 00423249
LoadCursorA.USER32(00000000,00000000), ref: 00423273

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CursorLoad
String ID:
API String ID: 3238433803-0
Opcode ID: 0c9a104e89a33193f60416200903d3bd70bbd31149720632682593485f60625b
Instruction ID: 5e34cf6406f075c2c63d733b1f02ef4b9a88184ee1572dc0f3c8875cc615d59b
Opcode Fuzzy Hash: 0c9a104e89a33193f60416200903d3bd70bbd31149720632682593485f60625b
Instruction Fuzzy Hash: 9EF0A711B04254AADA109E7E6CC0D6B72A8DF82735B61037BFA3EC72D1C62E1D414569

Function 0042E394 Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008000), ref: 0042E39E
LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 255a0478d79177ccbef95319841b9e9e828fbe5b8587ea3eaa3c8c427559dbd8
Instruction ID: 14c2566281f292fbf4bc3f3871eddb8f7eb4f11f4d1149329263d7d1c8790498
Opcode Fuzzy Hash: 255a0478d79177ccbef95319841b9e9e828fbe5b8587ea3eaa3c8c427559dbd8
Instruction Fuzzy Hash: 02F08970B147447FDB119F779CA241BBBECDB49B1175249B6F800A3591E53C4910C928

Function 0047678C Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(6F5027E0,?,?,?,?), ref: 004767B9
CallWindowProcW.USER32(FFFF0469,?,?,?,?), ref: 004767CA

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 4aae512627136846cb04b36f127d2b35c30ac0fa2ec00dc50a7c14aa0d4939c4
Instruction ID: 1219a5ba84ab03939c43bccac728164024fd08da7027a3a95cad6b1af82576aa
Opcode Fuzzy Hash: 4aae512627136846cb04b36f127d2b35c30ac0fa2ec00dc50a7c14aa0d4939c4
Instruction Fuzzy Hash: EAF030B6110708BBEA04DAA9DCD9CA7776DDF49364B048227BD18972A0D178AC0486B8

Function 0047C3DF Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(00499D40,00008000,00000000,?), ref: 0047C3EF
CoTaskMemFree.OLE32(?,0047C432), ref: 0047C425

Strings

COMMAND.COM, xrefs: 0047C471
Failed to get path of 64-bit Common Files directory, xrefs: 0047C360
SystemDrive, xrefs: 0047C227
ProgramFilesDir, xrefs: 0047C288, 0047C30F
cmd.exe, xrefs: 0047C450
Failed to get path of 64-bit Program Files directory, xrefs: 0047C331
Common Files, xrefs: 0047C2F9
CommonFilesDir, xrefs: 0047C2C2, 0047C33E
\Program Files, xrefs: 0047C2AF

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: FolderFreeKnownPathTask
String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
API String ID: 969438705-544719455
Opcode ID: f49e17189a8e127d810c726b17742940271c18109cdabf392ea144cc89c97294
Instruction ID: 78bb290b036081a8c854dfe2dcd0608ff47ffb153639a71a40c08638323bd745
Opcode Fuzzy Hash: f49e17189a8e127d810c726b17742940271c18109cdabf392ea144cc89c97294
Instruction Fuzzy Hash: 92E09B70340600AEDB11DB61DDA3F7977ACEB48B00BA18477F500E1681D67C6D00895C

Function 00482FA0 Relevance: 3.0, APIs: 2, Instructions: 17COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00482FAA
GetTickCount.KERNEL32 ref: 00482FA1

Part of subcall function 00482F6C: GetForegroundWindow.USER32(00000000,00000000,?,?,00482FD1,?,004830B6,?,?,00000000), ref: 00482F72
Part of subcall function 00482F6C: GetWindowThreadProcessId.USER32(00000000,?), ref: 00482F84
Part of subcall function 00482F6C: GetCurrentProcessId.KERNEL32(00000000,?,00000000,00000000,?,?,00482FD1,?,004830B6,?,?,00000000), ref: 00482F8D

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CountProcessTickWindow$CurrentForegroundThread
String ID:
API String ID: 711787588-0
Opcode ID: 0111aa82c2b9838541359b9666df3c7aa511cc11df4b908869c74b293a307c4c
Instruction ID: 2e8ccacf02ce903f79dbe11524d4d09067cf2d2383abf652664fbdbb30b0bc4a
Opcode Fuzzy Hash: 0111aa82c2b9838541359b9666df3c7aa511cc11df4b908869c74b293a307c4c
Instruction Fuzzy Hash: 8DD0A95020024241CE0032FB468622D0128AF1636CB001C2FBB4AAA083CE9C4086E33F

Function 0041EFF4 Relevance: 3.0, APIs: 2, Instructions: 16threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0041F00E
EnumThreadWindows.USER32(00000000,0041EF90,00000000), ref: 0041F014

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Thread$CurrentEnumWindows
String ID:
API String ID: 2396873506-0
Opcode ID: 28faba8d13260114aebe4435219a546304dde162066a62bc81d999aa95987238
Instruction ID: 1bd0ab66c6aeceffdc4f5e21b8af03a27ec20acb013402289ac5ff21683637d0
Opcode Fuzzy Hash: 28faba8d13260114aebe4435219a546304dde162066a62bc81d999aa95987238
Instruction Fuzzy Hash: EBE02676600200AEDB12DF7AAD4575B37D0A394314F12483FA904D61A1D2745C84DB19

Function 004014E4 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,004017ED), ref: 00401513
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,004017ED), ref: 0040153A

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 94577317c2bcd4d3a70d22c0b2f2fc78c72c60cff144ef5375d29febf27e2799
Instruction ID: 119661fe7174a079321c86e78af40791ac039b5eb8373b45468023a5ba433726
Opcode Fuzzy Hash: 94577317c2bcd4d3a70d22c0b2f2fc78c72c60cff144ef5375d29febf27e2799
Instruction Fuzzy Hash: F7F08272A0063067EB60596A4C81B5359859BC5B94F154076FD09FF3E9D6B58C0142A9

Function 004085DC Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00408712), ref: 004085FB

Part of subcall function 00406DEC: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00406E09

Part of subcall function 00408568: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049B4C0,00000001,?,00408633,?,00000000,00408712), ref: 00408586

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: 92125e52594e5bc8ee6d97e09480d95589045c4468e862feaba19903f63d3f1d
Instruction ID: 9026c6f0acc6bf601755118861b832b1e3c4c92574a9a05948c89544872af2a3
Opcode Fuzzy Hash: 92125e52594e5bc8ee6d97e09480d95589045c4468e862feaba19903f63d3f1d
Instruction Fuzzy Hash: 47314E35E00109ABCB00EB55CC819EEB779EF84314F558577E815BB286EB38AA018B98

Function 0041FB9C Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

SetScrollInfo.USER32(00000000,?,?,00000001), ref: 0041FC39

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: InfoScroll
String ID:
API String ID: 629608716-0
Opcode ID: a0ce2aaa01497ac04468ea6ac7a83421c49688bcbeeff2d3e991700215f3b25f
Instruction ID: 6365c2cd079840e4170b7c9ce409c3d873e807bce8729d2e10e5c00059922083
Opcode Fuzzy Hash: a0ce2aaa01497ac04468ea6ac7a83421c49688bcbeeff2d3e991700215f3b25f
Instruction Fuzzy Hash: D8214FB1608746AFC351DF3984407A6BBE4BB48344F14893EE498C3741E778E99ACBD6

Function 0046C328 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0041EEA4: GetCurrentThreadId.KERNEL32 ref: 0041EEF3
Part of subcall function 0041EEA4: EnumThreadWindows.USER32(00000000,0041EE54,00000000), ref: 0041EEF9

SHPathPrepareForWriteA.SHELL32(00000000,00000000,00000000,00000000,00000000,0046C386,?,00000000,?,?,0046C598,?,00000000,0046C60C), ref: 0046C36A

Part of subcall function 0041EF58: IsWindow.USER32(?), ref: 0041EF66
Part of subcall function 0041EF58: EnableWindow.USER32(?,00000001), ref: 0041EF75

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ThreadWindow$CurrentEnableEnumPathPrepareWindowsWrite
String ID:
API String ID: 3319771486-0
Opcode ID: 875ecd16d026c9fb2f47fe667a946e0b43a0f47f451e50900a60f5c842b0ed02
Instruction ID: 7e5312134c404819c948a8388fb2839a3e812e0a8cd15d5c2d1e8ddeefbff487
Opcode Fuzzy Hash: 875ecd16d026c9fb2f47fe667a946e0b43a0f47f451e50900a60f5c842b0ed02
Instruction Fuzzy Hash: 7FF0E270209300BFEB15AFB2EC96B2977E8E748714F61443BF904C6690E6795880C52E

Function 00416550 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(?,?,?,?,?,?,?,?,?,00000000,00400000,?), ref: 00416585

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: b152e844846ae8a52721441d180559fdf16f7956a15d86c9ff4cf0dcda8b9698
Instruction ID: 158b8484bb218b41c698b3aa21f26e2dd86497bc01e640ef524e7c8f4c0ee3c6
Opcode Fuzzy Hash: b152e844846ae8a52721441d180559fdf16f7956a15d86c9ff4cf0dcda8b9698
Instruction Fuzzy Hash: 4BF019B2200510AFDB84DE9CD9C0F9773ECEB0C210B0481A6FA08CB21AD220EC108BB0

Function 004149B4 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?), ref: 004149EF

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction ID: 59ac3629b8f45f7a6bca1b57e2bf54285868c68ba6336e642f1ef9b7bb8d2b05
Opcode Fuzzy Hash: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction Fuzzy Hash: B2F0DA762042019FC740DF6CC8C488A77E5FF89255B5546A9F989CB356C731EC54CB91

Function 004507C4 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 00450804

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ce99838f7be0491c6923214398908b2fd93372403a84c7b432a549debe4dc153
Instruction ID: 52eb814c7c241dc182afdc6c3e242d4e4c9a4e6d94000e289351c80ae23ff87c
Opcode Fuzzy Hash: ce99838f7be0491c6923214398908b2fd93372403a84c7b432a549debe4dc153
Instruction Fuzzy Hash: 53E012B53541483EE780EEAD6C42F9777DC971A714F008037B998D7341D461DD158BA8

Function 0042CCCC Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,0042CD14,?,00000001,?,?,00000000,?,0042CD66,00000000,00452A25,00000000,00452A46,?,00000000), ref: 0042CCF7

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 00b3057be2b7f487f29192626b11eab3da9f9548613e8b85f168c5d0410c37ae
Instruction ID: d3c11148bbbe1678040d416a6bc301cfea82702c80b798926358c5e84281cc0e
Opcode Fuzzy Hash: 00b3057be2b7f487f29192626b11eab3da9f9548613e8b85f168c5d0410c37ae
Instruction Fuzzy Hash: 80E065B1304304BFD701EB66EC92A5EBAACDB49754BA14876B50097592D5B86E008468

Function 0042E8C8 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00453273,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E8E7

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 07eb917982e44065cc90d67cadef310e262c4caec6bcfbb1197f6d5f5d2cfc19
Instruction ID: fbc307da5c1359fbfbc351051067b699ae1438aedf6613c80dda169529e76e7e
Opcode Fuzzy Hash: 07eb917982e44065cc90d67cadef310e262c4caec6bcfbb1197f6d5f5d2cfc19
Instruction Fuzzy Hash: BCE0206278431116F2353416AC47B77150E43C0708F944027BB90DF3D3D6AF9945D25E

Function 004062E8 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000000,0042367C,00000000,94CA0000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00406311

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ff94722aa4050723ad3f6c96c0112c9f8192a5aa4540eb1f1ae13447e7542d04
Instruction ID: 53e57476791a39574122dfc8a3f58f2f78c4a621b5a82e38d1c80b15216a1e52
Opcode Fuzzy Hash: ff94722aa4050723ad3f6c96c0112c9f8192a5aa4540eb1f1ae13447e7542d04
Instruction Fuzzy Hash: EEE0FEB2214209BBDB00DE8ADCC1DABB7ACFB4C654F808105BB1C972428275AC608B71

Function 0042DDE4 Relevance: 1.5, APIs: 1, Instructions: 26registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DE10

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 296f4a6b1841180fcb6525c1425398a2afe0618770c3240f8adf4a5c8222c494
Instruction ID: 68673b5cf84413dff1d7ecec16939cb2303f89f305828e6cd22260af4b89741b
Opcode Fuzzy Hash: 296f4a6b1841180fcb6525c1425398a2afe0618770c3240f8adf4a5c8222c494
Instruction Fuzzy Hash: EDE07EB2610119AF9B40DE8CDC81EEB37ADAB1D350F404016FA08E7200C2B4EC519BB4

Function 00454BF8 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(00000000,000000FF,00470848,00000000,0047165E,?,00000000,004716A7,?,00000000,004717E0,?,00000000,?,00000000), ref: 00454C0E

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: aadebc8b53df3de256c4b1b5725a3a32280a250bc883bef4a10d561e7000b356
Instruction ID: 5c2dbd3a099336849a47a332199978da45cb785deb8a29a76394180ab3bc5383
Opcode Fuzzy Hash: aadebc8b53df3de256c4b1b5725a3a32280a250bc883bef4a10d561e7000b356
Instruction Fuzzy Hash: A1E09BB09097004BC715DF39858031A76D19FC9325F05C96AEC99CF3D7E77D84454617

Function 0041467C Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(004955C2,?,004955E4,?,?,00000000,004955C2,?,?), ref: 0041469B

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction ID: 3a83c41fa5c3d176b15f2666d2672a78f9af76d4247255e2ff0bda4df6ea0631
Opcode Fuzzy Hash: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction Fuzzy Hash: 59E012723001199F8250CE5EDC88C57FBEDEBC966130983A6F508C7306DA31EC44C7A0

Function 00406F10 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00406F24

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 4c02731fe18b0a47ab7745946c5e8dd4c7dfafdb2aa22804bebcbb41d9412fbb
Instruction ID: adeaf4ebd0e6cd94d64be6b3cb299443ba394f13a0b1cd3d8337db6b6af80796
Opcode Fuzzy Hash: 4c02731fe18b0a47ab7745946c5e8dd4c7dfafdb2aa22804bebcbb41d9412fbb
Instruction Fuzzy Hash: 53D012722091506AD220965A6C44EAB6BDCCBC5770F11063AB558C2181D7209C01C675

Function 0042364C Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 004235F8: SystemParametersInfoA.USER32(00000048,00000000,00000000,00000000), ref: 0042360D

ShowWindow.USER32(00410460,00000009,?,00000000,0041EDA4,0042393A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00423667

Part of subcall function 00423628: SystemParametersInfoA.USER32(00000049,00000000,00000000,00000000), ref: 00423644

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: InfoParametersSystem$ShowWindow
String ID:
API String ID: 3202724764-0
Opcode ID: 7b120fb8f3e198202e6e1662029165cdd5ac94201a1216f50b6deb174ece9cf4
Instruction ID: 3e39ddd90fb628193caaea160b6f4ed5bf244f394cc2da11a07db6b12dca8b82
Opcode Fuzzy Hash: 7b120fb8f3e198202e6e1662029165cdd5ac94201a1216f50b6deb174ece9cf4
Instruction Fuzzy Hash: 34D05E123821703142307ABB280699B46EC8D822EB389043BB5449B312ED5DCE01116C

Function 004242C4 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(?,00000000), ref: 004242DC

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 968e2600307bd84f4d65718215a4df57ccfa9b7919b98356d7a542cd4e907fd2
Instruction ID: e359d8c046b4275bb87a72ac3440150ee0889cd0e7de0465f76ccf46c1161c2e
Opcode Fuzzy Hash: 968e2600307bd84f4d65718215a4df57ccfa9b7919b98356d7a542cd4e907fd2
Instruction Fuzzy Hash: 81D05EE27011602BCB01BAED54C4AC667CC9B8D25AB1840BBF904EF257D638CE40C398

Function 0042CD6C Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00452C55,00000000,00452C6E,?,-00000001,00000000), ref: 0042CD77

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: e4e221269d90e6e77bb9141cf69f4d14af136adba67872c9c3d3ba7e619b8cd0
Instruction ID: 2eab32a2699244162946c929296992ee32eb3599f5fc22494aed3d9886f7b4af
Opcode Fuzzy Hash: e4e221269d90e6e77bb9141cf69f4d14af136adba67872c9c3d3ba7e619b8cd0
Instruction Fuzzy Hash: 51D012D036121015DF1455BD28C535F05884B65375BA82F37B66DE62E2D23D8857281C

Function 00466A18 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,00467700,00000000,00000000,00000000,0000000C,00000000), ref: 00466A30

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
Instruction ID: a3a9c25b9c80179eca176ae0059a0aa24e3542550d9dc9bac8dced773014ab2a
Opcode Fuzzy Hash: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
Instruction Fuzzy Hash: 0ED09272210A109F8364CAADC9C4C97B3ECEF4C2213004659E54AC3B15D664FC018BA0

Function 0042CD24 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,004515CB,00000000), ref: 0042CD2F

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 3e212e939afd4966d1e5dd69d95018e4efbd2efd6da352e945c0cda6919741a9
Instruction ID: 53db4a1afaa3b7bebcc80daf879f764776582c58df104e6651e2d127eece83ed
Opcode Fuzzy Hash: 3e212e939afd4966d1e5dd69d95018e4efbd2efd6da352e945c0cda6919741a9
Instruction Fuzzy Hash: 48C08CE03222001A9E60A6BD2CC551F06CC891423A3A41E3BB129EB2E2D23D88162818

Function 00406EC0 Relevance: 1.5, APIs: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,0040A6D4,0040CC80,?,00000000,?), ref: 00406EDD

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d487f09bce5ab2446fefe52ff91139140134d323c8d44495a9ab4cbc0f9c4527
Instruction ID: fbce42704b7dd2fd8be74a622cf743b4adaa06f64be9adac3ea2875d17ee2119
Opcode Fuzzy Hash: d487f09bce5ab2446fefe52ff91139140134d323c8d44495a9ab4cbc0f9c4527
Instruction Fuzzy Hash: EAC048A13C130032F92035A60C87F16008C5754F0AE60C43AB740BF1C2D8E9A818022C

Function 0045092C Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,?,0045C21A,00000000,0045C3A5,?,00000000,00000002,00000002), ref: 00450933

Part of subcall function 004506B4: GetLastError.KERNEL32(004504D0,00450776,?,00000000,?,00497A0C,00000001,00000000,00000002,00000000,00497B6D,?,?,00000005,00000000,00497BA1), ref: 004506B7

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: dfd6122944db5b319254e7b77af95d7469dcf5406d44b15aeae4525e96e42585
Instruction ID: 9573b676cf6dd5fef234c73c81a1a5d02d78d5ca05287b50762f3c98dcfac2da
Opcode Fuzzy Hash: dfd6122944db5b319254e7b77af95d7469dcf5406d44b15aeae4525e96e42585
Instruction Fuzzy Hash: 1AC04CA5700211479F10A6BA85C1A0662D86A5D3157144066BD08CF207D668D8148A18

Function 00406F50 Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,0049B628,004982D1,00000000,00498326,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F5B

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 974406c8209f5f2baf9aa7f60898e2c16b4dbb69ce3e1bfb04616041c36a0a4c
Instruction ID: 1cff4f98fe1f8e2c1d524c72e998173d896329315b0501cca3ecf0a0fad01fcd
Opcode Fuzzy Hash: 974406c8209f5f2baf9aa7f60898e2c16b4dbb69ce3e1bfb04616041c36a0a4c
Instruction Fuzzy Hash: E4B012E13D224A26CB0079FE4CC1D1A00CC4A293063406A3A3006F72C3D83CC8180014

Function 004072A8 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(00000000,?,0049799A,00000000,00497B6D,?,?,00000005,00000000,00497BA1,?,?,00000000), ref: 004072B3

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 9cfe1b671e2ded52e2a4f1899edd371c25323ab6eac1b77aed394817f5a1d109
Instruction ID: 2ee9fcf0c2ecb8048618371478a38130c752a95b947e2a8aefd026f579ab26ad
Opcode Fuzzy Hash: 9cfe1b671e2ded52e2a4f1899edd371c25323ab6eac1b77aed394817f5a1d109
Instruction Fuzzy Hash: 33B012E03D120A2BCA0079FE4CC192A00CC46292163401B3B3006EB1C3D83DC8180824

Function 0044FE04 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,00450010,00000000,?,004682B8,0000000C,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,?), ref: 0044FE22

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 80b3e3336f136fa094e5bf735bbe293ae774cbadf16b6798ba5e4c8953333e60
Instruction ID: 66f3cd114cd8849fa0b5cd02f95834ec0ce5bd652375c405162ae2aedd08d897
Opcode Fuzzy Hash: 80b3e3336f136fa094e5bf735bbe293ae774cbadf16b6798ba5e4c8953333e60
Instruction Fuzzy Hash: A1D0C9B05022448EDB50EB69FA8472233E4E328346F18503FE500CA26AF33A8C44CF9C

Function 0042E3EF Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,0042E40D), ref: 0042E400

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: cb8e2ebd86b0ac1182f6c4657d989dfa6a466ad308997f4b3834ff3b1e7758f7
Instruction ID: 426ac138898b17598b25982f2c454791bd479401c65f9a69ae9baa170422678e
Opcode Fuzzy Hash: cb8e2ebd86b0ac1182f6c4657d989dfa6a466ad308997f4b3834ff3b1e7758f7
Instruction Fuzzy Hash: CDB09B7670C6105EE709D6D5B45552D63D4D7C57207E14477F010D2581D57D58054E18

Function 0047CC20 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,0048157B), ref: 0047CC36

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 7ac9dcef1b4596372a865af428db5c1749cc9498ac2df90e17d1b598c6576eff
Instruction ID: ed453d699ff6dac46e13df25dce852f7a9571d2290e9a004c16fc2be8befa713
Opcode Fuzzy Hash: 7ac9dcef1b4596372a865af428db5c1749cc9498ac2df90e17d1b598c6576eff
Instruction Fuzzy Hash: A4C002717512018EC759DB799DD5B6536D8A724305F00543B5414E7165DA346440CB6C

Function 004817B8 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(00000000,00000012,00000000,00000000), ref: 004817C0

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 8abd7250b863d5bcc9c16d1c67e29cf1100666b6d2ef3896e20c3eae561ef315
Instruction ID: fbd2fd99f2342ae97ce2e912f06b4f6775a0193fa59faa32ac81747571f1ea96
Opcode Fuzzy Hash: 8abd7250b863d5bcc9c16d1c67e29cf1100666b6d2ef3896e20c3eae561ef315
Instruction Fuzzy Hash: E2A002343C430430F47462511D03F4400441744F05EE1909573053C0C704D82520201E

Function 004165EC Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?), ref: 004165F3

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: DestroyWindow
String ID:
API String ID: 3375834691-0
Opcode ID: 1244af60e57b01067fe56da529b9c4312cbd500fa9ed17bad69dff1823a021af
Instruction ID: 4f6e5339ba6c71e81ef5aec1f6829bfe42d3c8de95bc03762545e97b2cddf6f9
Opcode Fuzzy Hash: 1244af60e57b01067fe56da529b9c4312cbd500fa9ed17bad69dff1823a021af
Instruction Fuzzy Hash: 1AA00275501500AADA00E7B5D849F7E2298BB44204FD905F9714897056C57C99008B55

Function 00448728 Relevance: 1.4, APIs: 1, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23cd19f4d157b610881d156a0561bf24660ed88a0cfede39be00974ae65a3954
Instruction ID: 41a6872630840156d23f43a697f0b10540748f54e9aa1b8241e7bbe25a2b1888
Opcode Fuzzy Hash: 23cd19f4d157b610881d156a0561bf24660ed88a0cfede39be00974ae65a3954
Instruction Fuzzy Hash: 73517574E002099FDB00EFA9C892AAFBBF5EB49314F50817AE500E7351DB389D41CB98

Function 0041F3C4 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041EDA4,?,0042388F,00423C0C,0041EDA4), ref: 0041F3E2

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f624f178b2757757f6ee0ed82108e7e17b49aa81eb1cfd09d0e3ddd3732ee692
Instruction ID: 3312bc658de40493dbbbdb628fa1ac862c14c743cb2aabe02eeb7d71ec829e14
Opcode Fuzzy Hash: f624f178b2757757f6ee0ed82108e7e17b49aa81eb1cfd09d0e3ddd3732ee692
Instruction Fuzzy Hash: D5115A752007059BCB20DF19D880B82FBE5EF98390F10C53BE9688B385D3B4E8458BA9

Function 00452FC4 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,0045302D), ref: 0045300F

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 796ee09302341f2f0fe022b6b7ad64e2259239b3e6510a293da86372227c0e6a
Instruction ID: b902f5f71593d0acd8113edc39c0d5725662cc955bae9521e0e34912f41e4d76
Opcode Fuzzy Hash: 796ee09302341f2f0fe022b6b7ad64e2259239b3e6510a293da86372227c0e6a
Instruction Fuzzy Hash: 850170356042486FC701DF699C008EEFBE8EB4D76171082B7FC24C3382D7345E059664

Function 0040170C Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00004000,?,?,?,?,?,00401973), ref: 00401766

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 3cb279d385dc81f8188aef87182d0a586e7f532f71175ddb5b892d42a5daf7f8
Instruction ID: fd45504e6079eb3c344fd15592bdf3984e08e9418c18d248e8b2091ea2ac4f2a
Opcode Fuzzy Hash: 3cb279d385dc81f8188aef87182d0a586e7f532f71175ddb5b892d42a5daf7f8
Instruction Fuzzy Hash: A10120766443148FC3109F29EDC0E2677E8D794378F15453EDA85673A1D37A6C0187D8

Non-executed Functions

Function 0041F118 Relevance: 45.6, APIs: 15, Strings: 11, Instructions: 87libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,00418FF0,00000000,?,?,?,00000001), ref: 0041F126
SetErrorMode.KERNEL32(00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F142
LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F14E
SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F15C
GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F18C
GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F1B5
GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F1CA
GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F1DF
GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F1F4
GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F209
GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F21E
GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F233
GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F248
GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F25D
FreeLibrary.KERNEL32(00000001,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F26F

Strings

Ctl3dSubclassCtl, xrefs: 0041F1BF
Ctl3DColorChange, xrefs: 0041F23D
Ctl3dSubclassDlgEx, xrefs: 0041F1D4
CTL3D32.DLL, xrefs: 0041F149
Ctl3dUnAutoSubclass, xrefs: 0041F228
Ctl3dCtlColorEx, xrefs: 0041F1FE
Ctl3dDlgFramePaint, xrefs: 0041F1E9
Ctl3dRegister, xrefs: 0041F181
BtnWndProc3d, xrefs: 0041F252
Ctl3dAutoSubclass, xrefs: 0041F213
Ctl3dUnregister, xrefs: 0041F1AA

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressProc$ErrorLibraryMode$FreeLoadVersion
String ID: BtnWndProc3d$CTL3D32.DLL$Ctl3DColorChange$Ctl3dAutoSubclass$Ctl3dCtlColorEx$Ctl3dDlgFramePaint$Ctl3dRegister$Ctl3dSubclassCtl$Ctl3dSubclassDlgEx$Ctl3dUnAutoSubclass$Ctl3dUnregister
API String ID: 2323315520-3614243559
Opcode ID: 14e3e5f2e917328749ef093614a986abae05d3f075f7e2c7ef23893690e5ba28
Instruction ID: e724c2aa341d6685c6ab1c4031cb88844a897dd828fe35f3324890dc483947ec
Opcode Fuzzy Hash: 14e3e5f2e917328749ef093614a986abae05d3f075f7e2c7ef23893690e5ba28
Instruction Fuzzy Hash: 8E314FB2640700ABEB01EBB9AC46A6B3794F328724741093FB508D7192D77C5C55CF5C

Function 004584A0 Relevance: 40.4, APIs: 11, Strings: 12, Instructions: 186pipeprocessfileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00458507
QueryPerformanceCounter.KERNEL32(00000000,00000000,0045879A,?,?,00000000,00000000,?,00458E96,?,00000000,00000000), ref: 00458510
GetSystemTimeAsFileTime.KERNEL32(00000000,00000000), ref: 0045851A
GetCurrentProcessId.KERNEL32(?,00000000,00000000,0045879A,?,?,00000000,00000000,?,00458E96,?,00000000,00000000), ref: 00458523
CreateNamedPipeA.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 00458599
GetLastError.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000,?,00000000,00000000), ref: 004585A7
CreateFileA.KERNEL32(00000000,C0000000,00000000,00499B24,00000003,00000000,00000000,00000000,00458756), ref: 004585EF
SetNamedPipeHandleState.KERNEL32(000000FF,00000002,00000000,00000000,00000000,00458745,?,00000000,C0000000,00000000,00499B24,00000003,00000000,00000000,00000000,00458756), ref: 00458628

Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7

CreateProcessA.KERNEL32(00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 004586D1
CloseHandle.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000), ref: 00458707
CloseHandle.KERNEL32(000000FF,0045874C,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 0045873F

Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,00497F85,00000000), ref: 0045349F

Strings

64-bit helper EXE wasn't extracted, xrefs: 004584FB
CreateProcess, xrefs: 004586DA
i, xrefs: 00458684
SetNamedPipeHandleState, xrefs: 00458631
Helper process PID: %u, xrefs: 00458724
CreateFile, xrefs: 004585FD
\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x, xrefs: 0045856F
Cannot utilize 64-bit features on this version of Windows, xrefs: 004584E8
helper %d 0x%x, xrefs: 004586B0
D, xrefs: 0045864A
CreateNamedPipe, xrefs: 004585B7
Starting 64-bit helper process., xrefs: 004584D5

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CreateHandle$CloseErrorFileLastNamedPipeProcessSystemTime$CountCounterCurrentDirectoryPerformanceQueryStateTick
String ID: 64-bit helper EXE wasn't extracted$Cannot utilize 64-bit features on this version of Windows$CreateFile$CreateNamedPipe$CreateProcess$D$Helper process PID: %u$SetNamedPipeHandleState$Starting 64-bit helper process.$\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x$helper %d 0x%x$i
API String ID: 770386003-3271284199
Opcode ID: 7b80e965207cd8113120de85ca987cc547943186837d511df9b56330fc4b4e25
Instruction ID: 4fac45827f99e86d35fc8880dd95b28a2747ee355542b7261400ff42129ab219
Opcode Fuzzy Hash: 7b80e965207cd8113120de85ca987cc547943186837d511df9b56330fc4b4e25
Instruction Fuzzy Hash: 19710470A007449EDB10EF69CC45B9EBBF4EB19705F5084BAF904FB282DB7899448F69

Function 0047808C Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00477EF8: GetModuleHandleA.KERNEL32(kernel32.dll,GetFinalPathNameByHandleA,02132C0C,?,?,?,02132C0C,004780BC,00000000,004781DA,?,?,-00000010,?), ref: 00477F11
Part of subcall function 00477EF8: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00477F17
Part of subcall function 00477EF8: GetFileAttributesA.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,02132C0C,?,?,?,02132C0C,004780BC,00000000,004781DA,?,?,-00000010,?), ref: 00477F2A
Part of subcall function 00477EF8: CreateFileA.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,02132C0C,?,?,?,02132C0C), ref: 00477F54
Part of subcall function 00477EF8: CloseHandle.KERNEL32(00000000,?,?,?,02132C0C,004780BC,00000000,004781DA,?,?,-00000010,?), ref: 00477F72

Part of subcall function 00477FD0: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00478062,?,?,?,02132C0C,?,004780C4,00000000,004781DA,?,?,-00000010,?), ref: 00478000

ShellExecuteEx.SHELL32(0000003C), ref: 00478114
GetLastError.KERNEL32(00000000,004781DA,?,?,-00000010,?), ref: 0047811D
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 0047816A
GetExitCodeProcess.KERNEL32(00000000,00000000), ref: 0047818E
CloseHandle.KERNEL32(00000000,004781BF,00000000,00000000,000000FF,000000FF,00000000,004781B8,?,00000000,004781DA,?,?,-00000010,?), ref: 004781B2

Strings

GetExitCodeProcess, xrefs: 00478197
runas, xrefs: 004780E1
=G, xrefs: 004780C4, 004780D3
ShellExecuteEx, xrefs: 0047812E
ShellExecuteEx returned hProcess=0, xrefs: 0047813E
MsgWaitForMultipleObjects, xrefs: 00478177

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Handle$CloseFile$AddressAttributesCodeCreateCurrentDirectoryErrorExecuteExitLastModuleMultipleObjectsProcProcessShellWait
String ID: =G$GetExitCodeProcess$MsgWaitForMultipleObjects$ShellExecuteEx$ShellExecuteEx returned hProcess=0$runas
API String ID: 883996979-2356621170
Opcode ID: 98a4e4fae55201d08ea22943755bdad011bffdb5cef3b6d211370a4e50a33d78
Instruction ID: 465927b674a78934c6441533dfbac97f16e6c6102eec2a8575dd2df8133d4ea1
Opcode Fuzzy Hash: 98a4e4fae55201d08ea22943755bdad011bffdb5cef3b6d211370a4e50a33d78
Instruction Fuzzy Hash: 8531A770A40204AEDB11EFA6C8456DEB7B8EF05314F90843FF408F7682DB3C49018B19

Function 00418384 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00418393
GetWindowPlacement.USER32(?,0000002C), ref: 004183B0
GetWindowRect.USER32(?), ref: 004183CC
GetWindowLongA.USER32(?,000000F0), ref: 004183DA
GetWindowLongA.USER32(?,000000F8), ref: 004183EF
ScreenToClient.USER32(00000000), ref: 004183F8
ScreenToClient.USER32(00000000,?), ref: 00418403

Strings

,, xrefs: 0041839C

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Window$ClientLongScreen$IconicPlacementRect
String ID: ,
API String ID: 2266315723-3772416878
Opcode ID: 093fbc58c9f2bb22a74bd7cb36b3f86111f4d6c014dbe9a16a5ffda61369e0f0
Instruction ID: 8875a2d430ef8be2c5346fa25315cde737655516302bc4d2344e38a88124d083
Opcode Fuzzy Hash: 093fbc58c9f2bb22a74bd7cb36b3f86111f4d6c014dbe9a16a5ffda61369e0f0
Instruction Fuzzy Hash: 2B112B71505201ABEB00DF69C885F9B77E8AF48314F04067EFD58DB296D738D900CB65

Function 004555E4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 004555F3
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 004555F9
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 00455612
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 00455639
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 0045563E
ExitWindowsEx.USER32(00000002,00000000), ref: 0045564F

Strings

SeShutdownPrivilege, xrefs: 0045560B

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 1153bac2f19f83d143aadd10bfaa5f2371894b6c1f4acab214bba93ce73f3def
Instruction ID: 23182b732e3c774e917f784577cc733395bd6f0e504c2650860deaf78f25ff04
Opcode Fuzzy Hash: 1153bac2f19f83d143aadd10bfaa5f2371894b6c1f4acab214bba93ce73f3def
Instruction Fuzzy Hash: CBF0C870294B41B9EA10A6718C17F3B21C89B40709F80083ABD05E90D3D7BDD40C4A2E

Function 00497C84 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 90fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00497DC2,?,?,00000000,0049B628,?,00497F4C,00000000,00497FA0,?,?,00000000,0049B628), ref: 00497CDB
SetFileAttributesA.KERNEL32(00000000,00000010), ref: 00497D5E
FindNextFileA.KERNEL32(000000FF,?,00000000,00497D9A,?,00000000,?,00000000,00497DC2,?,?,00000000,0049B628,?,00497F4C,00000000), ref: 00497D76
FindClose.KERNEL32(000000FF,00497DA1,00497D9A,?,00000000,?,00000000,00497DC2,?,?,00000000,0049B628,?,00497F4C,00000000,00497FA0), ref: 00497D94

Strings

isRS-???.tmp, xrefs: 00497CC5
isRS-, xrefs: 00497CFB

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstNext
String ID: isRS-$isRS-???.tmp
API String ID: 134685335-3422211394
Opcode ID: 9a592638bc2750322f214c0eb344c8148df857e83d765ddb3acdf8ed9d2ec43c
Instruction ID: 077204e4b59ba8174d874b411549c05da503e5c3c4c12a43784b6924d2c4c749
Opcode Fuzzy Hash: 9a592638bc2750322f214c0eb344c8148df857e83d765ddb3acdf8ed9d2ec43c
Instruction Fuzzy Hash: 00317671A146086BCF11EF65CC81ADEBBBCDF45305F5085B7A808A32A1E6389E458F58

Function 0045746C Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 241windownativeCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 004574E9
PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00457510
SetForegroundWindow.USER32(?), ref: 00457521
NtdllDefWindowProc_A.USER32(00000000,?,?,?,00000000,004577F9,?,00000000,00457835), ref: 004577E4

Strings

Cannot evaluate variable because [Code] isn't running yet, xrefs: 00457664

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: MessagePostWindow$ForegroundNtdllProc_
String ID: Cannot evaluate variable because [Code] isn't running yet
API String ID: 2236967946-3182603685
Opcode ID: 96aa167a3baa95a2338ad81f9a381b760b400273dfe998f23b0892c305739983
Instruction ID: 49c7ca61fbccde69a4bda81b3c117289df4d71a96d4cc10d1dff28d50592e65c
Opcode Fuzzy Hash: 96aa167a3baa95a2338ad81f9a381b760b400273dfe998f23b0892c305739983
Instruction Fuzzy Hash: 4191CF34608204EFD715DF69E991F5ABBF9FB49304F2180BAEC0497792D638AE04DB58

Function 00417CD0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417D0F
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417D2D
GetWindowPlacement.USER32(?,0000002C), ref: 00417D63
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417D8A

Strings

,, xrefs: 00417D51

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID: ,
API String ID: 568898626-3772416878
Opcode ID: 9bef5f2699a14fc460bb8f4c137cb8544ee30b66db2c811631afee2a7eee1c15
Instruction ID: e85585575f8c5a3e7823c55acc6b28d6d187d41511fbfc80546af44b70413e2d
Opcode Fuzzy Hash: 9bef5f2699a14fc460bb8f4c137cb8544ee30b66db2c811631afee2a7eee1c15
Instruction Fuzzy Hash: 4C2112716042089BDF10EF69D8C1AEA77B8AF48314F05456AFD18DF346D678DD84CBA8

Function 00464030 Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001,00000000,00464217), ref: 004640A5
FindFirstFileA.KERNEL32(00000000,?,00000000,004641E2,?,00000001,00000000,00464217), ref: 004640EB
FindNextFileA.KERNEL32(000000FF,?,00000000,004641C4,?,00000000,?,00000000,004641E2,?,00000001,00000000,00464217), ref: 004641A0
FindClose.KERNEL32(000000FF,004641CB,004641C4,?,00000000,?,00000000,004641E2,?,00000001,00000000,00464217), ref: 004641BE

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: d1b1abdae6da0b26b18feb454965bdec43d4a67e9dcbe06fdf23a7501467d4e3
Instruction ID: 06a8d60215f6d5d9d871a504bfff84f6e0c1ecbd426c21799f33ee47dd91da96
Opcode Fuzzy Hash: d1b1abdae6da0b26b18feb454965bdec43d4a67e9dcbe06fdf23a7501467d4e3
Instruction Fuzzy Hash: 8A418675A00A18DFCB10EFA5DC959DEB7B9EB88305F4044AAF804A7341E7789E848E59

Function 00463BB4 Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001,00000000,00463D71), ref: 00463BE5
FindFirstFileA.KERNEL32(00000000,?,00000000,00463D44,?,00000001,00000000,00463D71), ref: 00463C74
FindNextFileA.KERNEL32(000000FF,?,00000000,00463D26,?,00000000,?,00000000,00463D44,?,00000001,00000000,00463D71), ref: 00463D06
FindClose.KERNEL32(000000FF,00463D2D,00463D26,?,00000000,?,00000000,00463D44,?,00000001,00000000,00463D71), ref: 00463D20

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: c341d22c7a053e48ac2d12a3ad3a7dbd5d641ad6df1598854ae3d6088d37969b
Instruction ID: 11f8cf6308ec642fe3db94f9052ed69b05f75390ec556d34b8037de08a3bd43b
Opcode Fuzzy Hash: c341d22c7a053e48ac2d12a3ad3a7dbd5d641ad6df1598854ae3d6088d37969b
Instruction Fuzzy Hash: 94418434A00A589FDB11EF65DC55ADEB7B8EF88306F4044BAF404A7381E67C9F488E59

Function 0042E934 Relevance: 7.6, APIs: 5, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E956
DeviceIoControl.KERNEL32(00000000,0009C040,?,00000002,00000000,00000000,?,00000000), ref: 0042E981
GetLastError.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E98E
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E996
SetLastError.KERNEL32(00000000,00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E99C

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ErrorLast$CloseControlCreateDeviceFileHandle
String ID:
API String ID: 1177325624-0
Opcode ID: 00c40fca2cfdd97ba02e44e9efda7f487b55ec81a2bcf6d63bb4130569f45397
Instruction ID: 661b18b1de4eb1238568a50ab540e77c3175952f9b14320adb6d96c9b056064d
Opcode Fuzzy Hash: 00c40fca2cfdd97ba02e44e9efda7f487b55ec81a2bcf6d63bb4130569f45397
Instruction Fuzzy Hash: 80F090B23A17207AF620B57A5C86F7F418CCB89B68F10423BBA04FF1D1D9A85D0555AD

Function 0048348C Relevance: 6.0, APIs: 4, Instructions: 47windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 004834CA
GetWindowLongA.USER32(00000000,000000F0), ref: 004834E8
ShowWindow.USER32(00000000,00000005,00000000,000000F0,0049C0A4,004829A6,004829DA,00000000,004829FA,?,?,?,0049C0A4), ref: 0048350A
ShowWindow.USER32(00000000,00000000,00000000,000000F0,0049C0A4,004829A6,004829DA,00000000,004829FA,?,?,?,0049C0A4), ref: 0048351E

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Window$Show$IconicLong
String ID:
API String ID: 2754861897-0
Opcode ID: 7ffa2f78d84017fdfeacbfdda1e85d43c8c51a80690e172a9d98e1415006cbb5
Instruction ID: 42b5823d88870d489630fed61ffe24a9a5c61b02f9884224dbb3fdac0babcbec
Opcode Fuzzy Hash: 7ffa2f78d84017fdfeacbfdda1e85d43c8c51a80690e172a9d98e1415006cbb5
Instruction Fuzzy Hash: 74017170705200ABEF01FFA5DD8AB5A37D46B14B45F08187BB9019F2A3CA6CEE41872C

Function 00462628 Relevance: 4.6, APIs: 3, Instructions: 67fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,004626FC), ref: 00462680
FindNextFileA.KERNEL32(000000FF,?,00000000,004626DC,?,00000000,?,00000000,004626FC), ref: 004626BC
FindClose.KERNEL32(000000FF,004626E3,004626DC,?,00000000,?,00000000,004626FC), ref: 004626D6

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: f57a64d85c54d353e45a018184ec90ae3d27a327a474c1dd2b6888a4f83ab7a6
Instruction ID: 348d5188472d8d67b5ed560b6c21b28065d15f8f2fc4a6e80af24ab03650058e
Opcode Fuzzy Hash: f57a64d85c54d353e45a018184ec90ae3d27a327a474c1dd2b6888a4f83ab7a6
Instruction Fuzzy Hash: F021D871904B087EDB11EB65CC41ADEBBACDB49304F5084F7A808E26A1E6B89E54CE59

Function 004241DC Relevance: 4.5, APIs: 3, Instructions: 32windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 004241E4
SetActiveWindow.USER32(?,?,?,0046CC2B), ref: 004241F1

Part of subcall function 0042364C: ShowWindow.USER32(00410460,00000009,?,00000000,0041EDA4,0042393A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00423667

Part of subcall function 00423B14: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000013,?,021325AC,0042420A,?,?,?,0046CC2B), ref: 00423B4F

SetFocus.USER32(00000000,?,?,?,0046CC2B), ref: 0042421E

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Window$ActiveFocusIconicShow
String ID:
API String ID: 649377781-0
Opcode ID: 1be179083055f96161d8b165ddd04f1e3bd56871e014c6a07f585ac04199aa1a
Instruction ID: c953833529836f01456b8f788e47b4b7c36f7a841d6c6df07f57e62630513da6
Opcode Fuzzy Hash: 1be179083055f96161d8b165ddd04f1e3bd56871e014c6a07f585ac04199aa1a
Instruction Fuzzy Hash: 8CF030B170012097CB10BFAAA8C5B9676A8AB48344F5500BBBD05DF357CA7CDC018778

Function 00417CCE Relevance: 3.0, APIs: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417D0F
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417D2D
GetWindowPlacement.USER32(?,0000002C), ref: 00417D63
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417D8A

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID:
API String ID: 568898626-0
Opcode ID: ebd707d3ae313beec07553f07bd7f77ab110097aa9cac76d67ea171003520b00
Instruction ID: d9358ea7cd183770b33139a8ac7b7a0a70302bd2c01e5fc8313c3e2814ac7f2c
Opcode Fuzzy Hash: ebd707d3ae313beec07553f07bd7f77ab110097aa9cac76d67ea171003520b00
Instruction Fuzzy Hash: 33012C71204108ABDB10EE59D8C1EF673A8AF45724F154566FD19DF242D639ED8087A8

Function 00417598 Relevance: 3.0, APIs: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 004175C3
GetCapture.USER32 ref: 004175CC

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CaptureIconic
String ID:
API String ID: 2277910766-0
Opcode ID: c8f0edb1377470e81cbec4a2b95b5efcfd9f911131a56f14dd142127f01798ba
Instruction ID: 6cb7601519473143bf4e876ebf6758ccc8fc4fa751d6c6e0357a6193460a6b05
Opcode Fuzzy Hash: c8f0edb1377470e81cbec4a2b95b5efcfd9f911131a56f14dd142127f01798ba
Instruction Fuzzy Hash: 0AF0A4723056425BD730AB2EC984AB762F69F84314B14403BE419CBFA1EB3CDCC08798

Function 00424194 Relevance: 3.0, APIs: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0042419B

Part of subcall function 00423A84: EnumWindows.USER32(00423A1C), ref: 00423AA8
Part of subcall function 00423A84: GetWindow.USER32(?,00000003), ref: 00423ABD
Part of subcall function 00423A84: GetWindowLongA.USER32(?,000000EC), ref: 00423ACC
Part of subcall function 00423A84: SetWindowPos.USER32(00000000,\AB,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,004241AB,?,?,00423D73), ref: 00423B02

SetActiveWindow.USER32(?,?,?,00423D73,00000000,0042415C), ref: 004241AF

Part of subcall function 0042364C: ShowWindow.USER32(00410460,00000009,?,00000000,0041EDA4,0042393A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00423667

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Window$ActiveEnumIconicLongShowWindows
String ID:
API String ID: 2671590913-0
Opcode ID: b2ff140757208bd7b7cc33ac29151dbeb423d1cdddd3b288bc041a56f1810338
Instruction ID: ce5d4440ec1c13bcfda566247f28ea27228b22b89c70f7a48f218b5e8bc86154
Opcode Fuzzy Hash: b2ff140757208bd7b7cc33ac29151dbeb423d1cdddd3b288bc041a56f1810338
Instruction Fuzzy Hash: 55E01AA070011087DB10AFAADCC8B9632A9BB48304F55017ABD49CF35BD63CC8608724

Function 004125D8 Relevance: 1.7, APIs: 1, Instructions: 188nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,00000000,004127D5), ref: 004127C3

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 120c9c179850e2d77f2b5158c289480559fb4752f9becda92d3f5c4f199058c9
Instruction ID: 2c049f03cfb376e3baa0368465928f91904f6d03483072bf0e6cb5f6a46bccc5
Opcode Fuzzy Hash: 120c9c179850e2d77f2b5158c289480559fb4752f9becda92d3f5c4f199058c9
Instruction Fuzzy Hash: 4A5102357082048FD710DB6ADA80A9BF3E5EF98314B2082BBD814C77A1D7B8AD91C75D

Function 00478648 Relevance: 1.6, APIs: 1, Instructions: 107nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 00478796

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 92d8ff69c8f9015843013c8ef6195f22e1eec5ec2e4e9776c301f132ad58bf6e
Instruction ID: e013cb3c42dd58cceab177a6d205a04243eb2a1ac844c0beb79983e020d4b19f
Opcode Fuzzy Hash: 92d8ff69c8f9015843013c8ef6195f22e1eec5ec2e4e9776c301f132ad58bf6e
Instruction Fuzzy Hash: F7414939604104DF9B24CF99CA888AAB7F5FB48310B34C59AE80ADB705D738EE409B95

Function 0044B658 Relevance: 166.5, APIs: 48, Strings: 47, Instructions: 252libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044B604: GetVersionExA.KERNEL32(00000094), ref: 0044B621

LoadLibraryA.KERNEL32(uxtheme.dll,?,0044F775,004987D2), ref: 0044B67F
GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044B697
GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044B6A9
GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044B6BB
GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044B6CD
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6DF
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6F1
GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044B703
GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044B715
GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044B727
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044B739
GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044B74B
GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044B75D
GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044B76F
GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044B781
GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044B793
GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044B7A5
GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044B7B7
GetProcAddress.KERNEL32(00000000,GetThemeString), ref: 0044B7C9
GetProcAddress.KERNEL32(00000000,GetThemeBool), ref: 0044B7DB
GetProcAddress.KERNEL32(00000000,GetThemeInt), ref: 0044B7ED
GetProcAddress.KERNEL32(00000000,GetThemeEnumValue), ref: 0044B7FF
GetProcAddress.KERNEL32(00000000,GetThemePosition), ref: 0044B811
GetProcAddress.KERNEL32(00000000,GetThemeFont), ref: 0044B823
GetProcAddress.KERNEL32(00000000,GetThemeRect), ref: 0044B835
GetProcAddress.KERNEL32(00000000,GetThemeMargins), ref: 0044B847
GetProcAddress.KERNEL32(00000000,GetThemeIntList), ref: 0044B859
GetProcAddress.KERNEL32(00000000,GetThemePropertyOrigin), ref: 0044B86B
GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 0044B87D
GetProcAddress.KERNEL32(00000000,GetThemeFilename), ref: 0044B88F
GetProcAddress.KERNEL32(00000000,GetThemeSysColor), ref: 0044B8A1
GetProcAddress.KERNEL32(00000000,GetThemeSysColorBrush), ref: 0044B8B3
GetProcAddress.KERNEL32(00000000,GetThemeSysBool), ref: 0044B8C5
GetProcAddress.KERNEL32(00000000,GetThemeSysSize), ref: 0044B8D7
GetProcAddress.KERNEL32(00000000,GetThemeSysFont), ref: 0044B8E9
GetProcAddress.KERNEL32(00000000,GetThemeSysString), ref: 0044B8FB
GetProcAddress.KERNEL32(00000000,GetThemeSysInt), ref: 0044B90D
GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0044B91F
GetProcAddress.KERNEL32(00000000,IsAppThemed), ref: 0044B931
GetProcAddress.KERNEL32(00000000,GetWindowTheme), ref: 0044B943
GetProcAddress.KERNEL32(00000000,EnableThemeDialogTexture), ref: 0044B955
GetProcAddress.KERNEL32(00000000,IsThemeDialogTextureEnabled), ref: 0044B967
GetProcAddress.KERNEL32(00000000,GetThemeAppProperties), ref: 0044B979
GetProcAddress.KERNEL32(00000000,SetThemeAppProperties), ref: 0044B98B
GetProcAddress.KERNEL32(00000000,GetCurrentThemeName), ref: 0044B99D
GetProcAddress.KERNEL32(00000000,GetThemeDocumentationProperty), ref: 0044B9AF
GetProcAddress.KERNEL32(00000000,DrawThemeParentBackground), ref: 0044B9C1
GetProcAddress.KERNEL32(00000000,EnableTheming), ref: 0044B9D3

Strings

GetThemePropertyOrigin, xrefs: 0044B863
GetThemeBool, xrefs: 0044B7D3
GetThemeMargins, xrefs: 0044B83F
GetThemeDocumentationProperty, xrefs: 0044B9A7
GetThemeFont, xrefs: 0044B81B
GetThemeSysBool, xrefs: 0044B8BD
OpenThemeData, xrefs: 0044B68F
IsThemePartDefined, xrefs: 0044B779
GetThemeEnumValue, xrefs: 0044B7F7
GetThemeBackgroundContentRect, xrefs: 0044B6D7, 0044B6E9
GetThemeColor, xrefs: 0044B79D
DrawThemeEdge, xrefs: 0044B755
SetThemeAppProperties, xrefs: 0044B983
IsThemeBackgroundPartiallyTransparent, xrefs: 0044B78B
GetThemeBackgroundRegion, xrefs: 0044B731
GetThemeString, xrefs: 0044B7C1
IsThemeDialogTextureEnabled, xrefs: 0044B95F
DrawThemeText, xrefs: 0044B6C5
GetThemeSysInt, xrefs: 0044B905
GetThemeSysSize, xrefs: 0044B8CF
GetThemeIntList, xrefs: 0044B851
GetWindowTheme, xrefs: 0044B93B
GetCurrentThemeName, xrefs: 0044B995
HitTestThemeBackground, xrefs: 0044B743
SetWindowTheme, xrefs: 0044B875
uxtheme.dll, xrefs: 0044B67A
DrawThemeIcon, xrefs: 0044B767
EnableTheming, xrefs: 0044B9CB
CloseThemeData, xrefs: 0044B6A1
GetThemePartSize, xrefs: 0044B6FB
GetThemePosition, xrefs: 0044B809
GetThemeTextExtent, xrefs: 0044B70D
GetThemeFilename, xrefs: 0044B887
GetThemeSysColor, xrefs: 0044B899
GetThemeRect, xrefs: 0044B82D
GetThemeTextMetrics, xrefs: 0044B71F
GetThemeSysFont, xrefs: 0044B8E1
DrawThemeBackground, xrefs: 0044B6B3
GetThemeMetric, xrefs: 0044B7AF
IsThemeActive, xrefs: 0044B917
IsAppThemed, xrefs: 0044B929
DrawThemeParentBackground, xrefs: 0044B9B9
GetThemeInt, xrefs: 0044B7E5
GetThemeSysString, xrefs: 0044B8F3
GetThemeAppProperties, xrefs: 0044B971
EnableThemeDialogTexture, xrefs: 0044B94D
GetThemeSysColorBrush, xrefs: 0044B8AB

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressProc$LibraryLoadVersion
String ID: CloseThemeData$DrawThemeBackground$DrawThemeEdge$DrawThemeIcon$DrawThemeParentBackground$DrawThemeText$EnableThemeDialogTexture$EnableTheming$GetCurrentThemeName$GetThemeAppProperties$GetThemeBackgroundContentRect$GetThemeBackgroundRegion$GetThemeBool$GetThemeColor$GetThemeDocumentationProperty$GetThemeEnumValue$GetThemeFilename$GetThemeFont$GetThemeInt$GetThemeIntList$GetThemeMargins$GetThemeMetric$GetThemePartSize$GetThemePosition$GetThemePropertyOrigin$GetThemeRect$GetThemeString$GetThemeSysBool$GetThemeSysColor$GetThemeSysColorBrush$GetThemeSysFont$GetThemeSysInt$GetThemeSysSize$GetThemeSysString$GetThemeTextExtent$GetThemeTextMetrics$GetWindowTheme$HitTestThemeBackground$IsAppThemed$IsThemeActive$IsThemeBackgroundPartiallyTransparent$IsThemeDialogTextureEnabled$IsThemePartDefined$OpenThemeData$SetThemeAppProperties$SetWindowTheme$uxtheme.dll
API String ID: 1968650500-2910565190
Opcode ID: 95dc7e01f57bcb691e719ed2fb4b3cf68dab2605f840b59d7f83adc2db29b4cf
Instruction ID: e93aa9000a3b975727f71862fff1c9a8a52c50bca2d3d110ef64c9f3a3b13d35
Opcode Fuzzy Hash: 95dc7e01f57bcb691e719ed2fb4b3cf68dab2605f840b59d7f83adc2db29b4cf
Instruction Fuzzy Hash: D391A8F0A40B11ABEB00EFB5AD96A2A3BA8EB15714310067BB454DF295D778DC108FDD

Function 00492414 Relevance: 56.4, APIs: 16, Strings: 16, Instructions: 431sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,00000000,00492909,?,?,?,?,00000000,00000000,00000000), ref: 00492454
FindWindowA.USER32(00000000,00000000), ref: 00492485

Strings

SENDBROADCASTNOTIFYMESSAGE, xrefs: 004926C3
CALLDLLPROC, xrefs: 00492779
SENDMESSAGE, xrefs: 004924D9
REGISTERWINDOWMESSAGE, xrefs: 004925E7
SENDNOTIFYMESSAGE, xrefs: 0049258B
FINDWINDOWBYWINDOWNAME, xrefs: 0049249D
FINDWINDOWBYCLASSNAME, xrefs: 00492461
LOADDLL, xrefs: 00492717
CREATEMUTEX, xrefs: 00492835
POSTBROADCASTMESSAGE, xrefs: 0049266F
POSTMESSAGE, xrefs: 0049252F
CHARTOOEMBUFF, xrefs: 004928AA
OEMTOCHARBUFF, xrefs: 00492867
SLEEP, xrefs: 0049243E
SENDBROADCASTMESSAGE, xrefs: 00492621
FREEDLL, xrefs: 00492800

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: FindSleepWindow
String ID: CALLDLLPROC$CHARTOOEMBUFF$CREATEMUTEX$FINDWINDOWBYCLASSNAME$FINDWINDOWBYWINDOWNAME$FREEDLL$LOADDLL$OEMTOCHARBUFF$POSTBROADCASTMESSAGE$POSTMESSAGE$REGISTERWINDOWMESSAGE$SENDBROADCASTMESSAGE$SENDBROADCASTNOTIFYMESSAGE$SENDMESSAGE$SENDNOTIFYMESSAGE$SLEEP
API String ID: 3078808852-3310373309
Opcode ID: b663632e49e180770bec75779cfad8c50b21de5265e4831b2eb78b7839abac61
Instruction ID: f9b6100cdcb125238a703780d580572f8216b12678261aa4779c5284adf6670e
Opcode Fuzzy Hash: b663632e49e180770bec75779cfad8c50b21de5265e4831b2eb78b7839abac61
Instruction Fuzzy Hash: AFC173A0B042003BDB14BF3E9D4551F59AA9B84708B11DA3FB446EB78BCE7DEC0A4359

Function 0041CA0C Relevance: 33.2, APIs: 22, Instructions: 213windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0041CA40
CreateCompatibleDC.GDI32(?), ref: 0041CA4C
CreateBitmap.GDI32(0041A944,?,00000001,00000001,00000000), ref: 0041CA70
CreateCompatibleBitmap.GDI32(?,0041A944,?), ref: 0041CA80
SelectObject.GDI32(0041CE3C,00000000), ref: 0041CA9B
FillRect.USER32(0041CE3C,?,?), ref: 0041CAD6
SetTextColor.GDI32(0041CE3C,00000000), ref: 0041CAEB
SetBkColor.GDI32(0041CE3C,00000000), ref: 0041CB02
PatBlt.GDI32(0041CE3C,00000000,00000000,0041A944,?,00FF0062), ref: 0041CB18
CreateCompatibleDC.GDI32(?), ref: 0041CB2B
SelectObject.GDI32(00000000,00000000), ref: 0041CB5C
SelectPalette.GDI32(00000000,00000000,00000001), ref: 0041CB74
RealizePalette.GDI32(00000000), ref: 0041CB7D
SelectPalette.GDI32(0041CE3C,00000000,00000001), ref: 0041CB8C
RealizePalette.GDI32(0041CE3C), ref: 0041CB95
SetTextColor.GDI32(00000000,00000000), ref: 0041CBAE
SetBkColor.GDI32(00000000,00000000), ref: 0041CBC5
BitBlt.GDI32(0041CE3C,00000000,00000000,0041A944,?,00000000,00000000,00000000,00CC0020), ref: 0041CBE1
SelectObject.GDI32(00000000,?), ref: 0041CBEE
DeleteDC.GDI32(00000000), ref: 0041CC04

Part of subcall function 0041A058: GetSysColor.USER32(?), ref: 0041A062

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ColorSelect$CreatePalette$CompatibleObject$BitmapRealizeText$DeleteFillRect
String ID:
API String ID: 269503290-0
Opcode ID: 9806164d1606c634515afc64932ea3bc8f16e9e6d983aee2c5c16924e4641f34
Instruction ID: 91afdf38925dfcc0a19aef53af63d8b93a06df8cfedaf367688fa0d34ebdb442
Opcode Fuzzy Hash: 9806164d1606c634515afc64932ea3bc8f16e9e6d983aee2c5c16924e4641f34
Instruction Fuzzy Hash: 01610071A44648AFDF10EBE9DC86FDFB7B8EB48704F10446AB504E7281D67CA940CB68

Function 004502C0 Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 45libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(0048069A), ref: 004502D3
LoadLibraryA.KERNEL32(Rstrtmgr.dll,0048069A), ref: 004502EB
GetProcAddress.KERNEL32(00000000,RmStartSession), ref: 00450309
GetProcAddress.KERNEL32(00000000,RmRegisterResources), ref: 0045031E
GetProcAddress.KERNEL32(00000000,RmGetList), ref: 00450333
GetProcAddress.KERNEL32(00000000,RmShutdown), ref: 00450348
GetProcAddress.KERNEL32(00000000,RmRestart), ref: 0045035D
GetProcAddress.KERNEL32(00000000,RmEndSession), ref: 00450372

Strings

RmRestart, xrefs: 00450352
RmShutdown, xrefs: 0045033D
Rstrtmgr.dll, xrefs: 004502E6
RmRegisterResources, xrefs: 00450313
RmEndSession, xrefs: 00450367
RmGetList, xrefs: 00450328
RmStartSession, xrefs: 004502FE

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressProc$LibraryLoadVersion
String ID: RmEndSession$RmGetList$RmRegisterResources$RmRestart$RmShutdown$RmStartSession$Rstrtmgr.dll
API String ID: 1968650500-3419246398
Opcode ID: 368ac912df4a413815acbb426437c023a97144279f6b51fe123355473e8d046a
Instruction ID: c77cef2ad5653e61b65a4477cbb73d0d56cf7b8a9d174f96be3e9b6947252677
Opcode Fuzzy Hash: 368ac912df4a413815acbb426437c023a97144279f6b51fe123355473e8d046a
Instruction Fuzzy Hash: B211F7B4510301DBD710FB61BF45A2E36E9E728315B08063FE804961A2CB7C4844CF8C

Function 00497FB0 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 251synchronizationCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000005,00000000,00498348,?,?,00000000,?,00000000,00000000,?,004986FF,00000000,00498709,?,00000000), ref: 00498033
CreateMutexA.KERNEL32(00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00498348,?,?,00000000,?,00000000,00000000,?,004986FF,00000000), ref: 00498046
ShowWindow.USER32(?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00498348,?,?,00000000,?,00000000,00000000), ref: 00498056
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00498077
ShowWindow.USER32(?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00498348,?,?,00000000,?,00000000), ref: 00498087

Part of subcall function 0042D44C: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D4DA,?,?,?,00000001,?,0045607E,00000000,004560E6), ref: 0042D481

Strings

Setup, xrefs: 0049801F
/REG, xrefs: 00497FE5
.msg, xrefs: 004980AA
/REGU, xrefs: 00498009
.lst, xrefs: 004980C4
Inno-Setup-RegSvr-Mutex, xrefs: 0049803D

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ShowWindow$CreateFileModuleMultipleMutexNameObjectsWait
String ID: .lst$.msg$/REG$/REGU$Inno-Setup-RegSvr-Mutex$Setup
API String ID: 2000705611-3672972446
Opcode ID: be167af9581472d792d676f9cd6aca47b85cc2d924e5f6cfd1bab36a441b3776
Instruction ID: 514ae71ba50caa4962cee2ce17bbe530033c2a842a2b30bc95236382d26c0aa5
Opcode Fuzzy Hash: be167af9581472d792d676f9cd6aca47b85cc2d924e5f6cfd1bab36a441b3776
Instruction Fuzzy Hash: AC91B734A046449FDF11EBA9C852BAE7BB4EF4A704F51447BF900AB292CE7D9805CB1D

Function 0045A5B0 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 209COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,0045A86C,?,?,?,?,?,00000006,?,00000000,00497439,?,00000000,004974DC), ref: 0045A71E

Strings

Failed to strip read-only attribute., xrefs: 0045A703
Failed to delete the file; it may be in use (%d)., xrefs: 0045A80D
.chm, xrefs: 0045A64C
.chw, xrefs: 0045A665
The file appears to be in use (%d). Will delete on restart., xrefs: 0045A767
.lnk, xrefs: 0045A68B
.hlp, xrefs: 0045A5E7
.gid, xrefs: 0045A600
Deleting file: %s, xrefs: 0045A6BD
Stripped read-only attribute., xrefs: 0045A6F7
.fts, xrefs: 0045A624

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ErrorLast
String ID: .chm$.chw$.fts$.gid$.hlp$.lnk$Deleting file: %s$Failed to delete the file; it may be in use (%d).$Failed to strip read-only attribute.$Stripped read-only attribute.$The file appears to be in use (%d). Will delete on restart.
API String ID: 1452528299-3112430753
Opcode ID: 013e8754df7b10902fd09dccc84370fbcd1ca9cb2211e1a7bf3e698d7b97e334
Instruction ID: 048478fdc0414bf964f0012d81fb6b7d529e35510f272ac8cc0834971c44cb08
Opcode Fuzzy Hash: 013e8754df7b10902fd09dccc84370fbcd1ca9cb2211e1a7bf3e698d7b97e334
Instruction Fuzzy Hash: 31718230B042445BDB10EB6988417AE7BA5AF49315F50856BFC01EB383DB7CDA1E875E

Function 0045CA98 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 182libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 0045CAB2
GetModuleHandleA.KERNEL32(advapi32.dll), ref: 0045CAD2
GetProcAddress.KERNEL32(00000000,GetNamedSecurityInfoW), ref: 0045CADF
GetProcAddress.KERNEL32(00000000,SetNamedSecurityInfoW), ref: 0045CAEC
GetProcAddress.KERNEL32(00000000,SetEntriesInAclW), ref: 0045CAFA

Part of subcall function 0045C9A0: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0045CA3F,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0045CA19

AllocateAndInitializeSid.ADVAPI32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045CCED,?,?,00000000), ref: 0045CBB3
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045CCED,?,?,00000000), ref: 0045CBBC

Strings

W, xrefs: 0045CBCA
SetEntriesInAclW, xrefs: 0045CAF4
GetNamedSecurityInfoW, xrefs: 0045CAD9
SetNamedSecurityInfoW, xrefs: 0045CAE6
advapi32.dll, xrefs: 0045CACD

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressProc$AllocateByteCharErrorHandleInitializeLastModuleMultiVersionWide
String ID: GetNamedSecurityInfoW$SetEntriesInAclW$SetNamedSecurityInfoW$W$advapi32.dll
API String ID: 59345061-4263478283
Opcode ID: b78dba30cedf2a73cdf13b83454b281f3a3408169449f6210df8ffb2a7e5822a
Instruction ID: a358b2862a28276d7d6860985b60e8ecba44f528035a1e3ad3a8a0dac7ee7aee
Opcode Fuzzy Hash: b78dba30cedf2a73cdf13b83454b281f3a3408169449f6210df8ffb2a7e5822a
Instruction Fuzzy Hash: A15165B1A00708AFDB10DF99C885BAEBBB8EB48311F14806AF915E7241D6789945CF69

Function 0041B3AC Relevance: 21.1, APIs: 14, Instructions: 126windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 0041B3C3
CreateCompatibleDC.GDI32(00000000), ref: 0041B3CD
GetObjectA.GDI32(?,00000018,00000004), ref: 0041B3DF
CreateBitmap.GDI32(0000000B,?,00000001,00000001,00000000), ref: 0041B3F6
GetDC.USER32(00000000), ref: 0041B402
CreateCompatibleBitmap.GDI32(00000000,0000000B,?), ref: 0041B42F
ReleaseDC.USER32(00000000,00000000), ref: 0041B455
SelectObject.GDI32(00000000,?), ref: 0041B470
SelectObject.GDI32(?,00000000), ref: 0041B47F
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B4AB
SelectObject.GDI32(00000000,00000000), ref: 0041B4B9
SelectObject.GDI32(?,00000000), ref: 0041B4C7
DeleteDC.GDI32(00000000), ref: 0041B4D0
DeleteDC.GDI32(?), ref: 0041B4D9

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Object$CreateSelect$Compatible$BitmapDelete$ReleaseStretch
String ID:
API String ID: 644427674-0
Opcode ID: 9212dc48eb065078ffd6e64a0fe4b3e7e755c3ed7e1f96497366cc94fc87ddf9
Instruction ID: 0f3e5998203d07172116f12fa3fedaa120d09cd030f2870c51d139f455c41937
Opcode Fuzzy Hash: 9212dc48eb065078ffd6e64a0fe4b3e7e755c3ed7e1f96497366cc94fc87ddf9
Instruction Fuzzy Hash: E941AD71E44619AFDB10DAE9C846FEFB7BCEB08704F104466B614F7281D6786D408BA8

Function 00454874 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 244registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,37H,?,00000001,?,?,00483733,?,00000001,00000000), ref: 0042DE38

RegQueryValueExA.ADVAPI32(0045AA42,00000000,00000000,?,00000000,?,00000000,00454B0D,?,0045AA42,00000003,00000000,00000000,00454B44), ref: 0045498D

Part of subcall function 0042E8C8: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00453273,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E8E7

RegQueryValueExA.ADVAPI32(0045AA42,00000000,00000000,00000000,?,00000004,00000000,00454A57,?,0045AA42,00000000,00000000,?,00000000,?,00000000), ref: 00454A11
RegQueryValueExA.ADVAPI32(0045AA42,00000000,00000000,00000000,?,00000004,00000000,00454A57,?,0045AA42,00000000,00000000,?,00000000,?,00000000), ref: 00454A40

Strings

Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 004548E4
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 004548AB
, xrefs: 004548FE
RegOpenKeyEx, xrefs: 00454910

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: QueryValue$FormatMessageOpen
String ID: $RegOpenKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2812809588-1577016196
Opcode ID: fcd4d493ddb343decf7749ef48b5cbc365a509ed3611e34bcf7a5cf6bf8218e6
Instruction ID: 10c729c5df0f457655d9edc07d187ac9b2ad403c2690153cc8aec617143616fc
Opcode Fuzzy Hash: fcd4d493ddb343decf7749ef48b5cbc365a509ed3611e34bcf7a5cf6bf8218e6
Instruction Fuzzy Hash: D1914871E44148ABDB10DF95C842BDEB7FCEB49309F50406BF900FB282D6789E458B69

Function 00459330 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 165registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0045923C: RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,00459379,00000000,00459531,?,00000000,00000000,00000000), ref: 00459289

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00459531,?,00000000,00000000,00000000), ref: 004593D7
RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00459531,?,00000000,00000000,00000000), ref: 00459441

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,37H,?,00000001,?,?,00483733,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000001,00000000,00000000,00459531,?,00000000,00000000,00000000), ref: 004594A8

Strings

SOFTWARE\Microsoft\.NETFramework\Policy\v4.0, xrefs: 0045938A
v2.0.50727, xrefs: 00459433
SOFTWARE\Microsoft\.NETFramework\Policy\v2.0, xrefs: 004593F4
v4.0.30319, xrefs: 004593C9
SOFTWARE\Microsoft\.NETFramework\Policy\v1.1, xrefs: 0045945B
.NET Framework version %s not found, xrefs: 004594E1
.NET Framework not found, xrefs: 004594F5
v1.1.4322, xrefs: 0045949A

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Close$Open
String ID: .NET Framework not found$.NET Framework version %s not found$SOFTWARE\Microsoft\.NETFramework\Policy\v1.1$SOFTWARE\Microsoft\.NETFramework\Policy\v2.0$SOFTWARE\Microsoft\.NETFramework\Policy\v4.0$v1.1.4322$v2.0.50727$v4.0.30319
API String ID: 2976201327-446240816
Opcode ID: 350e4df8e04af077fe02aa66194ae6a40507e73a84c8321153f8b8b98bc436f5
Instruction ID: a1bdb027ff648d56d57a6d7e975bd84a611c623bc5fe4c8cd801963552f4df29
Opcode Fuzzy Hash: 350e4df8e04af077fe02aa66194ae6a40507e73a84c8321153f8b8b98bc436f5
Instruction Fuzzy Hash: A851A431A04145EBCB00DFA8D8A17EE77B6DB59305F5444BBE901DB352E63D9E0E8B18

Function 0045891C Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 70sleepsynchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00458953
TerminateProcess.KERNEL32(?,00000001,?,00002710,?), ref: 0045896F
WaitForSingleObject.KERNEL32(?,00002710,?), ref: 0045897D
GetExitCodeProcess.KERNEL32(?), ref: 0045898E
CloseHandle.KERNEL32(?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 004589D5
Sleep.KERNEL32(000000FA,?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 004589F1

Strings

Stopping 64-bit helper process. (PID: %u), xrefs: 00458945
Helper process exited., xrefs: 0045899D
Helper isn't responding; killing it., xrefs: 0045895F
Helper process exited with failure code: 0x%x, xrefs: 004589BB
Helper process exited, but failed to get exit code., xrefs: 004589C7

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CloseHandleProcess$CodeExitObjectSingleSleepTerminateWait
String ID: Helper isn't responding; killing it.$Helper process exited with failure code: 0x%x$Helper process exited, but failed to get exit code.$Helper process exited.$Stopping 64-bit helper process. (PID: %u)
API String ID: 3355656108-1243109208
Opcode ID: 19115aeb8cc828f4877c8e64310325412b092dec34bdac0bc308453008b78928
Instruction ID: 607cb17b66f328b897cb67912c8e5c96499f04238989bb189b7f5ef4a6f94b21
Opcode Fuzzy Hash: 19115aeb8cc828f4877c8e64310325412b092dec34bdac0bc308453008b78928
Instruction Fuzzy Hash: 502130B16087409BD710E77DC44576BB7D49F48305F04892FB99AEB293DE78E8488B2B

Function 00454528 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 228registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DDE4: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DE10

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,004546FF,?,00000000,004547C3), ref: 0045464F
RegCloseKey.ADVAPI32(?,?,?,00000000,00000004,00000000,00000001,?,00000000,?,00000000,004546FF,?,00000000,004547C3), ref: 0045478B

Part of subcall function 0042E8C8: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00453273,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E8E7

Strings

Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00454597
, xrefs: 004545B1
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00454567
RegCreateKeyEx, xrefs: 004545C3

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CloseCreateFormatMessageQueryValue
String ID: $RegCreateKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2481121983-1280779767
Opcode ID: eb870b7264be2e79576d733cc433dee21af662c2ed5ee69006979a4f4339c867
Instruction ID: cde7545684c4620c2d036396f19d9a4160a162433608d969df8f63117b7f1412
Opcode Fuzzy Hash: eb870b7264be2e79576d733cc433dee21af662c2ed5ee69006979a4f4339c867
Instruction Fuzzy Hash: AC81FF75A00209ABDB00DFD5C981BDEB7B9EB49309F50452AF900FB282D7789A45CB69

Function 0049682C Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 141fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004538BC: CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,004969FD,_iu,?,00000000,004539F6), ref: 004539AB
Part of subcall function 004538BC: CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,004969FD,_iu,?,00000000,004539F6), ref: 004539BB

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 004968A9
SetFileAttributesA.KERNEL32(00000000,00000080,00000000,004969FD), ref: 004968CA
CreateWindowExA.USER32(00000000,STATIC,00496A0C,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 004968F1
SetWindowLongA.USER32(?,000000FC,00496084), ref: 00496904
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,004969D0,?,?,000000FC,00496084,00000000,STATIC,00496A0C), ref: 00496934
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 004969A8
CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,004969D0,?,?,000000FC,00496084,00000000), ref: 004969B4

Part of subcall function 00453D30: WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00453E17

DestroyWindow.USER32(?,004969D7,00000000,00000000,00000000,00000000,00000000,00000097,00000000,004969D0,?,?,000000FC,00496084,00000000,STATIC), ref: 004969CA

Strings

/SECONDPHASE="%s" /FIRSTPHASEWND=$%x , xrefs: 00496963
STATIC, xrefs: 004968EA

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Window$File$CloseCreateHandle$AttributesCopyDestroyLongMultipleObjectsPrivateProfileStringWaitWrite
String ID: /SECONDPHASE="%s" /FIRSTPHASEWND=$%x $STATIC
API String ID: 1549857992-2312673372
Opcode ID: 0ff8806cfc16226b8271fea6881625880f8b34c0fceb2e6630b06791538ea603
Instruction ID: 05662a77ac8dbb229cb1f217f99859aac6875f761ccc70cea94f4b310aaeaa54
Opcode Fuzzy Hash: 0ff8806cfc16226b8271fea6881625880f8b34c0fceb2e6630b06791538ea603
Instruction Fuzzy Hash: 85414D70A00208AFDF00EFA5DC42F9E7BB8EB09704F11457AF510F7291D679AA008B68

Function 0042E418 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,0042E51D,?,00000000,0047E224,00000000), ref: 0042E441
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042E447
RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0042E51D,?,00000000,0047E224,00000000), ref: 0042E495

Strings

GetUserDefaultUILanguage, xrefs: 0042E437
.DEFAULT\Control Panel\International, xrefs: 0042E46C
Control Panel\Desktop\ResourceLocale, xrefs: 0042E4A4
kernel32.dll, xrefs: 0042E43C
QaE, xrefs: 0042E4D7, 0042E4DF, 0042E4EA, 0042E50C
Locale, xrefs: 0042E484

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$QaE$kernel32.dll
API String ID: 4190037839-2312295185
Opcode ID: 35095e656ef5d7fa0a9fc776174aa0ebe5c7f31f1e54572c1a22f8c063aae220
Instruction ID: f42d7e7755912f49377b3a3c2778cbb45b18f2cdc7334bb7b0fb93ca3fe573dd
Opcode Fuzzy Hash: 35095e656ef5d7fa0a9fc776174aa0ebe5c7f31f1e54572c1a22f8c063aae220
Instruction Fuzzy Hash: E8213230B10225BBDB10EAE6DC51B9E76B8EB44308F90447BA504E7281E77CDE419B5C

Function 004628C8 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 004628D4
GetModuleHandleA.KERNEL32(user32.dll), ref: 004628E8
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 004628F5
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 00462902
GetWindowRect.USER32(?,00000000), ref: 0046294E
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D,?,00000000), ref: 0046298C

Strings

MonitorFromWindow, xrefs: 004628EF
user32.dll, xrefs: 004628E3
(, xrefs: 0046292D
GetMonitorInfoA, xrefs: 004628FC

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Window$AddressProc$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2610873146-3407710046
Opcode ID: 51933d510fdc2b35f8277f6e81f95ff0a6ecacb1625e4b1c97d49bbd47144a3d
Instruction ID: b88ed3b497c956bed5d3405569dd74873656c78e9379ed97482968eb64e54f8d
Opcode Fuzzy Hash: 51933d510fdc2b35f8277f6e81f95ff0a6ecacb1625e4b1c97d49bbd47144a3d
Instruction Fuzzy Hash: E22183B5705B147BD7009A64DD41F7F3699DBC4720F09453AF944DB382E6B8EC048A9A

Function 0042F188 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0042F194
GetModuleHandleA.KERNEL32(user32.dll), ref: 0042F1A8
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 0042F1B5
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0042F1C2
GetWindowRect.USER32(?,00000000), ref: 0042F20E
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D), ref: 0042F24C

Strings

GetMonitorInfoA, xrefs: 0042F1BC
MonitorFromWindow, xrefs: 0042F1AF
user32.dll, xrefs: 0042F1A3
(, xrefs: 0042F1ED

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Window$AddressProc$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2610873146-3407710046
Opcode ID: d03a5336eb35153ccda785e1be34bacea57cfdeb7a98c38ce42309e3d491c1fb
Instruction ID: 50a2e38ba83faf67dd7c56e8d7733487d454ef14a416094e89dadcccf0bf0910
Opcode Fuzzy Hash: d03a5336eb35153ccda785e1be34bacea57cfdeb7a98c38ce42309e3d491c1fb
Instruction Fuzzy Hash: 3821F279704710ABD300EA68ED41F3B37A9DB89714F88457AF944DB382DA79EC044BA9

Function 00458AF4 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 127pipeCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00458CD3,?,00000000,00458D36,?,?,00000000,00000000), ref: 00458B51
TransactNamedPipe.KERNEL32(?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00458C68,?,00000000,00000001,00000000,00000000,00000000,00458CD3), ref: 00458BAE
GetLastError.KERNEL32(?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00458C68,?,00000000,00000001,00000000,00000000,00000000,00458CD3), ref: 00458BBB
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00458C07
GetOverlappedResult.KERNEL32(?,?,00000000,00000001,00458C41,?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00458C68,?,00000000), ref: 00458C2D
GetLastError.KERNEL32(?,?,00000000,00000001,00458C41,?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00458C68,?,00000000), ref: 00458C34

Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,00497F85,00000000), ref: 0045349F

Strings

CreateEvent, xrefs: 00458B5F
TransactNamedPipe, xrefs: 00458BC7

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ErrorLast$CreateEventMultipleNamedObjectsOverlappedPipeResultTransactWait
String ID: CreateEvent$TransactNamedPipe
API String ID: 2182916169-3012584893
Opcode ID: cd445275fb89d6df69e78ee85778bd79cffcc07580db40040f45f034c0efb706
Instruction ID: 0ef67bb603c363795969125e94a580235eeff181ddb05b6f1d1be6d110ffec77
Opcode Fuzzy Hash: cd445275fb89d6df69e78ee85778bd79cffcc07580db40040f45f034c0efb706
Instruction Fuzzy Hash: 70418E71A00608EFDB15DF95C981F9EB7F9EB08715F1040AAF900F7292DA789E44DA28

Function 00456BF8 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(OLEAUT32.DLL,UnRegisterTypeLib,00000000,00456D5D,?,?,00000031,?), ref: 00456C20
GetProcAddress.KERNEL32(00000000,OLEAUT32.DLL), ref: 00456C26
LoadTypeLib.OLEAUT32(00000000,?), ref: 00456C73

Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,00497F85,00000000), ref: 0045349F

Strings

UnRegisterTypeLib, xrefs: 00456C16
GetProcAddress, xrefs: 00456C33
LoadTypeLib, xrefs: 00456C7E
OLEAUT32.DLL, xrefs: 00456C1B
ITypeLib::GetLibAttr, xrefs: 00456CA9
UnRegisterTypeLib, xrefs: 00456CDF

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressErrorHandleLastLoadModuleProcType
String ID: GetProcAddress$ITypeLib::GetLibAttr$LoadTypeLib$OLEAUT32.DLL$UnRegisterTypeLib$UnRegisterTypeLib
API String ID: 1914119943-2711329623
Opcode ID: 3e19e1f9d82f0627edce4b12e1e0f8f8c598e604cb4ac052333ecb52fec70c2c
Instruction ID: b3f5faa621b90d83088b4b17fb935927980fc0aea231793fdf23f6d5fbfe6d64
Opcode Fuzzy Hash: 3e19e1f9d82f0627edce4b12e1e0f8f8c598e604cb4ac052333ecb52fec70c2c
Instruction Fuzzy Hash: 3E31A371B00604AFDB12EFAACC11D5A77BDEB897057528466FC04D3352DA38DD08CB28

Function 00416D80 Relevance: 15.2, APIs: 10, Instructions: 167windowCOMMON

Download Yara Rule

APIs

RectVisible.GDI32(?,?), ref: 00416E13
SaveDC.GDI32(?), ref: 00416E27
IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 00416E4A
RestoreDC.GDI32(?,?), ref: 00416E65
CreateSolidBrush.GDI32(00000000), ref: 00416EE5
FrameRect.USER32(?,?,?), ref: 00416F18
DeleteObject.GDI32(?), ref: 00416F22
CreateSolidBrush.GDI32(00000000), ref: 00416F32
FrameRect.USER32(?,?,?), ref: 00416F65
DeleteObject.GDI32(?), ref: 00416F6F

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Rect$BrushCreateDeleteFrameObjectSolid$ClipIntersectRestoreSaveVisible
String ID:
API String ID: 375863564-0
Opcode ID: 9d71f870ed9c6b7adb0073f445c908c0d6bb0069ee5c7552777bb1b8ba5f0c9b
Instruction ID: c082a38e55a2621cff38c0036c5e412d4739722926df34ebe37a7eff5f7859fc
Opcode Fuzzy Hash: 9d71f870ed9c6b7adb0073f445c908c0d6bb0069ee5c7552777bb1b8ba5f0c9b
Instruction Fuzzy Hash: 70515A712086459FDB50EF69C8C4B9B77E8AF48314F15466AFD488B286C738EC81CB99

Function 00404ABF Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B46
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B6A
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B86
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00404BA7
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00404BD0
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00404BDA
GetStdHandle.KERNEL32(000000F5), ref: 00404BFA
GetFileType.KERNEL32(?,000000F5), ref: 00404C11
CloseHandle.KERNEL32(?,?,000000F5), ref: 00404C2C
GetLastError.KERNEL32(000000F5), ref: 00404C46

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
Instruction ID: 0555156f4d2a620bb114dc01d937536d57074fdea11cd86abdfeb4dd56d828b4
Opcode Fuzzy Hash: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
Instruction Fuzzy Hash: 3741B3F02093009AF7305E248905B2375E5EBC0755F208E3FE296BA6E0D7BDE8458B1D

Function 004221E8 Relevance: 15.1, APIs: 10, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000), ref: 00422233
DeleteMenu.USER32(00000000,0000F130,00000000,00000000,00000000), ref: 00422251
DeleteMenu.USER32(00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 0042225E
DeleteMenu.USER32(00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 0042226B
DeleteMenu.USER32(00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 00422278
DeleteMenu.USER32(00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000), ref: 00422285
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000), ref: 00422292
DeleteMenu.USER32(00000000,0000F120,00000000,00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000), ref: 0042229F
EnableMenuItem.USER32(00000000,0000F020,00000001), ref: 004222BD
EnableMenuItem.USER32(00000000,0000F030,00000001), ref: 004222D9

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Menu$Delete$EnableItem$System
String ID:
API String ID: 3985193851-0
Opcode ID: fc4199aaac3f99511bb4ff32e12d7dfce3aae71cb8e2bfb07c8f1265a7c3622c
Instruction ID: 662ae76830c3dbb110fd6952920e185112f137d20e740dc0dcce1beff7d7cd05
Opcode Fuzzy Hash: fc4199aaac3f99511bb4ff32e12d7dfce3aae71cb8e2bfb07c8f1265a7c3622c
Instruction Fuzzy Hash: AF2144703407047AE720E724CD8BF9BBBD89B04708F5451A5BA487F6D3C6F9AB804698

Function 00461564 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 0046159F
GetActiveWindow.USER32 ref: 00461603
CoInitialize.OLE32(00000000), ref: 00461617
SHBrowseForFolder.SHELL32(?), ref: 0046162E
CoUninitialize.OLE32(0046166F,00000000,?,?,?,?,?,00000000,004616F3), ref: 00461643
SetActiveWindow.USER32(?,0046166F,00000000,?,?,?,?,?,00000000,004616F3), ref: 00461659
SetActiveWindow.USER32(?,?,0046166F,00000000,?,?,?,?,?,00000000,004616F3), ref: 00461662

Strings

A, xrefs: 004615D7

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ActiveWindow$BrowseFolderInitializeMallocUninitialize
String ID: A
API String ID: 2684663990-3554254475
Opcode ID: 30089e3c30d0c3d36f39b8b1d4781c2a21ffec0060a5585bd299ad216e4990aa
Instruction ID: 887b805d7b7894e7c3e16e65f0cb8bc8b62606f18410bd973e890a89b0dd1abf
Opcode Fuzzy Hash: 30089e3c30d0c3d36f39b8b1d4781c2a21ffec0060a5585bd299ad216e4990aa
Instruction Fuzzy Hash: 3D310F70E00348AFDB01EFB6D885A9EBBF8EB09304F55447AF415E7251E7785A04CB5A

Function 0045D18C Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 41libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,inflateInit_), ref: 0045D195
GetProcAddress.KERNEL32(00000000,inflate), ref: 0045D1A5
GetProcAddress.KERNEL32(00000000,inflateEnd), ref: 0045D1B5
GetProcAddress.KERNEL32(00000000,inflateReset), ref: 0045D1C5

Strings

inflate, xrefs: 0045D19F
inflateInit_, xrefs: 0045D18F
inflateEnd, xrefs: 0045D1AF
inflateReset, xrefs: 0045D1BF

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressProc
String ID: inflate$inflateEnd$inflateInit_$inflateReset
API String ID: 190572456-3516654456
Opcode ID: 80c5134a1f55eac21adb9a8231f5c97f635f55f56804fe188f7ba9ee36614b8d
Instruction ID: e76692604156c969a14c628a7f3d38bcbb79e262894e7ece3495cd036a1d4bae
Opcode Fuzzy Hash: 80c5134a1f55eac21adb9a8231f5c97f635f55f56804fe188f7ba9ee36614b8d
Instruction Fuzzy Hash: 640162B0D00701DAD728DFB6ACD172636A5EBA4306F10C13BE809962A2D37D4459DF3D

Function 0041A8DC Relevance: 13.7, APIs: 9, Instructions: 176windowCOMMON

Download Yara Rule

APIs

SetBkColor.GDI32(?,00000000), ref: 0041A9B9
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0041A9F3
SetBkColor.GDI32(?,?), ref: 0041AA08
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00CC0020), ref: 0041AA52
SetTextColor.GDI32(00000000,00000000), ref: 0041AA5D
SetBkColor.GDI32(00000000,00FFFFFF), ref: 0041AA6D
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00E20746), ref: 0041AAAC
SetTextColor.GDI32(00000000,00000000), ref: 0041AAB6
SetBkColor.GDI32(00000000,?), ref: 0041AAC3

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Color$StretchText
String ID:
API String ID: 2984075790-0
Opcode ID: d5776733ae79b3841affab46b3657f1400c4e8fd3bac8129ab5b82e8e92c5d66
Instruction ID: 4467ea82dd13d464879b0bd0dd0607b47ee3045dce17e21d2c6451b7f26a8ea4
Opcode Fuzzy Hash: d5776733ae79b3841affab46b3657f1400c4e8fd3bac8129ab5b82e8e92c5d66
Instruction Fuzzy Hash: 8761E5B5A00505AFCB40EFADD985E9AB7F8EF08314B10816AF908DB262C775ED40CF58

Function 0044D178 Relevance: 13.6, APIs: 9, Instructions: 90COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,00000001,00000001), ref: 0044D1A9
GetSysColor.USER32(00000014), ref: 0044D1B0
SetTextColor.GDI32(00000000,00000000), ref: 0044D1C8
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D1F1
OffsetRect.USER32(?,000000FF,000000FF), ref: 0044D1FB
GetSysColor.USER32(00000010), ref: 0044D202
SetTextColor.GDI32(00000000,00000000), ref: 0044D21A
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D243
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D26E

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Text$Color$Draw$OffsetRect
String ID:
API String ID: 1005981011-0
Opcode ID: 64e894641ce67cbe80cb84d1f014edff4e193ae3d7429a1fbcc6453b09a2e017
Instruction ID: 8406a00effd73db105afccad7da3796984cf264811f0ddac3e5cace4e0ac1d2b
Opcode Fuzzy Hash: 64e894641ce67cbe80cb84d1f014edff4e193ae3d7429a1fbcc6453b09a2e017
Instruction Fuzzy Hash: A021BDB42015047FC710FB2ACD8AE8B6BDCDF19319B05457AB958EB292C67CDD404668

Function 0041B66C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 144windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B745
GetDC.USER32(?), ref: 0041B751
SelectPalette.GDI32(00000000,?,00000000), ref: 0041B786
RealizePalette.GDI32(00000000), ref: 0041B792
CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041B7C0
SelectPalette.GDI32(00000000,00000000,00000000), ref: 0041B7F4

Strings

3!H, xrefs: 0041B674

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Palette$Select$BitmapCreateFocusRealize
String ID: 3!H
API String ID: 3275473261-770989722
Opcode ID: 9b17a45ebd00e155e5aeae17ac6cac102e8e00fd56b9a0d3692e3d2bf0971335
Instruction ID: 38bdddf8d72f5571b31e8017bfcff87152bbfcb95d4f6cd7f9962c0a723fddb9
Opcode Fuzzy Hash: 9b17a45ebd00e155e5aeae17ac6cac102e8e00fd56b9a0d3692e3d2bf0971335
Instruction Fuzzy Hash: 8A512F70A002099FDF11DFA9C881AEEBBF9FF49704F104066F504A7791D7799981CBA9

Function 0041B93C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 142windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041BA17
GetDC.USER32(?), ref: 0041BA23
SelectPalette.GDI32(00000000,?,00000000), ref: 0041BA5D
RealizePalette.GDI32(00000000), ref: 0041BA69
CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041BA8D
SelectPalette.GDI32(00000000,00000000,00000000), ref: 0041BAC1

Strings

3!H, xrefs: 0041B944

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Palette$Select$BitmapCreateFocusRealize
String ID: 3!H
API String ID: 3275473261-770989722
Opcode ID: f1b656a7ede54f8d65f93cc35dc493626dae048aef23b352968a277fb398f08e
Instruction ID: 3fcaffe560058c7771eaec6053d79e0e1924f360d52694d27862de55114c0f48
Opcode Fuzzy Hash: f1b656a7ede54f8d65f93cc35dc493626dae048aef23b352968a277fb398f08e
Instruction Fuzzy Hash: 9D512A74A002189FDB11DFA9C891AAEBBF9FF49700F154066F904EB751D738AD40CBA4

Function 004960D0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 90sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 0045092C: SetEndOfFile.KERNEL32(?,?,0045C21A,00000000,0045C3A5,?,00000000,00000002,00000002), ref: 00450933

Part of subcall function 00406F50: DeleteFileA.KERNEL32(00000000,0049B628,004982D1,00000000,00498326,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F5B

GetWindowThreadProcessId.USER32(00000000,?), ref: 00496161
OpenProcess.KERNEL32(00100000,00000000,?,00000000,?), ref: 00496175
SendNotifyMessageA.USER32(00000000,0000054D,00000000,00000000), ref: 0049618F
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 0049619B
CloseHandle.KERNEL32(00000000,00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 004961A1
Sleep.KERNEL32(000001F4,00000000,0000054D,00000000,00000000,00000000,?), ref: 004961B4

Strings

Deleting Uninstall data files., xrefs: 004960D7

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: FileProcess$CloseDeleteHandleMessageNotifyObjectOpenSendSingleSleepThreadWaitWindow
String ID: Deleting Uninstall data files.
API String ID: 1570157960-2568741658
Opcode ID: 098eea10618780f686b7a3c8f577816b854df39408f499a4f4d6e418665acdc5
Instruction ID: f761780b945b7fe8b82d6e025c481ead527c030d3f8fe43749ea068a3773b499
Opcode Fuzzy Hash: 098eea10618780f686b7a3c8f577816b854df39408f499a4f4d6e418665acdc5
Instruction Fuzzy Hash: 10217370304250AFEB10E77AEC87B2A3798DB15328F52453BB504962E3D67CAC04CA6D

Function 004700D8 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 89registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,37H,?,00000001,?,?,00483733,?,00000001,00000000), ref: 0042DE38

RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,004701D5,?,?,?,?,00000000), ref: 0047013F
RegCloseKey.ADVAPI32(?,?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,004701D5), ref: 00470156
AddFontResourceA.GDI32(00000000), ref: 00470173
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 00470187

Strings

Failed to set value in Fonts registry key., xrefs: 00470148
AddFontResource, xrefs: 00470191
Failed to open Fonts registry key., xrefs: 0047015D

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CloseFontMessageNotifyOpenResourceSendValue
String ID: AddFontResource$Failed to open Fonts registry key.$Failed to set value in Fonts registry key.
API String ID: 955540645-649663873
Opcode ID: 01bf44dadb164a8cfbd18d444b82604aded5fab2352620559528e680a448af29
Instruction ID: edb246ac8d360be22e831a605db15bcf50c93ef0f31456572a4f1831c9a006fe
Opcode Fuzzy Hash: 01bf44dadb164a8cfbd18d444b82604aded5fab2352620559528e680a448af29
Instruction Fuzzy Hash: 2B21B270741204BAD710EAA69C42F9E779DDB45704FA08077F904EB3C2DA7D9E02866D

Function 00462D08 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00416410: GetClassInfoA.USER32(00400000,?,?), ref: 0041647F
Part of subcall function 00416410: UnregisterClassA.USER32(?,00400000), ref: 004164AB
Part of subcall function 00416410: RegisterClassA.USER32(?), ref: 004164CE

GetVersion.KERNEL32 ref: 00462D38
SendMessageA.USER32(00000000,0000112C,00000004,00000004), ref: 00462D76
SHGetFileInfo.SHELL32(00462E14,00000000,?,00000160,00004011), ref: 00462D93
LoadCursorA.USER32(00000000,00007F02), ref: 00462DB1
SetCursor.USER32(00000000,00000000,00007F02,00462E14,00000000,?,00000160,00004011), ref: 00462DB7
SetCursor.USER32(?,00462DF7,00007F02,00462E14,00000000,?,00000160,00004011), ref: 00462DEA

Strings

Explorer, xrefs: 00462D52

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ClassCursor$Info$FileLoadMessageRegisterSendUnregisterVersion
String ID: Explorer
API String ID: 2594429197-512347832
Opcode ID: a2e9ae9cb6bbe51d8d64c1330c559a6660772c754723a6bd460fb469bd151c7a
Instruction ID: ffdf2bcf01de770556fc9a1a904d7b5cbe2215756c8dfda3fdc8a5fea8adaa53
Opcode Fuzzy Hash: a2e9ae9cb6bbe51d8d64c1330c559a6660772c754723a6bd460fb469bd151c7a
Instruction Fuzzy Hash: 5221D5307407047BE711BB758D47B9A3698EB09708F4004BFF604EA2C3EEBD985186AD

Function 00477EF8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 66libraryfileloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetFinalPathNameByHandleA,02132C0C,?,?,?,02132C0C,004780BC,00000000,004781DA,?,?,-00000010,?), ref: 00477F11
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00477F17
GetFileAttributesA.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,02132C0C,?,?,?,02132C0C,004780BC,00000000,004781DA,?,?,-00000010,?), ref: 00477F2A
CreateFileA.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,02132C0C,?,?,?,02132C0C), ref: 00477F54
CloseHandle.KERNEL32(00000000,?,?,?,02132C0C,004780BC,00000000,004781DA,?,?,-00000010,?), ref: 00477F72

Strings

GetFinalPathNameByHandleA, xrefs: 00477F07
kernel32.dll, xrefs: 00477F0C

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: FileHandle$AddressAttributesCloseCreateModuleProc
String ID: GetFinalPathNameByHandleA$kernel32.dll
API String ID: 2704155762-2318956294
Opcode ID: 02635a6eba41d1d381b3ff010b71e21b86f61c13db2d6aeaf7634f2930668ec2
Instruction ID: f6b14e4403fa6e021c9b420378acc5d4cb4866daa4f233b6b4aef587dbeed81a
Opcode Fuzzy Hash: 02635a6eba41d1d381b3ff010b71e21b86f61c13db2d6aeaf7634f2930668ec2
Instruction Fuzzy Hash: 0401B951748B0436E520326A4D86FBB654D8B4076DF648537FA1CEF2D2D9AC9D06019E

Function 00459CE4 Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 121COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00459E66,?,00000000,00000000,00000000,?,00000006,?,00000000,00497439,?,00000000,004974DC), ref: 00459DAA

Part of subcall function 004543F4: FindClose.KERNEL32(000000FF,004544EA), ref: 004544D9

Strings

Failed to delete directory (%d)., xrefs: 00459E40
Failed to delete directory (%d). Will delete on restart (if empty)., xrefs: 00459E1F
Stripped read-only attribute., xrefs: 00459D6C
Failed to strip read-only attribute., xrefs: 00459D78
Not stripping read-only attribute because the directory does not appear to be empty., xrefs: 00459D84
Deleting directory: %s, xrefs: 00459D33
Failed to delete directory (%d). Will retry later., xrefs: 00459DC3

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CloseErrorFindLast
String ID: Deleting directory: %s$Failed to delete directory (%d).$Failed to delete directory (%d). Will delete on restart (if empty).$Failed to delete directory (%d). Will retry later.$Failed to strip read-only attribute.$Not stripping read-only attribute because the directory does not appear to be empty.$Stripped read-only attribute.
API String ID: 754982922-1448842058
Opcode ID: 2b5b70f1799cd2e20623f0c3bad5597a11f99a08b1534049f065463acc6bba50
Instruction ID: 487a8df0da378a50a54402f8a8e6859597fb7ae5ca12eb66e0df57f27e629c6b
Opcode Fuzzy Hash: 2b5b70f1799cd2e20623f0c3bad5597a11f99a08b1534049f065463acc6bba50
Instruction Fuzzy Hash: 1F417130A04244CACB10EB69C8423AE76A59F8930AF54857BAC15A73D3DB7C8D0DC75A

Function 0042F290 Relevance: 12.1, APIs: 8, Instructions: 102windowCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 0042F2BA
GetWindowLongA.USER32(?,000000EC), ref: 0042F2D1
GetActiveWindow.USER32 ref: 0042F2DA
MessageBoxA.USER32(00000000,00000000,00000000,00000000), ref: 0042F307
SetActiveWindow.USER32(?,0042F437,00000000,?), ref: 0042F328

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Window$ActiveLong$Message
String ID:
API String ID: 2785966331-0
Opcode ID: 11db5c39fda7e9e37fc13726db040ca70a735e85c888501a128082291c1f2969
Instruction ID: ac844ef734d24c76dc9aa96f201b13a865b129e9c1b137beabd8cb6517960092
Opcode Fuzzy Hash: 11db5c39fda7e9e37fc13726db040ca70a735e85c888501a128082291c1f2969
Instruction Fuzzy Hash: F931D271A00254AFEB01EFA5DD52E6EBBB8EB09304F9144BAF804E3291D73C9D10CB58

Function 00429480 Relevance: 12.1, APIs: 8, Instructions: 62COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0042948A
GetTextMetricsA.GDI32(00000000), ref: 00429493

Part of subcall function 0041A1E8: CreateFontIndirectA.GDI32(?), ref: 0041A2A7

SelectObject.GDI32(00000000,00000000), ref: 004294A2
GetTextMetricsA.GDI32(00000000,?), ref: 004294AF
SelectObject.GDI32(00000000,00000000), ref: 004294B6
ReleaseDC.USER32(00000000,00000000), ref: 004294BE
GetSystemMetrics.USER32(00000006), ref: 004294E3
GetSystemMetrics.USER32(00000006), ref: 004294FD

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Metrics$ObjectSelectSystemText$CreateFontIndirectRelease
String ID:
API String ID: 1583807278-0
Opcode ID: 33023116b38033d851b06c26603ef1f627da642c76d1d31b10a48b25f89d3417
Instruction ID: 8a5b62ad3b2811282b00f4aa11bc4c2c065e9b9ae855548013837f5c18493421
Opcode Fuzzy Hash: 33023116b38033d851b06c26603ef1f627da642c76d1d31b10a48b25f89d3417
Instruction Fuzzy Hash: 0F01C4A17087103BE321767A9CC6F6F65C8DB44358F84043BF686D63D3D96C9C41866A

Function 0041DE24 Relevance: 12.1, APIs: 8, Instructions: 60windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0041DE27
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0041DE31
ReleaseDC.USER32(00000000,00000000), ref: 0041DE3E
MulDiv.KERNEL32(00000008,00000060,00000048), ref: 0041DE4D
GetStockObject.GDI32(00000007), ref: 0041DE5B
GetStockObject.GDI32(00000005), ref: 0041DE67
GetStockObject.GDI32(0000000D), ref: 0041DE73
LoadIconA.USER32(00000000,00007F00), ref: 0041DE84

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ObjectStock$CapsDeviceIconLoadRelease
String ID:
API String ID: 225703358-0
Opcode ID: 93123cf7b7da28845296a778695a34f9ae7968dfa7e72d2685fd09fde09bf652
Instruction ID: 282f56568f1177e4dad385ec7f61a974d29090d827cf1f87eb40c920fa9ca7e8
Opcode Fuzzy Hash: 93123cf7b7da28845296a778695a34f9ae7968dfa7e72d2685fd09fde09bf652
Instruction Fuzzy Hash: 4C1142706457015EE340BFA66E52B6A36A4D725708F40413FF609AF3D1D77A2C448B9E

Function 00463118 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 273COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F02), ref: 0046321C
SetCursor.USER32(00000000,00000000,00007F02,00000000,004632B1), ref: 00463222
SetCursor.USER32(?,00463299,00007F02,00000000,004632B1), ref: 0046328C

Strings

, xrefs: 00463497
, xrefs: 004634B2
Internal error: Item already expanding, xrefs: 004631B9

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Cursor$Load
String ID: $ $Internal error: Item already expanding
API String ID: 1675784387-1948079669
Opcode ID: d6abcfe13bbf9e478e2ac3749bb31cb32d16938431ae96ca9092eb1d8a5228c9
Instruction ID: 9c63b88249a6b2a043d95d6a291c06ea88b324d4d5646231a91c330f02ea7575
Opcode Fuzzy Hash: d6abcfe13bbf9e478e2ac3749bb31cb32d16938431ae96ca9092eb1d8a5228c9
Instruction Fuzzy Hash: D6B1A130A00284DFD711DF65C585B9ABBF4AF04305F1484AEE8459B792EB7CEE44CB5A

Function 00453D30 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 225COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00453E17

Strings

WININIT.INI, xrefs: 00453DC5
NUL, xrefs: 00453ED9
MoveFileEx, xrefs: 00454027
[rename], xrefs: 00453E7A, 00453EB6
.tmp, xrefs: 00453DD3

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID: .tmp$MoveFileEx$NUL$WININIT.INI$[rename]
API String ID: 390214022-3304407042
Opcode ID: 3a7f67efcd7e81dadc528b9d15263cd5cedffac5342d4ba97c059f53dc3f2af1
Instruction ID: 4c4b1d7f09994941c57eaafc4db68242d6a3f6c21ecd3f2b5b8f846a746055a2
Opcode Fuzzy Hash: 3a7f67efcd7e81dadc528b9d15263cd5cedffac5342d4ba97c059f53dc3f2af1
Instruction Fuzzy Hash: 40911434E002099BDB01EFA5D842BDEB7F5AF4874AF608466E90077392D7786E49CB58

Function 00408720 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00408968,?,?,?,?,00000000,00000000,00000000,?,0040996F,00000000,00409982), ref: 0040873A

Part of subcall function 00408568: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049B4C0,00000001,?,00408633,?,00000000,00408712), ref: 00408586

Part of subcall function 004085B4: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,004087B6,?,?,?,00000000,00408968), ref: 004085C7

Strings

m/d/yy, xrefs: 00408809
AMPM, xrefs: 00408905
:mm:ss, xrefs: 00408936
:mm, xrefs: 0040891C
mmmm d, yyyy, xrefs: 0040882B

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: 1aa54b825be0663a048d9151eb266916599812ed65bca77d997a641661a7f1c7
Instruction ID: 5c6fde8006682913ecab3173e7335377554a92ac61a87523d81808753b4ec1a9
Opcode Fuzzy Hash: 1aa54b825be0663a048d9151eb266916599812ed65bca77d997a641661a7f1c7
Instruction Fuzzy Hash: 7D516C24B00108ABDB01FBA69E4169EB7A9DB94308F50C07FA181BB3C3CE3DDA05975D

Function 004116F4 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 158windowCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,004118F9), ref: 0041178C
InsertMenuItemA.USER32(?,000000FF,00000001,0000002C), ref: 0041184A

Part of subcall function 00411AAC: CreatePopupMenu.USER32 ref: 00411AC6

InsertMenuA.USER32(?,000000FF,?,?,00000000), ref: 004118D6

Part of subcall function 00411AAC: CreateMenu.USER32 ref: 00411AD0

InsertMenuA.USER32(?,000000FF,?,00000000,00000000), ref: 004118BD

Strings

?, xrefs: 004117A6
,, xrefs: 0041179F

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Menu$Insert$Create$ItemPopupVersion
String ID: ,$?
API String ID: 2359071979-2308483597
Opcode ID: 1956e794d50847aa48f090e1e974dc612a96ae6ee68340223bb9305f49f23e04
Instruction ID: ecf66c9774bccec907b621c371347452b74b7622051e058d8a4a73451c3e974f
Opcode Fuzzy Hash: 1956e794d50847aa48f090e1e974dc612a96ae6ee68340223bb9305f49f23e04
Instruction Fuzzy Hash: D7510674A00245ABDB10EF6ADC816EA7BF9AF09304B11857BF904E73A6D738DD41CB58

Function 0041BE63 Relevance: 10.7, APIs: 7, Instructions: 153windowCOMMON

Download Yara Rule

APIs

GetObjectA.GDI32(?,00000018,?), ref: 0041BF28
GetObjectA.GDI32(?,00000018,?), ref: 0041BF37
GetBitmapBits.GDI32(?,?,?), ref: 0041BF88
GetBitmapBits.GDI32(?,?,?), ref: 0041BF96
DeleteObject.GDI32(?), ref: 0041BF9F
DeleteObject.GDI32(?), ref: 0041BFA8
CreateIcon.USER32(00400000,?,?,?,?,?,?), ref: 0041BFC5

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Object$BitmapBitsDelete$CreateIcon
String ID:
API String ID: 1030595962-0
Opcode ID: dabea464bc85c36b4411cc83672e19ff5768c85fc4c65aec36842f1966395034
Instruction ID: 74cae3b7aa7aab4ce12a2fbd062d204c5c4082198076ec6df892ad84fd278e80
Opcode Fuzzy Hash: dabea464bc85c36b4411cc83672e19ff5768c85fc4c65aec36842f1966395034
Instruction Fuzzy Hash: 6A510671A002199FCB10DFA9C9819EEB7F9EF48314B11416AF914E7395D738AD41CB68

Function 0041CED8 Relevance: 10.7, APIs: 7, Instructions: 152windowCOMMON

Download Yara Rule

APIs

SetStretchBltMode.GDI32(00000000,00000003), ref: 0041CEFE
GetDeviceCaps.GDI32(00000000,00000026), ref: 0041CF1D
SelectPalette.GDI32(?,?,00000001), ref: 0041CF83
RealizePalette.GDI32(?), ref: 0041CF92
StretchBlt.GDI32(00000000,?,?,?,?,?,00000000,00000000,00000000,?,?), ref: 0041CFFC
StretchDIBits.GDI32(?,?,?,?,?,00000000,00000000,00000000,?,?,?,00000000,?), ref: 0041D03A
SelectPalette.GDI32(?,?,00000001), ref: 0041D05F

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: PaletteStretch$Select$BitsCapsDeviceModeRealize
String ID:
API String ID: 2222416421-0
Opcode ID: 005477d534ded6a1333eb88360c51d017015bb26bfeda877011d4b02ad3af21b
Instruction ID: 4b814cf558339e083a7fb5ccd56fb4ffad9fd0a27a4bfdacf16c2dd2476febac
Opcode Fuzzy Hash: 005477d534ded6a1333eb88360c51d017015bb26bfeda877011d4b02ad3af21b
Instruction Fuzzy Hash: D2515EB0604200AFDB14DFA8C985F9BBBE9EF08304F10459AB549DB292C778ED81CB58

Function 004571B4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,?,?), ref: 00457206

Part of subcall function 0042427C: GetWindowTextA.USER32(?,?,00000100), ref: 0042429C

Part of subcall function 0041EEA4: GetCurrentThreadId.KERNEL32 ref: 0041EEF3
Part of subcall function 0041EEA4: EnumThreadWindows.USER32(00000000,0041EE54,00000000), ref: 0041EEF9

Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0045726D
TranslateMessage.USER32(?), ref: 0045728B
DispatchMessageA.USER32(?), ref: 00457294

Strings

[Paused] , xrefs: 0045723C

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Message$TextThreadWindow$CurrentDispatchEnumSendTranslateWindows
String ID: [Paused]
API String ID: 1007367021-4230553315
Opcode ID: d02ef8ab2bf39247f1fe84a4d4970361fc03c061cec3499ad24772e3637fd057
Instruction ID: 59d40607b048d5b57409de994e913315237add37533dbcd11464ac15b97af71d
Opcode Fuzzy Hash: d02ef8ab2bf39247f1fe84a4d4970361fc03c061cec3499ad24772e3637fd057
Instruction Fuzzy Hash: 8731CA309082449EDB11DBB5EC81BDE7BB8DB49314F5540B7F800E7292D67C9949CB69

Function 0046B2F8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99sleepCOMMON

Download Yara Rule

APIs

GetCursor.USER32(00000000,0046B437), ref: 0046B3B4
LoadCursorA.USER32(00000000,00007F02), ref: 0046B3C2
SetCursor.USER32(00000000,00000000,00007F02,00000000,0046B437), ref: 0046B3C8
Sleep.KERNEL32(000002EE,00000000,00000000,00007F02,00000000,0046B437), ref: 0046B3D2
SetCursor.USER32(00000000,000002EE,00000000,00000000,00007F02,00000000,0046B437), ref: 0046B3D8

Strings

CheckPassword, xrefs: 0046B35C

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Cursor$LoadSleep
String ID: CheckPassword
API String ID: 4023313301-1302249611
Opcode ID: 44b8382409f936438604d225ef89184371de59a866ae62e55b9f5dcfd9756c82
Instruction ID: b09255d9a7c611b0bfc089710c17667b12f0d593a5b55614b79a89e9649d4142
Opcode Fuzzy Hash: 44b8382409f936438604d225ef89184371de59a866ae62e55b9f5dcfd9756c82
Instruction Fuzzy Hash: 0F3163347402449FD711EF69C889F9E7BE0EB45308F5580B6B844DB3A2D778AE80CB99

Function 004777F4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 92windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0047771C: GetWindowThreadProcessId.USER32(00000000), ref: 00477724
Part of subcall function 0047771C: GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,0047781B,0049C0A4,00000000), ref: 00477737
Part of subcall function 0047771C: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0047773D

SendMessageA.USER32(00000000,0000004A,00000000,00477BAE), ref: 00477829
GetTickCount.KERNEL32 ref: 0047786E
GetTickCount.KERNEL32 ref: 00477878
MsgWaitForMultipleObjects.USER32(00000000,00000000,00000000,0000000A,000000FF), ref: 004778CD

Strings

CallSpawnServer: Unexpected status: %d, xrefs: 004778B6
CallSpawnServer: Unexpected response: $%x, xrefs: 0047785E

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CountTick$AddressHandleMessageModuleMultipleObjectsProcProcessSendThreadWaitWindow
String ID: CallSpawnServer: Unexpected response: $%x$CallSpawnServer: Unexpected status: %d
API String ID: 613034392-3771334282
Opcode ID: ca880343a386001ff40cbe570b9ef123517aa43358773809a55ead1e01c0fa0a
Instruction ID: 299670a9d8cbc3645b3f78b49a497e4fea958f91e042c3b01241e910438e05bb
Opcode Fuzzy Hash: ca880343a386001ff40cbe570b9ef123517aa43358773809a55ead1e01c0fa0a
Instruction Fuzzy Hash: 2431D674F042149BDB10EBB9C8867EEB6E49F04314F90807AB548EB392D67C4D01CB9D

Function 0045965C Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(626D6573,CreateAssemblyCache), ref: 00459717

Strings

Fusion.dll, xrefs: 004596B7
CreateAssemblyCache, xrefs: 0045970E
.NET Framework CreateAssemblyCache function failed, xrefs: 0045973A
Failed to load .NET Framework DLL "%s", xrefs: 004596FC
Failed to get address of .NET Framework CreateAssemblyCache function, xrefs: 00459722

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressProc
String ID: .NET Framework CreateAssemblyCache function failed$CreateAssemblyCache$Failed to get address of .NET Framework CreateAssemblyCache function$Failed to load .NET Framework DLL "%s"$Fusion.dll
API String ID: 190572456-3990135632
Opcode ID: 4c41a785560e20bd7f4efb213984261e3dc167c4566bd066bbc2c635501a0dfa
Instruction ID: 558248bdb3bf595e2e3e39b0d8ee8dc7338ab5379a9da9f0630157063a96258d
Opcode Fuzzy Hash: 4c41a785560e20bd7f4efb213984261e3dc167c4566bd066bbc2c635501a0dfa
Instruction Fuzzy Hash: 1A318870E10605EBCB10EFA5C88169EB7B8EF48315F50857BE814E7382DB389E08C799

Function 0041C148 Relevance: 10.6, APIs: 7, Instructions: 70windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0041C048: GetObjectA.GDI32(?,00000018), ref: 0041C055

GetFocus.USER32 ref: 0041C168
GetDC.USER32(?), ref: 0041C174
SelectPalette.GDI32(?,?,00000000), ref: 0041C195
RealizePalette.GDI32(?), ref: 0041C1A1
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 0041C1B8
SelectPalette.GDI32(?,00000000,00000000), ref: 0041C1E0
ReleaseDC.USER32(?,?), ref: 0041C1ED

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Palette$Select$BitsFocusObjectRealizeRelease
String ID:
API String ID: 3303097818-0
Opcode ID: 26117fda3ddcda01a6cc84f42a4f6ec069d0e010bd6cdd98afb854c6c7779a8d
Instruction ID: 25a0b6576c779426e59073023ceed4ef49f3845c1b310514cd4f08ef327de147
Opcode Fuzzy Hash: 26117fda3ddcda01a6cc84f42a4f6ec069d0e010bd6cdd98afb854c6c7779a8d
Instruction Fuzzy Hash: 49116D71A44604BFDF10DBE9CC81FAFB7FCEB48700F50486AB518E7281DA7899008B28

Function 00418C54 Relevance: 10.6, APIs: 7, Instructions: 67COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000E), ref: 00418C70
GetSystemMetrics.USER32(0000000D), ref: 00418C78
6F522980.COMCTL32(00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418C7E

Part of subcall function 004107F8: 6F51C400.COMCTL32(0049B628,000000FF,00000000,00418CAC,00000000,00418D08,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 004107FC

6F58CB00.COMCTL32(0049B628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418CCE
6F58C740.COMCTL32(00000000,?,0049B628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001), ref: 00418CD9
6F58CB00.COMCTL32(0049B628,00000001,?,?,00000000,?,0049B628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000), ref: 00418CEC
6F520860.COMCTL32(0049B628,00418D0F,?,00000000,?,0049B628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000,0000000E), ref: 00418D02

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: MetricsSystem$C400C740F520860F522980
String ID:
API String ID: 2856677924-0
Opcode ID: e2c7fe5230f8d2f143d47c0d6a7892a097693e1c100db4317caf46c6149257f7
Instruction ID: f48c8f8e6a400555c090207229051c9eae11b8a9b20c4da93df477ea8fa1a9e8
Opcode Fuzzy Hash: e2c7fe5230f8d2f143d47c0d6a7892a097693e1c100db4317caf46c6149257f7
Instruction Fuzzy Hash: 6B112475744204BBDB50EBA9EC82FAD73F8DB08704F504066B514EB2C1DAB9AD808759

Function 004837BC Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,37H,?,00000001,?,?,00483733,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,00483874), ref: 00483859

Strings

ProductType, xrefs: 004837F8
LanmanNT, xrefs: 00483823
System\CurrentControlSet\Control\ProductOptions, xrefs: 004837E0
WinNT, xrefs: 00483809
ServerNT, xrefs: 0048383D

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CloseOpen
String ID: LanmanNT$ProductType$ServerNT$System\CurrentControlSet\Control\ProductOptions$WinNT
API String ID: 47109696-2530820420
Opcode ID: 3ad13a19f6e4c10b8ef41cf1365920aabe65a3cc38594f05f2e38bb50b4e5b67
Instruction ID: 1dfcf6bb9fe641fa61e52870c2eb081b504a015dbdcc7d4aeb9825b5cf210b35
Opcode Fuzzy Hash: 3ad13a19f6e4c10b8ef41cf1365920aabe65a3cc38594f05f2e38bb50b4e5b67
Instruction Fuzzy Hash: CD118E30B04204AADB10FF658C51B5EBAE9DB45B09F61487AB800E7281EB78DB05975D

Function 004950E4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004950F5

Part of subcall function 0041A1E8: CreateFontIndirectA.GDI32(?), ref: 0041A2A7

SelectObject.GDI32(00000000,00000000), ref: 00495117
GetTextExtentPointA.GDI32(00000000,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,00495695), ref: 0049512B
GetTextMetricsA.GDI32(00000000,?), ref: 0049514D
ReleaseDC.USER32(00000000,00000000), ref: 0049516A

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz, xrefs: 00495122

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Text$CreateExtentFontIndirectMetricsObjectPointReleaseSelect
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
API String ID: 2948443157-222967699
Opcode ID: 5badb62f71b3d99971882b4f0678e1772bdc8b17f624e945f1c31b5db279baf8
Instruction ID: 0df81e417f092862c4a6b10bc5b85ed6f3f433902ba426d4dc320704c2e31f18
Opcode Fuzzy Hash: 5badb62f71b3d99971882b4f0678e1772bdc8b17f624e945f1c31b5db279baf8
Instruction Fuzzy Hash: F5012176A04708BFDB15DBA9CC42F5EB7ECDB48704F614476F604E7291D678AE008B68

Function 0041B462 Relevance: 10.6, APIs: 7, Instructions: 57windowCOMMON

Download Yara Rule

APIs

SelectObject.GDI32(00000000,?), ref: 0041B470
SelectObject.GDI32(?,00000000), ref: 0041B47F
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B4AB
SelectObject.GDI32(00000000,00000000), ref: 0041B4B9
SelectObject.GDI32(?,00000000), ref: 0041B4C7
DeleteDC.GDI32(00000000), ref: 0041B4D0
DeleteDC.GDI32(?), ref: 0041B4D9

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ObjectSelect$Delete$Stretch
String ID:
API String ID: 1458357782-0
Opcode ID: 8542cbb8adbe0fd8af4a730cfe3faeef428ae57c020086fb9cb954466ea4b08d
Instruction ID: 052e9154069abc57648b404522aaf552eddfcc6d95cd3388d63b7ef9ce004286
Opcode Fuzzy Hash: 8542cbb8adbe0fd8af4a730cfe3faeef428ae57c020086fb9cb954466ea4b08d
Instruction Fuzzy Hash: 7B115C72E40619ABDB10DAD9DC86FEFB7BCEF08704F144555B614F7282C678AC418BA8

Function 00423394 Relevance: 10.6, APIs: 7, Instructions: 56threadwindowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 004233AF
WindowFromPoint.USER32(?,?), ref: 004233BC
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 004233CA
GetCurrentThreadId.KERNEL32 ref: 004233D1
SendMessageA.USER32(00000000,00000084,?,?), ref: 004233EA
SendMessageA.USER32(00000000,00000020,00000000,00000000), ref: 00423401
SetCursor.USER32(00000000), ref: 00423413

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CursorMessageSendThreadWindow$CurrentFromPointProcess
String ID:
API String ID: 1770779139-0
Opcode ID: 134875e674979cd567c136abb418dc525a6250aa5b529fa10794d0eebf3240cc
Instruction ID: 22bb490dc700fc35bbf8fe9eba0271ced42fa0644d0760cf779c582944844a3d
Opcode Fuzzy Hash: 134875e674979cd567c136abb418dc525a6250aa5b529fa10794d0eebf3240cc
Instruction Fuzzy Hash: BA01D4223046103AD6217B755D82E2F26E8DB85B15F50407FF504BB283DA3D9D11937D

Function 00494F08 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll), ref: 00494F18
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 00494F25
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 00494F32

Strings

user32.dll, xrefs: 00494F13
MonitorFromRect, xrefs: 00494F1F
GetMonitorInfoA, xrefs: 00494F2C

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetMonitorInfoA$MonitorFromRect$user32.dll
API String ID: 667068680-2254406584
Opcode ID: 37909b725e6a52ee00d16a74014c96465fb066db26e4bf6f46264368631e9446
Instruction ID: 2f2711a2512f7fb170870be193f04cf16a3e8db421c69f418f1b662089c325dd
Opcode Fuzzy Hash: 37909b725e6a52ee00d16a74014c96465fb066db26e4bf6f46264368631e9446
Instruction Fuzzy Hash: 4DF0F652B45B1A26EA2065668C41E7B698CCBC5774F040137BD44A7386E95C8D0242FD

Function 0045D060 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,ISCryptGetVersion), ref: 0045D069
GetProcAddress.KERNEL32(00000000,ArcFourInit), ref: 0045D079
GetProcAddress.KERNEL32(00000000,ArcFourCrypt), ref: 0045D089

Strings

ISCryptGetVersion, xrefs: 0045D063
ArcFourInit, xrefs: 0045D073
ArcFourCrypt, xrefs: 0045D083

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressProc
String ID: ArcFourCrypt$ArcFourInit$ISCryptGetVersion
API String ID: 190572456-508647305
Opcode ID: 5122bc98b4243edee483dbd362e818e6acc0399cd5465a234f2a44048f9c1fe5
Instruction ID: 3f16491fd0632e8a02841724fbace7a68b5b3961c1e73dc4b9133e40a6f013db
Opcode Fuzzy Hash: 5122bc98b4243edee483dbd362e818e6acc0399cd5465a234f2a44048f9c1fe5
Instruction Fuzzy Hash: 93F012B0980701DBE728EFB6BCC57263695EBE571AF14C137A414911E2D7780459CF1D

Function 0045D560 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressInit), ref: 0045D569
GetProcAddress.KERNEL32(00000000,BZ2_bzDecompress), ref: 0045D579
GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressEnd), ref: 0045D589

Strings

BZ2_bzDecompressInit, xrefs: 0045D563
BZ2_bzDecompressEnd, xrefs: 0045D583
BZ2_bzDecompress, xrefs: 0045D573

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressProc
String ID: BZ2_bzDecompress$BZ2_bzDecompressEnd$BZ2_bzDecompressInit
API String ID: 190572456-212574377
Opcode ID: 32367f3f71a88edad6cb0c18a1faf3f35cd26c2391eb0080ad94b90b0e942293
Instruction ID: 7482b4c4bf9fc4dc9e9e03776ed9023a769b21f625f1bb01c5bf02fa64bb1e85
Opcode Fuzzy Hash: 32367f3f71a88edad6cb0c18a1faf3f35cd26c2391eb0080ad94b90b0e942293
Instruction Fuzzy Hash: 08F0D0B0D01704EBE725EFB69CC772636959F6431AF10843BAA0E55362E6784489CF2C

Function 0042EA1C Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 30libraryloaderwindowCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilterEx,00000004,00499934,004570C9,0045746C,00457020,00000000,00000B06,00000000,00000000,00000001,00000000,00000002,00000000,00480E10), ref: 0042EA35
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EA3B
InterlockedExchange.KERNEL32(0049B668,00000001), ref: 0042EA4C

Part of subcall function 0042E9AC: GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042EA70,00000004,00499934,004570C9,0045746C,00457020,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042E9C2
Part of subcall function 0042E9AC: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E9C8
Part of subcall function 0042E9AC: InterlockedExchange.KERNEL32(0049B660,00000001), ref: 0042E9D9

ChangeWindowMessageFilterEx.USER32(00000000,?,00000001,00000000,00000004,00499934,004570C9,0045746C,00457020,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042EA60

Strings

ChangeWindowMessageFilterEx, xrefs: 0042EA2B
user32.dll, xrefs: 0042EA30

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressExchangeHandleInterlockedModuleProc$ChangeFilterMessageWindow
String ID: ChangeWindowMessageFilterEx$user32.dll
API String ID: 142928637-2676053874
Opcode ID: 2e6935975283b392abf6eb535232e6e33c7297ce4864da2c850d0b2669d54df9
Instruction ID: 20967f7a279d57b19857f2ad39d34e10c6be6de8430a8d3efc5b40b14e24a4c3
Opcode Fuzzy Hash: 2e6935975283b392abf6eb535232e6e33c7297ce4864da2c850d0b2669d54df9
Instruction Fuzzy Hash: 99E092A1741B20EAEA10B7B67C86FAA2658EB1076DF500037F100A51F1C3BD1C80CE9E

Function 0044C7DC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleacc.dll,?,0044F089), ref: 0044C7EB
GetProcAddress.KERNEL32(00000000,LresultFromObject), ref: 0044C7FC
GetProcAddress.KERNEL32(00000000,CreateStdAccessibleObject), ref: 0044C80C

Strings

oleacc.dll, xrefs: 0044C7E6
LresultFromObject, xrefs: 0044C7F6
CreateStdAccessibleObject, xrefs: 0044C806

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateStdAccessibleObject$LresultFromObject$oleacc.dll
API String ID: 2238633743-1050967733
Opcode ID: 46df6f242ffea6dadd9b95a3969ee6b07dfd2bdc83798fbb48fe9be8034c654b
Instruction ID: d6497c9818d993b67a5702c7731996643d684f189bbd4b702b1f6e54e13363b7
Opcode Fuzzy Hash: 46df6f242ffea6dadd9b95a3969ee6b07dfd2bdc83798fbb48fe9be8034c654b
Instruction Fuzzy Hash: 50F0DA70282305CAE750BBB5FDD57263694E3A470AF18277BE841551A2C7B94844CB8C

Function 004787A8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,00498804), ref: 004787AE
GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 004787BB
GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 004787CB

Strings

kernel32.dll, xrefs: 004787A9
VerifyVersionInfoW, xrefs: 004787C5
VerSetConditionMask, xrefs: 004787B5

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: VerSetConditionMask$VerifyVersionInfoW$kernel32.dll
API String ID: 667068680-222143506
Opcode ID: e5a812b49ea658e27832845ac616033cc340e8eedd8302905143a2296aa88e52
Instruction ID: 13b8254b67659438ed938111a26cc9552f559048ccc0a884e9908eb0bf6ec68f
Opcode Fuzzy Hash: e5a812b49ea658e27832845ac616033cc340e8eedd8302905143a2296aa88e52
Instruction Fuzzy Hash: 91C0C9F02C0701EA9604B7F11CCA97B2988C550724330843F704EA6183D97C0C104A2C

Function 0041B508 Relevance: 9.1, APIs: 6, Instructions: 113windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B57E
GetDC.USER32(?), ref: 0041B58A
GetDeviceCaps.GDI32(?,00000068), ref: 0041B5A6
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 0041B5C3
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 0041B5DA
ReleaseDC.USER32(?,?), ref: 0041B626

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: EntriesPaletteSystem$CapsDeviceFocusRelease
String ID:
API String ID: 2502006586-0
Opcode ID: e956e6ae92597662ed98b2f51c6b506043ab8b509e5ceb21f610fa5f8f95298e
Instruction ID: 1753bd22f5710d4f749a3cf2d8329d0f84e6490acb09e3fae29671003709e3a5
Opcode Fuzzy Hash: e956e6ae92597662ed98b2f51c6b506043ab8b509e5ceb21f610fa5f8f95298e
Instruction Fuzzy Hash: D0410631A04258AFDF10DFA9C885AAFBBB4EF59704F1484AAF500EB351D3389D51CBA5

Function 0045CF24 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 73COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000057,00000000,0045CFF0,?,?,?,?,00000000), ref: 0045CF8F
SetLastError.KERNEL32(00000000,00000002,?,?,?,0045D05C,?,00000000,0045CFF0,?,?,?,?,00000000), ref: 0045CFCE

Strings

CLASSES_ROOT, xrefs: 0045CF54
MACHINE, xrefs: 0045CF72
USERS, xrefs: 0045CF81
CURRENT_USER, xrefs: 0045CF63

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ErrorLast
String ID: CLASSES_ROOT$CURRENT_USER$MACHINE$USERS
API String ID: 1452528299-1580325520
Opcode ID: 4ef202734eb69f455ac95b516f6f86e02e7b7125310c898b2e6da52e821c2096
Instruction ID: 88e29fb2def42a8f1dba447adddccd7e0868d31b9061dd0ea12196a4fe5e9a7f
Opcode Fuzzy Hash: 4ef202734eb69f455ac95b516f6f86e02e7b7125310c898b2e6da52e821c2096
Instruction Fuzzy Hash: BE11D536604304BFDB21DB91C981B9AB6AEDB4471AF608077AD00A62C3D63C9F0BD52D

Function 0041BD8C Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0041BDD5
GetSystemMetrics.USER32(0000000C), ref: 0041BDDF
GetDC.USER32(00000000), ref: 0041BDE9
GetDeviceCaps.GDI32(00000000,0000000E), ref: 0041BE10
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0041BE1D
ReleaseDC.USER32(00000000,00000000), ref: 0041BE56

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CapsDeviceMetricsSystem$Release
String ID:
API String ID: 447804332-0
Opcode ID: 3bdc6123dd6674b0137b7fef1a93c0b96d54f33e4692062cf67464f69f8f60e7
Instruction ID: d5b995c8e3894394b735eabd433659eae54025482fea58e306a85006fdca5b97
Opcode Fuzzy Hash: 3bdc6123dd6674b0137b7fef1a93c0b96d54f33e4692062cf67464f69f8f60e7
Instruction Fuzzy Hash: E5212A74E04648AFEB00EFA9C941BEEB7B4EB48714F10846AF514B7690D7785940CB69

Function 0047E2A0 Relevance: 9.1, APIs: 6, Instructions: 57COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EC), ref: 0047E2AE
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC,?,0046CC21), ref: 0047E2D4
GetWindowLongA.USER32(?,000000EC), ref: 0047E2E4
SetWindowLongA.USER32(?,000000EC,00000000), ref: 0047E305
ShowWindow.USER32(?,00000005,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC), ref: 0047E319
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000057,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000), ref: 0047E335

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Window$Long$Show
String ID:
API String ID: 3609083571-0
Opcode ID: c0826670ad78713e181474d501df874fd0f745b2ec8bbce53d2eee60c18809f6
Instruction ID: 60d3dee66aadba5e252eefcbf840e4ecab1b58808db24c68cc1e2a9bf0f2e662
Opcode Fuzzy Hash: c0826670ad78713e181474d501df874fd0f745b2ec8bbce53d2eee60c18809f6
Instruction Fuzzy Hash: 7C0112B5641210ABE700D769DE41F6637DCAB1C324F0947A6BA55DF3E3C778E8408B49

Function 0041B270 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 0041A6E0: CreateBrushIndirect.GDI32 ref: 0041A74B

UnrealizeObject.GDI32(00000000), ref: 0041B27C
SelectObject.GDI32(?,00000000), ref: 0041B28E
SetBkColor.GDI32(?,00000000), ref: 0041B2B1
SetBkMode.GDI32(?,00000002), ref: 0041B2BC
SetBkColor.GDI32(?,00000000), ref: 0041B2D7
SetBkMode.GDI32(?,00000001), ref: 0041B2E2

Part of subcall function 0041A058: GetSysColor.USER32(?), ref: 0041A062

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Color$ModeObject$BrushCreateIndirectSelectUnrealize
String ID:
API String ID: 3527656728-0
Opcode ID: 90af7722afa79acc590a6ee3060039fb524340e2cf7ce152cccbdcb584e8dbde
Instruction ID: d03b18a2b949c207061bd18b8e5d47ed8ce294e6be165222704fda36eef26a4f
Opcode Fuzzy Hash: 90af7722afa79acc590a6ee3060039fb524340e2cf7ce152cccbdcb584e8dbde
Instruction Fuzzy Hash: 56F0CD756015009BDE00FFAAD9CBE4B3B989F043097048496B908DF187CA3CD8649B3A

Function 0049793C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC

ShowWindow.USER32(?,00000005,00000000,00497BA1,?,?,00000000), ref: 00497972

Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7

Part of subcall function 004072A8: SetCurrentDirectoryA.KERNEL32(00000000,?,0049799A,00000000,00497B6D,?,?,00000005,00000000,00497BA1,?,?,00000000), ref: 004072B3

Part of subcall function 0042D44C: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D4DA,?,?,?,00000001,?,0045607E,00000000,004560E6), ref: 0042D481

Strings

IMsg, xrefs: 00497A46
Uninstall, xrefs: 00497958
.dat, xrefs: 004979B9
.msg, xrefs: 004979D8

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: DirectoryWindow$CurrentFileModuleNameShowSystemText
String ID: .dat$.msg$IMsg$Uninstall
API String ID: 3312786188-1660910688
Opcode ID: b1a1a4bda46f742705bd28c9d29f731ae9e6b69b046183db0b8c254b1b2955ff
Instruction ID: 07af27bb9797314682f3501d6ac3c866b0c61c961df02ccbdaec41a0fce40d49
Opcode Fuzzy Hash: b1a1a4bda46f742705bd28c9d29f731ae9e6b69b046183db0b8c254b1b2955ff
Instruction Fuzzy Hash: 04313034A10214AFCB00EF65DC9295E7BB5FB89718F918576F410A7351D738BD058B58

Function 0042EAA8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonCreate), ref: 0042EADA
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EAE0
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,user32.dll,ShutdownBlockReasonCreate), ref: 0042EB09

Strings

user32.dll, xrefs: 0042EAD5
ShutdownBlockReasonCreate, xrefs: 0042EAD0

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressByteCharHandleModuleMultiProcWide
String ID: ShutdownBlockReasonCreate$user32.dll
API String ID: 828529508-2866557904
Opcode ID: abd48416efe8c38b471d8fa4e8d7df9e86f36f64705d4ddad357e346b5b094ef
Instruction ID: 7e091cf0cf0c4dae12ae48626bdfb721f4796128e550bb25d34418d77cfbcdd5
Opcode Fuzzy Hash: abd48416efe8c38b471d8fa4e8d7df9e86f36f64705d4ddad357e346b5b094ef
Instruction Fuzzy Hash: 70F0C8D034061136E620B57F5C82F7B598C8F94759F140436B109E62C2D96CA905426E

Function 0042E9AC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042EA70,00000004,00499934,004570C9,0045746C,00457020,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042E9C2
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E9C8
InterlockedExchange.KERNEL32(0049B660,00000001), ref: 0042E9D9

Strings

user32.dll, xrefs: 0042E9BD
ChangeWindowMessageFilter, xrefs: 0042E9B8

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressExchangeHandleInterlockedModuleProc
String ID: ChangeWindowMessageFilter$user32.dll
API String ID: 3478007392-2498399450
Opcode ID: 3254194633b527647525dea76c004eb0f33bc99a9c522dc813bf1be520244ffe
Instruction ID: c922fa4e85abb1c6873f36dcd01b6443d81c66d6c3501223796626af46e79b09
Opcode Fuzzy Hash: 3254194633b527647525dea76c004eb0f33bc99a9c522dc813bf1be520244ffe
Instruction Fuzzy Hash: 5CE0ECB2740324EADA103B627E8AF663558E724B19F50043BF001751F1C7FD1C80CA9E

Function 0047771C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderthreadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(00000000), ref: 00477724
GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,0047781B,0049C0A4,00000000), ref: 00477737
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0047773D

Strings

AllowSetForegroundWindow, xrefs: 0047772D
user32.dll, xrefs: 00477732

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressHandleModuleProcProcessThreadWindow
String ID: AllowSetForegroundWindow$user32.dll
API String ID: 1782028327-3855017861
Opcode ID: 9cbf605bf7fb62c6fa6eed3a813332d63d01b072d47f223b934acc6204d32a91
Instruction ID: b8998b5b11308705bea9eb0f8ec6baab65f192f364a037d5a2b195a8f22c602c
Opcode Fuzzy Hash: 9cbf605bf7fb62c6fa6eed3a813332d63d01b072d47f223b934acc6204d32a91
Instruction Fuzzy Hash: 3ED0C7A0648701A9D91473F54D86F6F325C9944758794C43B7404F218ADA7CFC009A7D

Function 00416C2C Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

BeginPaint.USER32(00000000,?), ref: 00416C52
SaveDC.GDI32(?), ref: 00416C83
ExcludeClipRect.GDI32(?,?,?,?,?,?,00000000,00416D45), ref: 00416CE4
RestoreDC.GDI32(?,?), ref: 00416D0B
EndPaint.USER32(00000000,?,00416D4C,00000000,00416D45), ref: 00416D3F

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Paint$BeginClipExcludeRectRestoreSave
String ID:
API String ID: 3808407030-0
Opcode ID: ad781fe6fb59047a66b80eb53a3f65b2019eba16d1c733f202b60e39d660354f
Instruction ID: 8164e3b37c2b38cc39b91ef4074089abf19b8963c3e0e5cbd12a4ce3d65b1abe
Opcode Fuzzy Hash: ad781fe6fb59047a66b80eb53a3f65b2019eba16d1c733f202b60e39d660354f
Instruction Fuzzy Hash: A1415070A002049FCB14DBA9C585FAA77F9FF48304F1540AEE8459B362D778DD81CB58

Function 00414800 Relevance: 7.6, APIs: 5, Instructions: 102COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,?), ref: 00414836
MulDiv.KERNEL32(?,?,?), ref: 00414850
MulDiv.KERNEL32(?,?,?), ref: 00414879
MulDiv.KERNEL32(?,?,?), ref: 004148A4
MulDiv.KERNEL32(00000000,?,00000000), ref: 004148EC

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6913cb722474124f75cff2ee5949f067bbdde1b56a592e148b6496e85af3d5a
Instruction ID: a833d86c80f2fb81cba799e3b93fc1891ddf3ebdd98a67124a25423b7ab76754
Opcode Fuzzy Hash: b6913cb722474124f75cff2ee5949f067bbdde1b56a592e148b6496e85af3d5a
Instruction Fuzzy Hash: 563132746057809FC320EF69C984B9BB7E8AF89354F04491EF9D5C3752C638E8818F19

Function 004297CC Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 00429808
SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 00429837
SendMessageA.USER32(00000000,000000C1,00000000,00000000), ref: 00429853
SendMessageA.USER32(00000000,000000B1,00000000,00000000), ref: 0042987E
SendMessageA.USER32(00000000,000000C2,00000000,00000000), ref: 0042989C

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: fd8aa0ec1b973ae6aaefd16540d6ee8dc1d02e84f7fa614f966329f354bb3efc
Instruction ID: 8b65b0e689063cc909dba6714575951256d1ad54ff8cece17fd29570ea6901c2
Opcode Fuzzy Hash: fd8aa0ec1b973ae6aaefd16540d6ee8dc1d02e84f7fa614f966329f354bb3efc
Instruction Fuzzy Hash: 6E219D707107057BEB10AB62DC82F5B7AECAB41708F54443EB501AB2D2DFB8AE418228

Function 0041BBB8 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0041BBCA
GetSystemMetrics.USER32(0000000C), ref: 0041BBD4
GetDC.USER32(00000000), ref: 0041BC12
CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041BC59
DeleteObject.GDI32(00000000), ref: 0041BC9A

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: MetricsSystem$BitmapCreateDeleteObject
String ID:
API String ID: 1095203571-0
Opcode ID: d6ecec59309c4539c21f746b1d4641e0a999657a412e1d938322a226e3514674
Instruction ID: 2a907a32995036c4e239f44386a828d3a2f1e7d44945ead90e55d18394f4d4ff
Opcode Fuzzy Hash: d6ecec59309c4539c21f746b1d4641e0a999657a412e1d938322a226e3514674
Instruction Fuzzy Hash: 5D315C70E00208EFDB04DFA5C941AAEB7F5EB48700F2084AAF514AB781D7789E40DB98

Function 004734B4 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 0045CF24: SetLastError.KERNEL32(00000057,00000000,0045CFF0,?,?,?,?,00000000), ref: 0045CF8F

GetLastError.KERNEL32(00000000,00000000,00000000,00473588,?,?,0049C1DC,00000000), ref: 00473541
GetLastError.KERNEL32(00000000,00000000,00000000,00473588,?,?,0049C1DC,00000000), ref: 00473557

Strings

Could not set permissions on the registry key because it currently does not exist., xrefs: 0047354B
Failed to set permissions on registry key (%d)., xrefs: 00473568
Setting permissions on registry key: %s\%s, xrefs: 00473506

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ErrorLast
String ID: Could not set permissions on the registry key because it currently does not exist.$Failed to set permissions on registry key (%d).$Setting permissions on registry key: %s\%s
API String ID: 1452528299-4018462623
Opcode ID: cda487bc8e154a0ad9ae216a04a88865d7cb43f012aef9407592f0032e7bcf89
Instruction ID: 2212a5860512eb316d0a76154e76f7c63462165614e358f3f9a9decbb378d4da
Opcode Fuzzy Hash: cda487bc8e154a0ad9ae216a04a88865d7cb43f012aef9407592f0032e7bcf89
Instruction Fuzzy Hash: DF217470A042446FCB00DFAAC4816EEBBE9DB49315F50817AE408E7392D7785A058B6D

Function 00403CA4 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403CFC
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 00403D06
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403D15

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: dcd45591e65b03bd276bb2a5b0fabad56ebf76f0c081827c2345b0a7b763a240
Instruction ID: 657f84db466bd1c54801a2b30447fc2084338491f8142acf58a262d5883cef98
Opcode Fuzzy Hash: dcd45591e65b03bd276bb2a5b0fabad56ebf76f0c081827c2345b0a7b763a240
Instruction Fuzzy Hash: FCF0A4917442043BF21025A65C43F6B198CCB82B9BF50053FB704FA1D2D87C9D04427D

Function 004143E0 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON

Download Yara Rule

APIs

SelectPalette.GDI32(00000000,00000000,00000000), ref: 00414419
RealizePalette.GDI32(00000000), ref: 00414421
SelectPalette.GDI32(00000000,00000000,00000001), ref: 00414435
RealizePalette.GDI32(00000000), ref: 0041443B
ReleaseDC.USER32(00000000,00000000), ref: 00414446

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Palette$RealizeSelect$Release
String ID:
API String ID: 2261976640-0
Opcode ID: c9c8aa66f6917016d7555c0ac5b3df2d15848593dde74026b2272496f15e705b
Instruction ID: 3cc421e061c7a323c9855e33cbe13bf4890882f9e8533d15179bd5f7679f66d2
Opcode Fuzzy Hash: c9c8aa66f6917016d7555c0ac5b3df2d15848593dde74026b2272496f15e705b
Instruction Fuzzy Hash: A2018F7520C3806AE600A63D8C85A9F6BED9FCA718F15446EF495DB282DA7AC8018765

Function 00424CE0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 0041F074: GetActiveWindow.USER32 ref: 0041F077
Part of subcall function 0041F074: GetCurrentThreadId.KERNEL32 ref: 0041F08C
Part of subcall function 0041F074: EnumThreadWindows.USER32(00000000,Function_0001F050), ref: 0041F092

Part of subcall function 004231A8: GetSystemMetrics.USER32(00000000), ref: 004231AA

OffsetRect.USER32(?,?,?), ref: 00424DC9
DrawTextA.USER32(00000000,00000000,000000FF,?,00000C10), ref: 00424E8C
OffsetRect.USER32(?,?,?), ref: 00424E9D

Part of subcall function 00423564: GetCurrentThreadId.KERNEL32 ref: 00423579
Part of subcall function 00423564: SetWindowsHookExA.USER32(00000003,00423520,00000000,00000000), ref: 00423589
Part of subcall function 00423564: CreateThread.KERNEL32(00000000,000003E8,004234D0,00000000,00000000), ref: 004235AD

Part of subcall function 00424B2C: SetTimer.USER32(00000000,00000001,?,004234B4), ref: 00424B47

Strings

vLB, xrefs: 00424CF3, 00424DD1

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Thread$CurrentOffsetRectWindows$ActiveCreateDrawEnumHookMetricsSystemTextTimerWindow
String ID: vLB
API String ID: 1477829881-1797516613
Opcode ID: 2df939a64c7159e98cf11afb118bbc7b4d896149ced45f0655bbb58e5441d69a
Instruction ID: 1a85cd152e58b5c2614c87f396891e2b5808bef0cf689969089b0637ec596c27
Opcode Fuzzy Hash: 2df939a64c7159e98cf11afb118bbc7b4d896149ced45f0655bbb58e5441d69a
Instruction Fuzzy Hash: C5812675A003188FCB14DFA8D880ADEBBF4FF88314F50416AE905AB296E738AD45CF44

Function 00406FA4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 156shareCOMMON

Download Yara Rule

APIs

WNetGetUniversalNameA.MPR(00000000,00000001,?,00000400), ref: 00407003
WNetOpenEnumA.MPR(00000001,00000001,00000000,00000000,?), ref: 0040707D
WNetEnumResourceA.MPR(?,FFFFFFFF,?,?), ref: 004070D5

Strings

Z, xrefs: 0040703C

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Enum$NameOpenResourceUniversal
String ID: Z
API String ID: 3604996873-1505515367
Opcode ID: be1b99f2bddbcac53fb01ab14e5f8b9dccc9852fe0acc0d184f115cb4eb08e63
Instruction ID: 78f4b6eea80f90a9c0d6dbacb1000d6f5057f9b0a0312f2c839bfa0eabc808a5
Opcode Fuzzy Hash: be1b99f2bddbcac53fb01ab14e5f8b9dccc9852fe0acc0d184f115cb4eb08e63
Instruction Fuzzy Hash: 14516470E04208AFDB11DF95C951AAFBBB9EF09304F1045BAE500BB3D1D778AE458B5A

Function 0044CFC0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 0044D04E
DrawTextA.USER32(00000000,00000000,00000000,?,00000D20), ref: 0044D079
DrawTextA.USER32(00000000,00000000,00000000,00000000,00000800), ref: 0044D101

Strings

, xrefs: 0044D033

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: DrawText$EmptyRect
String ID:
API String ID: 182455014-2867612384
Opcode ID: 5a0539bf68205d97078423fcc454010b69767de64c7ecc47099b95a490b229f7
Instruction ID: ac611c4ae9e9b4e435f74cd3b872a097dcdbbef8ea8fa2dc8c743a2ef399c877
Opcode Fuzzy Hash: 5a0539bf68205d97078423fcc454010b69767de64c7ecc47099b95a490b229f7
Instruction Fuzzy Hash: 18517171E00248AFDB11DFA5C885BDEBBF8BF48308F18447AE845EB252D7789945CB64

Function 0042EF74 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0042EF9E

Part of subcall function 0041A1E8: CreateFontIndirectA.GDI32(?), ref: 0041A2A7

SelectObject.GDI32(?,00000000), ref: 0042EFC1
ReleaseDC.USER32(00000000,?), ref: 0042F0A0

Strings

...\, xrefs: 0042F052

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CreateFontIndirectObjectReleaseSelect
String ID: ...\
API String ID: 3133960002-983595016
Opcode ID: 70ac47cd1f24a616d7e2b727f260b13144e8c57b91404e99c31ef123f2268bbd
Instruction ID: de545d42c11d103cbad381cc3223c2b5efa9fdb4a6e9ae4bb0445229962d8c70
Opcode Fuzzy Hash: 70ac47cd1f24a616d7e2b727f260b13144e8c57b91404e99c31ef123f2268bbd
Instruction Fuzzy Hash: 5A316370B00128AFDB11EB96D841BAEB7F8EB09348F90447BE410A7392D7785E49CA59

Function 004538BC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,004969FD,_iu,?,00000000,004539F6), ref: 004539AB
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,004969FD,_iu,?,00000000,004539F6), ref: 004539BB

Strings

_iu, xrefs: 0045394D
.tmp, xrefs: 0045395F

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: .tmp$_iu
API String ID: 3498533004-10593223
Opcode ID: a2d893cb34534329417986e6c0829fc9ea942bfffc95fd4fb28473f4c8c7566b
Instruction ID: c819285d1904897ee35e15112b57b1097950df4cd651dd5525fdc5768647a91e
Opcode Fuzzy Hash: a2d893cb34534329417986e6c0829fc9ea942bfffc95fd4fb28473f4c8c7566b
Instruction Fuzzy Hash: 6531C5B0A00249ABCB11EFA5D842B9EBBB4AF44345F20453AF810B73C2D7785F058B69

Function 00416410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,?,?), ref: 0041647F
UnregisterClassA.USER32(?,00400000), ref: 004164AB
RegisterClassA.USER32(?), ref: 004164CE

Strings

@, xrefs: 00416429

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Class$InfoRegisterUnregister
String ID: @
API String ID: 3749476976-2766056989
Opcode ID: 5b42dbe956ccb297a4347149b64d01d8291e8cf711d902875b0d5c2af7b22291
Instruction ID: c77080f262680b7bd3c4c6a37e0a11d074b1995aa9dd52ebf92fb76dd285a693
Opcode Fuzzy Hash: 5b42dbe956ccb297a4347149b64d01d8291e8cf711d902875b0d5c2af7b22291
Instruction Fuzzy Hash: B8316D702042409BD720EF69C981B9B77E5AB89308F04457FF949DB392DB39DD44CB6A

Function 00497DF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00498740,00000000,00497EE6,?,?,00000000,0049B628), ref: 00497E60
SetFileAttributesA.KERNEL32(00000000,00000000,00000000,00498740,00000000,00497EE6,?,?,00000000,0049B628), ref: 00497E89
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 00497EA2

Strings

isRS-%.3u.tmp, xrefs: 00497E3F

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: File$Attributes$Move
String ID: isRS-%.3u.tmp
API String ID: 3839737484-3657609586
Opcode ID: 3cfb3d6793791d97cf74a4285948bf1fe76c54a9dc4c52927cfc271f3ab244fc
Instruction ID: adb9c33aafbf080cac665bc5299f23723db0aa29d84535d7a5ab6b838e12ed56
Opcode Fuzzy Hash: 3cfb3d6793791d97cf74a4285948bf1fe76c54a9dc4c52927cfc271f3ab244fc
Instruction Fuzzy Hash: 97214171E14219AFCF10EFA9C881AAFBBB8EF48314F50457BB414B72D1D6389E018B59

Function 00456AD4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042C804: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C828

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9

LoadTypeLib.OLEAUT32(00000000,00000000), ref: 00456B28
RegisterTypeLib.OLEAUT32(00000000,00000000,00000000), ref: 00456B55

Strings

LoadTypeLib, xrefs: 00456B33
RegisterTypeLib, xrefs: 00456B60

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Type$AllocByteCharFullLoadMultiNamePathRegisterStringWide
String ID: LoadTypeLib$RegisterTypeLib
API String ID: 1312246647-2435364021
Opcode ID: eeeb73eb9e9504d9a603f7ad8e3db9460b595fe7816c0dbb2ccb17ac3d1093e1
Instruction ID: 47a1d4ca4f4f91c66d019980732f736a11ff2a8de3fe636bef365ffac313579d
Opcode Fuzzy Hash: eeeb73eb9e9504d9a603f7ad8e3db9460b595fe7816c0dbb2ccb17ac3d1093e1
Instruction Fuzzy Hash: E4118470B00614AFDB01EFA6CD51E5EB7ADEB89705F5184B6BC04D3652DA38AE04CA14

Function 0045702C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000B06,00000000,00000000), ref: 00457046
SendMessageA.USER32(00000000,00000B00,00000000,00000000), ref: 004570E3

Strings

Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x), xrefs: 00457072
Failed to create DebugClientWnd, xrefs: 004570AC

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: MessageSend
String ID: Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x)$Failed to create DebugClientWnd
API String ID: 3850602802-3720027226
Opcode ID: 8e8f673caedfc7feff7eb7bdb190f376ea76f8ae9785284cd58aa93e224da2ea
Instruction ID: 04aa4b2c7eb1c454b5cba22971c1bbc1ea6d27c9adf2600e91ea5852dc491812
Opcode Fuzzy Hash: 8e8f673caedfc7feff7eb7bdb190f376ea76f8ae9785284cd58aa93e224da2ea
Instruction Fuzzy Hash: 7B11C4706082405BD310AB689C86B5F7BD89B55719F04403AFA849B3C3D7794818C7AA

Function 00478274 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC

GetFocus.USER32 ref: 004782DF
GetKeyState.USER32(0000007A), ref: 004782F1
WaitMessage.USER32(?,00000000,00478318,?,00000000,0047833F,?,?,00000001,00000000,?,?,?,0047FF4A,00000000,00480E10), ref: 004782FB

Strings

Wnd=$%x, xrefs: 004782C3

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: FocusMessageStateTextWaitWindow
String ID: Wnd=$%x
API String ID: 1381870634-2927251529
Opcode ID: df58875bdccc8777564035cf34c4fc2cc577789563157b56a5e7999ca7c4e77b
Instruction ID: 4fb3cd641778419160d589020729a47525b6cf65933b1fda4e748d396c294bb6
Opcode Fuzzy Hash: df58875bdccc8777564035cf34c4fc2cc577789563157b56a5e7999ca7c4e77b
Instruction Fuzzy Hash: AC11E730A44644AFCB01EF69CC4699E77F8EB48B04B5184BEF808E7681CB396900CA69

Function 0046E4E8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46timeCOMMON

Download Yara Rule

APIs

FileTimeToLocalFileTime.KERNEL32(?), ref: 0046E4F0
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 0046E4FF

Strings

%.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u, xrefs: 0046E574
(invalid), xrefs: 0046E582

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Time$File$LocalSystem
String ID: %.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u$(invalid)
API String ID: 1748579591-1013271723
Opcode ID: 3b65440f4752fc442d4002421b0f6f5f27c9f0dfaf9e9fe9353c18bfa240ec72
Instruction ID: 59800965179ea38ef94c82185105b35681c727fa36521559545391a6b8d853c9
Opcode Fuzzy Hash: 3b65440f4752fc442d4002421b0f6f5f27c9f0dfaf9e9fe9353c18bfa240ec72
Instruction Fuzzy Hash: 2211F8A440C3909AD340DF6AC44432BBAE4AB89708F44496EF9C8D6381F779C948DB67

Function 00453F76 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(00000000,00000020), ref: 00453F83

Part of subcall function 00406F50: DeleteFileA.KERNEL32(00000000,0049B628,004982D1,00000000,00498326,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F5B

MoveFileA.KERNEL32(00000000,00000000), ref: 00453FA8

Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,00497F85,00000000), ref: 0045349F

Strings

MoveFile, xrefs: 00453FB1
DeleteFile, xrefs: 00453F94

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: File$AttributesDeleteErrorLastMove
String ID: DeleteFile$MoveFile
API String ID: 3024442154-139070271
Opcode ID: c1e186276644241f0c7331fda0e10dfc1a351e9ccd8aa74ec051a1bdf32146c9
Instruction ID: b5871bee3d194af1fa843ac656f6d820fc0ba16d57580c91db5694710367c43f
Opcode Fuzzy Hash: c1e186276644241f0c7331fda0e10dfc1a351e9ccd8aa74ec051a1bdf32146c9
Instruction Fuzzy Hash: AEF062716142045BD701FBA2D84266EA7ECDB8435EF60443BB900BB6C3DA3C9E094529

Function 0045923C Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,37H,?,00000001,?,?,00483733,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,00459379,00000000,00459531,?,00000000,00000000,00000000), ref: 00459289

Strings

.NET Framework not found, xrefs: 00459298
SOFTWARE\Microsoft\.NETFramework, xrefs: 0045925C
InstallRoot, xrefs: 00459278

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CloseOpen
String ID: .NET Framework not found$InstallRoot$SOFTWARE\Microsoft\.NETFramework
API String ID: 47109696-2631785700
Opcode ID: 75219cf9845bb2cf9b324263233030eee3a43bc23f5af8ce4b2695e1a657a985
Instruction ID: b8cf81f510f5016daab1000a250b557ec77191f8025d1475bfe98ce45a5795d7
Opcode Fuzzy Hash: 75219cf9845bb2cf9b324263233030eee3a43bc23f5af8ce4b2695e1a657a985
Instruction Fuzzy Hash: A6F0AF31300110EBC710EB9AD885B5E7298DB95356F50453BF984CB263C67CCC468B6D

Function 00483714 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,37H,?,00000001,?,?,00483733,?,00000001,00000000), ref: 0042DE38

RegQueryValueExA.ADVAPI32(?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 00483755
RegCloseKey.ADVAPI32(?,?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 00483778

Strings

System\CurrentControlSet\Control\Windows, xrefs: 00483722
CSDVersion, xrefs: 0048374C

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: CSDVersion$System\CurrentControlSet\Control\Windows
API String ID: 3677997916-1910633163
Opcode ID: a43054236d00ebe64f13c76161d678db23357086e471883f50eee9bec3e1ddf0
Instruction ID: 473048f5e98eb31a87ee19f4d6f0e18d0c02793fb4f6cf55b6386f241b3b3c83
Opcode Fuzzy Hash: a43054236d00ebe64f13c76161d678db23357086e471883f50eee9bec3e1ddf0
Instruction Fuzzy Hash: 2CF036F5A40208A6DF10EAD58C45BDFB3BC9B04705F108567E510E7280E778DB048B59

Function 0042D8F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,00453B5A,00000000,00453BFD,?,?,00000000,00000000,00000000,00000000,00000000,?,00453FED,00000000), ref: 0042D90A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042D910

Strings

GetSystemWow64DirectoryA, xrefs: 0042D900
kernel32.dll, xrefs: 0042D905

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemWow64DirectoryA$kernel32.dll
API String ID: 1646373207-4063490227
Opcode ID: c1d4cb9903a355352fec54d7d7fc42ff69d50386832f09f5f28b98c1c912cee1
Instruction ID: 657275fb9dfacbe144619f02b172540cf2f0c5a6f4252bec6bd03a25d2dd35a2
Opcode Fuzzy Hash: c1d4cb9903a355352fec54d7d7fc42ff69d50386832f09f5f28b98c1c912cee1
Instruction Fuzzy Hash: A5E0DFE0B40B0122D70032BA1C82B6B108D4B84728F90053B3894E62D6DDBCD9840A6D

Function 0042EB54 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonDestroy,?,00000000,0042EAD0), ref: 0042EB62
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EB68

Strings

ShutdownBlockReasonDestroy, xrefs: 0042EB58
user32.dll, xrefs: 0042EB5D

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ShutdownBlockReasonDestroy$user32.dll
API String ID: 1646373207-260599015
Opcode ID: 88ce12e330a2fc51ece58c284b54de3a76b504cb94a4c995bd1a3fb2c6ea0693
Instruction ID: e1ec077e445c8734ae54db5ffdd633522f5c412f0b7fee52e54de0d29bb4c321
Opcode Fuzzy Hash: 88ce12e330a2fc51ece58c284b54de3a76b504cb94a4c995bd1a3fb2c6ea0693
Instruction Fuzzy Hash: A2D0C793311732665D10B1F73CD1EAB058C891527935404B7F515E5641D55DEC1115AD

Function 0044F744 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,004987D2), ref: 0044F77F
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044F785

Strings

NotifyWinEvent, xrefs: 0044F775
user32.dll, xrefs: 0044F77A

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NotifyWinEvent$user32.dll
API String ID: 1646373207-597752486
Opcode ID: f97c3de5cacafbf63d36e16939e29d51eb7e912e87a0fb2b79f6fc39cd446e20
Instruction ID: 5e946f17392c81a4f172a46fe169fb9a1f72c9003761a5edf28bd31acc2f1150
Opcode Fuzzy Hash: f97c3de5cacafbf63d36e16939e29d51eb7e912e87a0fb2b79f6fc39cd446e20
Instruction Fuzzy Hash: 59E012F0E417049AFF00BBB57B86B1A3A90E764719B00057FF414A6292DB7C481C4F9D

Function 00498548 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,00498828,00000001,00000000,0049884C), ref: 00498552
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00498558

Strings

user32.dll, xrefs: 0049854D
DisableProcessWindowsGhosting, xrefs: 00498548

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: DisableProcessWindowsGhosting$user32.dll
API String ID: 1646373207-834958232
Opcode ID: db518bae8a1cf5760848bd95fc6cdfcd790772d70ebb0fe4026802486380d2e4
Instruction ID: a30757b807d51f5124d599aa2c3f03a0cb1e1ebc6983b00e9b0dd3032a1cc0b0
Opcode Fuzzy Hash: db518bae8a1cf5760848bd95fc6cdfcd790772d70ebb0fe4026802486380d2e4
Instruction Fuzzy Hash: 74B002C06417067CDD5072FA0D46B5B484848527BD716047F3814E51C6DD6C8D19593D

Function 004644CC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 8libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044B658: LoadLibraryA.KERNEL32(uxtheme.dll,?,0044F775,004987D2), ref: 0044B67F
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044B697
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044B6A9
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044B6BB
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044B6CD
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6DF
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6F1
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044B703
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044B715
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044B727
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044B739
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044B74B
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044B75D
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044B76F
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044B781
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044B793
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044B7A5
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044B7B7

LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,004987FA), ref: 004644DB
GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 004644E1

Strings

shell32.dll, xrefs: 004644D6
SHPathPrepareForWriteA, xrefs: 004644D1

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 2238633743-2683653824
Opcode ID: c01632fc0f5b33953d3d614069ff975302c210d2ed533638465c2bab93595346
Instruction ID: d75953ebaa51f3cdf10b42b062242e5a2adabc3e146697bf4f9864d78fb0a240
Opcode Fuzzy Hash: c01632fc0f5b33953d3d614069ff975302c210d2ed533638465c2bab93595346
Instruction Fuzzy Hash: B8B092D4681741AAC9007BB2185BA0F6E4894A0B19750463B310971083EF7C44204A5E

Function 0047D1D0 Relevance: 6.2, APIs: 4, Instructions: 195fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,0047D344,?,?,?,?,00000000,0047D499,?,?,?,00000000,?,0047D5A8), ref: 0047D320
FindClose.KERNEL32(000000FF,0047D34B,0047D344,?,?,?,?,00000000,0047D499,?,?,?,00000000,?,0047D5A8,00000000), ref: 0047D33E

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: b5f0d664076e7aa74699ab92f955e394473f8998aa43bac9dc352ff6593dcf8a
Instruction ID: 0ecb69b5ed511d6fc0c0aa51fe2fcddc3f4b96abf7b679f4d8a8bcc6758ee249
Opcode Fuzzy Hash: b5f0d664076e7aa74699ab92f955e394473f8998aa43bac9dc352ff6593dcf8a
Instruction Fuzzy Hash: 65812B70D0424D9FCF11DF95CC41ADEBBB9EF49304F5080AAE808A7291D639AA46CF59

Function 00475488 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 114COMMON

Download Yara Rule

APIs

Part of subcall function 0042EE30: GetTickCount.KERNEL32 ref: 0042EE36

Part of subcall function 0042EC88: MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 0042ECBD

GetLastError.KERNEL32(00000000,004755FD,?,?,0049C1DC,00000000), ref: 004754E6

Strings

MoveFileEx, xrefs: 0047554B
, xrefs: 0047551E, 00475539
LoggedMsgBox returned an unexpected value. Assuming Cancel., xrefs: 004755BB

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CountErrorFileLastMoveTick
String ID: $LoggedMsgBox returned an unexpected value. Assuming Cancel.$MoveFileEx
API String ID: 2406187244-2685451598
Opcode ID: da84384ebc6fe045fbdefd9db643ba981601fc1c42c9890ab0328962f6cf6e5c
Instruction ID: 70c19203dce3efc737256e844b71bd63d15af5515763618ac70b615c3304bc0c
Opcode Fuzzy Hash: da84384ebc6fe045fbdefd9db643ba981601fc1c42c9890ab0328962f6cf6e5c
Instruction Fuzzy Hash: 3541B370E006099BCB10EFA5D882AEE77B5EF48315F508537E408BF395D7789A05CBA9

Function 00413CF8 Relevance: 6.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00413D46
GetDesktopWindow.USER32 ref: 00413DFE

Part of subcall function 00418EC0: 6F58C6F0.COMCTL32(?,00000000,00413FC3,00000000,004140D3,?,?,0049B628), ref: 00418EDC
Part of subcall function 00418EC0: ShowCursor.USER32(00000001,?,00000000,00413FC3,00000000,004140D3,?,?,0049B628), ref: 00418EF9

SetCursor.USER32(00000000,?,?,?,?,00413AF3,00000000,00413B06), ref: 00413E3C

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CursorDesktopWindow$Show
String ID:
API String ID: 2074268717-0
Opcode ID: 48e3412c1a46991eea637d4b1b247886da5b7466a2ee9d80c19fa9edf3c8b710
Instruction ID: d0219f8535474b9b7e790bb207accfb6dce16a9ac66decbe361331da1304c66b
Opcode Fuzzy Hash: 48e3412c1a46991eea637d4b1b247886da5b7466a2ee9d80c19fa9edf3c8b710
Instruction Fuzzy Hash: 91412C75600210AFC710DF2AFA84B56B7E1EB65329B16817BE405CB365DB38DD81CF98

Function 00408A54 Relevance: 6.1, APIs: 4, Instructions: 95windowCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00400000,?,00000100), ref: 00408A75
LoadStringA.USER32(00400000,0000FF9E,?,00000040), ref: 00408AE4
LoadStringA.USER32(00400000,0000FF9F,?,00000040), ref: 00408B7F
MessageBoxA.USER32(00000000,?,?,00002010), ref: 00408BBE

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: LoadString$FileMessageModuleName
String ID:
API String ID: 704749118-0
Opcode ID: ede814ba8b2c905ab74f80468cae56b5ab65d73ed59c96bbcc76a4520df8398d
Instruction ID: 7d65b0a5aa49ad722f3f3263bbe29e3330acee4661d9e2153cfe083702b22da2
Opcode Fuzzy Hash: ede814ba8b2c905ab74f80468cae56b5ab65d73ed59c96bbcc76a4520df8398d
Instruction Fuzzy Hash: 1F3123716083849AD370EB65C945BDF77D89B85704F40483FB6C8E72D1EB7859048B6B

Function 0044E8C4 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000001A1,?,00000000), ref: 0044E90D

Part of subcall function 0044CF50: SendMessageA.USER32(00000000,000001A0,?,00000000), ref: 0044CF82

InvalidateRect.USER32(00000000,00000000,00000001,00000000,000001A1,?,00000000), ref: 0044E991

Part of subcall function 0042BBB4: SendMessageA.USER32(00000000,0000018E,00000000,00000000), ref: 0042BBC8

IsRectEmpty.USER32(?), ref: 0044E953
ScrollWindowEx.USER32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000006), ref: 0044E976

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: MessageSend$Rect$EmptyInvalidateScrollWindow
String ID:
API String ID: 855768636-0
Opcode ID: 10250a0395981283fcc4a80b9eeb98fbc28641a3a135837a5077055f07d53bc9
Instruction ID: f7bad605b8f68185b4e834990bb8ca2287257270a928060092b59a923d315d7c
Opcode Fuzzy Hash: 10250a0395981283fcc4a80b9eeb98fbc28641a3a135837a5077055f07d53bc9
Instruction Fuzzy Hash: E5114A71B0030067E650BA7B8C86B5B76C9AB88748F15083FB545EB387DE7DDD094299

Function 00495500 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,?,00000000), ref: 00495564
OffsetRect.USER32(?,00000000,?), ref: 0049557F
OffsetRect.USER32(?,?,00000000), ref: 00495599
OffsetRect.USER32(?,00000000,?), ref: 004955B4

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: OffsetRect
String ID:
API String ID: 177026234-0
Opcode ID: 9137781dfa6337e8ef3f3b3b287e2de4796ba48f716e12dd1c164c0340d14a45
Instruction ID: 8a93a1a85cbb2b193f638f7d5e23572cc2bb20d35705657c91cc813c58603f6c
Opcode Fuzzy Hash: 9137781dfa6337e8ef3f3b3b287e2de4796ba48f716e12dd1c164c0340d14a45
Instruction Fuzzy Hash: 4821B0B6700701AFCB00DE69CD85E6BB7EAEFC4350F258A2AF544C728AD638ED048751

Function 00417218 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00417260
SetCursor.USER32(00000000), ref: 004172A3
GetLastActivePopup.USER32(?), ref: 004172CD
GetForegroundWindow.USER32(?), ref: 004172D4

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Cursor$ActiveForegroundLastPopupWindow
String ID:
API String ID: 1959210111-0
Opcode ID: fc3dc682e35aefc43ebed10bef0119cbd363a2e2ef148f8fcda91412316ed339
Instruction ID: de3f0dc6b436800086b9427ec8ddd2ec86eeedce3a35093462374e80c8eda50e
Opcode Fuzzy Hash: fc3dc682e35aefc43ebed10bef0119cbd363a2e2ef148f8fcda91412316ed339
Instruction Fuzzy Hash: C52183313086118AD720AFA9E945AE733F1EF44754B0544ABF8558B352DB3DDC82CB9E

Function 004951B8 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(8B500000,00000008,?), ref: 004951CD
MulDiv.KERNEL32(50142444,00000008,?), ref: 004951E1
MulDiv.KERNEL32(F7035BE8,00000008,?), ref: 004951F5
MulDiv.KERNEL32(8BF88BFF,00000008,?), ref: 00495213

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0bc83cb44cddb6cfb83e9cff79c84a8c4632dee95d4fc6912c32f85648e17c5
Instruction ID: a792722bc063b548a051c88181bbb06e8db95fe2d05683568d4c98e59dc11981
Opcode Fuzzy Hash: b0bc83cb44cddb6cfb83e9cff79c84a8c4632dee95d4fc6912c32f85648e17c5
Instruction Fuzzy Hash: 95112E72605504ABCB40DFE9C8C4D9B7BECEF8D324B2441AAF908DB242D634ED408F68

Function 0041F480 Relevance: 6.1, APIs: 4, Instructions: 56registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,0041F470,?), ref: 0041F4A1
UnregisterClassA.USER32(0041F470,00400000), ref: 0041F4CA
RegisterClassA.USER32(00499598), ref: 0041F4D4
SetWindowLongA.USER32(00000000,000000FC,00000000), ref: 0041F50F

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Class$InfoLongRegisterUnregisterWindow
String ID:
API String ID: 4025006896-0
Opcode ID: 2789f09181fedf2aa8f29be774d1bfe7920984f559ea6f8e8637ed1726722249
Instruction ID: 7a0dc659497f48f9aad4428a0df7724adcaf244520b53866b591a9b3b5545ee4
Opcode Fuzzy Hash: 2789f09181fedf2aa8f29be774d1bfe7920984f559ea6f8e8637ed1726722249
Instruction Fuzzy Hash: F6011B72240104AADA10EBACED81E9B33999729314B11423BB615E72A2D6399C558BAC

Function 0040D010 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00400000,?,00000000), ref: 0040D027
LoadResource.KERNEL32(00400000,72756F73,0040A7C8,00400000,00000001,00000000,?,0040CF84,00000000,?,00000000,?,?,0047C6AC,0000000A,00000000), ref: 0040D041
SizeofResource.KERNEL32(00400000,72756F73,00400000,72756F73,0040A7C8,00400000,00000001,00000000,?,0040CF84,00000000,?,00000000,?,?,0047C6AC), ref: 0040D05B
LockResource.KERNEL32(74536563,00000000,00400000,72756F73,00400000,72756F73,0040A7C8,00400000,00000001,00000000,?,0040CF84,00000000,?,00000000,?), ref: 0040D065

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: f701ce4f04cb0ebdd1143b5585c75acb70ffd029a82b31343d3be87257736b7b
Instruction ID: ce77ce8360aa458f47a01e9b0563465317cd85cc21d7bcd45488e041df035c61
Opcode Fuzzy Hash: f701ce4f04cb0ebdd1143b5585c75acb70ffd029a82b31343d3be87257736b7b
Instruction Fuzzy Hash: 49F04F726056046F9B14EE59A881D5B77ECDE88268310013AF908E7286DA38DD018B68

Function 0047047C Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000), ref: 004704CD

Strings

Unsetting NTFS compression on file: %s, xrefs: 004704B3
Setting NTFS compression on file: %s, xrefs: 0047049B
Failed to set NTFS compression state (%d)., xrefs: 004704DE

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on file: %s$Unsetting NTFS compression on file: %s
API String ID: 1452528299-3038984924
Opcode ID: 5e0f8f86fed6f9f7c39952bf00c87fcf13d0ad593fcc8ac6b3cdcf0c83175ddc
Instruction ID: e8b0162e57f804c2a30ba352f90a9bf92a8ca3f223517a7017406bd44fdcfcee
Opcode Fuzzy Hash: 5e0f8f86fed6f9f7c39952bf00c87fcf13d0ad593fcc8ac6b3cdcf0c83175ddc
Instruction Fuzzy Hash: A3018B70D19288A6CF04D7EDA4412EDBBF59F4D314F44C1EFA459E7342DB790A088BAA

Function 0046FCD0 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000), ref: 0046FD21

Strings

Failed to set NTFS compression state (%d)., xrefs: 0046FD32
Unsetting NTFS compression on directory: %s, xrefs: 0046FD07
Setting NTFS compression on directory: %s, xrefs: 0046FCEF

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on directory: %s$Unsetting NTFS compression on directory: %s
API String ID: 1452528299-1392080489
Opcode ID: 74cb5a7a130cb38d20d52844b97610ff045e975bde4c2f4f670a11906ade5ca5
Instruction ID: 0b62ff5e67c42b10e7bcd1c73b0a381227d0d173acf9807972347256283fcfef
Opcode Fuzzy Hash: 74cb5a7a130cb38d20d52844b97610ff045e975bde4c2f4f670a11906ade5ca5
Instruction Fuzzy Hash: A1016730E0825856CB04DBADA4412EDBBF49F0D304F5481FFE896D7242EB791A0D879B

Function 00455D9C Relevance: 6.0, APIs: 4, Instructions: 41registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,37H,?,00000001,?,?,00483733,?,00000001,00000000), ref: 0042DE38

RegDeleteValueA.ADVAPI32(?,00000000,00000082,00000002,00000000,?,?,00000000,0045B686,?,?,?,?,?,00000000,0045B6AD), ref: 00455DD8
RegCloseKey.ADVAPI32(00000000,?,00000000,00000082,00000002,00000000,?,?,00000000,0045B686,?,?,?,?,?,00000000), ref: 00455DE1
RemoveFontResourceA.GDI32(00000000), ref: 00455DEE
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 00455E02

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CloseDeleteFontMessageNotifyOpenRemoveResourceSendValue
String ID:
API String ID: 4283692357-0
Opcode ID: 02238595bac7234ebad497e510db0fe89aaf88b5be50f9c34004e14bcf4398aa
Instruction ID: 71ccc6c4ad223293e5fa71c014565a1ca4f3f808124b73c5b0663eb55104ffd2
Opcode Fuzzy Hash: 02238595bac7234ebad497e510db0fe89aaf88b5be50f9c34004e14bcf4398aa
Instruction Fuzzy Hash: 57F0BEB174070036EA10B6BAAC4BF2B26CC8F54745F10883ABA00EF2C3D97CDC04962D

Function 00477D8C Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,?,?,?,00000001,00000000,00000002,00000000,00480E10,?,?,?,?,?,004988BB,00000000), ref: 00477D95
OpenProcessToken.ADVAPI32(00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,00480E10,?,?,?,?,?,004988BB), ref: 00477D9B
GetTokenInformation.ADVAPI32(00000008,00000012(TokenIntegrityLevel),00000000,00000004,00000008,00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,00480E10), ref: 00477DBD
CloseHandle.KERNEL32(00000000,00000008,TokenIntegrityLevel,00000000,00000004,00000008,00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,00480E10), ref: 00477DCE

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: ced138171f4e7b37df63f6d60c59300768d0a071be6b50addf64793bfa5aa8eb
Instruction ID: 987b79840f0c52b8959c6360de64ddcb26e084bfbcaebf84e1f469c58c485e10
Opcode Fuzzy Hash: ced138171f4e7b37df63f6d60c59300768d0a071be6b50addf64793bfa5aa8eb
Instruction Fuzzy Hash: A7F037616443007BD600E6B58D81E6B77DCEF44354F04883ABE94C71C1D678D8089766

Function 00424240 Relevance: 6.0, APIs: 4, Instructions: 26windowCOMMON

Download Yara Rule

APIs

GetLastActivePopup.USER32(?), ref: 0042424C
IsWindowVisible.USER32(?), ref: 0042425D
IsWindowEnabled.USER32(?), ref: 00424267
SetForegroundWindow.USER32(?), ref: 00424271

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Window$ActiveEnabledForegroundLastPopupVisible
String ID:
API String ID: 2280970139-0
Opcode ID: ba19c83180c847f7cc1a799de6a6bd3f59fb62ceb1b1ee1cbd3621cddb0aa8ae
Instruction ID: 2c5ff33fc315f6eb6fab431e1453bcb0e66c5aaaa6596e28cc8dc28fd0b03a53
Opcode Fuzzy Hash: ba19c83180c847f7cc1a799de6a6bd3f59fb62ceb1b1ee1cbd3621cddb0aa8ae
Instruction Fuzzy Hash: C7E0EC61B02672D6AE31FA7B2881A9F518C9D45BE434641EBBC04FB38ADB2CDC1141BD

Function 00479DA0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 210registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,?,00000001,00000000,00000000,0047B689,?,00000000,00000000,00000001,00000000,0047A03D,?,00000000), ref: 0047A001

Strings

Cannot access a 64-bit key in a "reg" constant on this version of Windows, xrefs: 00479E75
Failed to parse "reg" constant, xrefs: 0047A008

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Close
String ID: Cannot access a 64-bit key in a "reg" constant on this version of Windows$Failed to parse "reg" constant
API String ID: 3535843008-1938159461
Opcode ID: cb5963443985b101f90e6459e9d92d1a207c50e5c3b3050293cb341093ee1cc6
Instruction ID: b9da291a702a23f9cca087d797e0ae80727d0787199f86d639bf183e32c29431
Opcode Fuzzy Hash: cb5963443985b101f90e6459e9d92d1a207c50e5c3b3050293cb341093ee1cc6
Instruction Fuzzy Hash: 85813E74E00148AFCB10DFA5C481ADEBBF9AF48315F50857AE814B7391DB38AE05CB99

Function 0046CAE4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 89COMMON

Download Yara Rule

Strings

Failed to proceed to next wizard page; showing wizard., xrefs: 0046CC10
Failed to proceed to next wizard page; aborting., xrefs: 0046CBFC

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID:
String ID: Failed to proceed to next wizard page; aborting.$Failed to proceed to next wizard page; showing wizard.
API String ID: 0-1974262853
Opcode ID: 33d594b63624b6580e6ea1335757c9c73b02cf19a18a2f29770ba97ccefe4596
Instruction ID: 02609ddebc2f72e37b130453db8fbd0a4ca28e8a7b44a7fb2411c0886f03fee3
Opcode Fuzzy Hash: 33d594b63624b6580e6ea1335757c9c73b02cf19a18a2f29770ba97ccefe4596
Instruction Fuzzy Hash: 0A31AF30604244DFD711EB99E9CABA977E5EB05704F5400BBF448AB392D7787E80CB5A

Function 00450168 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,0000044B,00000000,?), ref: 004501FD
ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 0045022E

Strings

open, xrefs: 00450221

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ExecuteMessageSendShell
String ID: open
API String ID: 812272486-2758837156
Opcode ID: fa29d62d9780523739d4a743ba00ec1ee44d09b31dd3b91501b045b0696864e0
Instruction ID: 7f57506e0c07b49dd0b520b237e7736b759e9f4ed638734fb0c833ac5abbff07
Opcode Fuzzy Hash: fa29d62d9780523739d4a743ba00ec1ee44d09b31dd3b91501b045b0696864e0
Instruction Fuzzy Hash: A1216074E00204AFDB10DFA9C896B9EBBF8EB44705F1081BAB404E7292D678DE45CA59

Function 00455290 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

ShellExecuteEx.SHELL32(0000003C), ref: 0045532C
GetLastError.KERNEL32(0000003C,00000000,00455375,?,?,?), ref: 0045533D

Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7

Strings

<, xrefs: 004552E6

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: DirectoryErrorExecuteLastShellSystem
String ID: <
API String ID: 893404051-4251816714
Opcode ID: e3c2aaf8164fd08d9067a555fb6a2966218db55df2f6cf118cfb9f904223115b
Instruction ID: 92df0b2f1231c5c49ece4c570041ef31d6ed92e86db86b93cafb864a5026e18c
Opcode Fuzzy Hash: e3c2aaf8164fd08d9067a555fb6a2966218db55df2f6cf118cfb9f904223115b
Instruction Fuzzy Hash: 172167B0600609ABDB10EF65C8926AE7BE8AF44355F54403AFC44E7291D7789E49CB98

Function 00402584 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0049B420,00000000,)), ref: 004025C7
RtlLeaveCriticalSection.KERNEL32(0049B420,0040263D), ref: 00402630

Part of subcall function 004019CC: RtlInitializeCriticalSection.KERNEL32(0049B420,00000000,00401A82,?,?,0040222E,02188000,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
Part of subcall function 004019CC: RtlEnterCriticalSection.KERNEL32(0049B420,0049B420,00000000,00401A82,?,?,0040222E,02188000,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
Part of subcall function 004019CC: LocalAlloc.KERNEL32(00000000,00000FF8,0049B420,00000000,00401A82,?,?,0040222E,02188000,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
Part of subcall function 004019CC: RtlLeaveCriticalSection.KERNEL32(0049B420,00401A89,00000000,00401A82,?,?,0040222E,02188000,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Strings

), xrefs: 004025AE

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID: )
API String ID: 2227675388-1084416617
Opcode ID: afc8f00caf7b780c94fc6e1267ef13ed48609c58ab26d4177af9a59a858bbbef
Instruction ID: 77bd95ba853a3ee3b707a504883d316aad751082ca23ba06a0d8aa2ba3da16af
Opcode Fuzzy Hash: afc8f00caf7b780c94fc6e1267ef13ed48609c58ab26d4177af9a59a858bbbef
Instruction Fuzzy Hash: E11104317042046FEB15AB796F5962B6AD4D795758B24087FF404F33D2DABD8C02929C

Function 0049670A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097), ref: 00496745

Strings

/INITPROCWND=$%x , xrefs: 00496770
@, xrefs: 00496710

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Window
String ID: /INITPROCWND=$%x $@
API String ID: 2353593579-4169826103
Opcode ID: ec0b8c3c988b4aa81f0fa7791b97a6f6051cb1d68697a70d3fd13d46f88cc7e3
Instruction ID: 7a141039dda579af08b5e6fdd7feeb5da9df03d9f9889a7a9c69f07b885fae46
Opcode Fuzzy Hash: ec0b8c3c988b4aa81f0fa7791b97a6f6051cb1d68697a70d3fd13d46f88cc7e3
Instruction Fuzzy Hash: 0111A531A043488FDF01DBA4D851BAE7BE8EB48318F5284BBE404E7291D73C9905CA58

Function 00447414 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9

SysFreeString.OLEAUT32(?), ref: 004474C6

Strings

NIL Interface Exception, xrefs: 00447468
Unknown Method, xrefs: 0044749F

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: String$AllocByteCharFreeMultiWide
String ID: NIL Interface Exception$Unknown Method
API String ID: 3952431833-1023667238
Opcode ID: fbec47f95d8ced89ede3bb4e447c9bec3a7dd321ad16f48a8b96cd6aab7145c6
Instruction ID: eb0132878ffe7144b3db707554455947565e11d0cdd4dc78092451a8fec87e99
Opcode Fuzzy Hash: fbec47f95d8ced89ede3bb4e447c9bec3a7dd321ad16f48a8b96cd6aab7145c6
Instruction Fuzzy Hash: 8011B9706082089FEB10DFA58C52A6EBBBCEB09704F91407AF504F7681D77C9D01CB69

Function 00495F7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,00496044,?,00496038,00000000,0049601F), ref: 00495FEA
CloseHandle.KERNEL32(00496084,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,00496044,?,00496038,00000000), ref: 00496001

Part of subcall function 00495ED4: GetLastError.KERNEL32(00000000,00495F6C,?,?,?,?), ref: 00495EF8

Strings

D, xrefs: 00495FC4

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CloseCreateErrorHandleLastProcess
String ID: D
API String ID: 3798668922-2746444292
Opcode ID: e05c694224b5543a0b1caa8416f95522950e10165cfd4008cc05a56571bf4433
Instruction ID: 6120f854a9747ac2d7a22113b9c0a9586d171a1b8bc238317803a43bf85d79ed
Opcode Fuzzy Hash: e05c694224b5543a0b1caa8416f95522950e10165cfd4008cc05a56571bf4433
Instruction Fuzzy Hash: AA01A1B0604648AFDF14DBA6CD82E9EBBACDF08714F61007AB504E7281E6785E048A28

Function 00497BE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 0047CC20: FreeLibrary.KERNEL32(00000000,0048157B), ref: 0047CC36

Part of subcall function 0047C8F0: GetTickCount.KERNEL32 ref: 0047C93A

Part of subcall function 0045716C: SendMessageA.USER32(00000000,00000B01,00000000,00000000), ref: 0045718B

GetCurrentProcess.KERNEL32(00000001,?,?,?,?,0049853B), ref: 00497C39
TerminateProcess.KERNEL32(00000000,00000001,?,?,?,?,0049853B), ref: 00497C3F

Strings

Detected restart. Removing temporary directory., xrefs: 00497BF3

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: Process$CountCurrentFreeLibraryMessageSendTerminateTick
String ID: Detected restart. Removing temporary directory.
API String ID: 1717587489-3199836293
Opcode ID: 9125a2873bd2436d1015a5dc6f845bf9a7d81bf413d74833c3e8d23694f035ae
Instruction ID: d17374ea43c2dea7e7337f0f5ab0ca4281604cba40593c00ffa5d5932da2e1ee
Opcode Fuzzy Hash: 9125a2873bd2436d1015a5dc6f845bf9a7d81bf413d74833c3e8d23694f035ae
Instruction Fuzzy Hash: E4E02B7121C6403DDA0277B67C569573F4CD745B6C761487BF90881652C52E5814D63D

Function 00403344 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00498796), ref: 0040334B
GetCommandLineA.KERNEL32(00000000,00498796), ref: 00403356

Strings

P7i, xrefs: 0040335B

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: CommandHandleLineModule
String ID: P7i
API String ID: 2123368496-932482666
Opcode ID: 48b45b62bccbc2a8e5daf731e4078a894a727d510552ebcfe8024faf6b9ab272
Instruction ID: ff8fa06d391bd0b31f892a344b3e95d40f530220570fde7b1ba7fad45aeb04f1
Opcode Fuzzy Hash: 48b45b62bccbc2a8e5daf731e4078a894a727d510552ebcfe8024faf6b9ab272
Instruction Fuzzy Hash: 45C002609013058AD754AF7579467162A94D751349F80447FF114BA3E1D77C82055BDD

Function 00455674 Relevance: 5.0, APIs: 4, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?), ref: 00455693
Sleep.KERNEL32(?), ref: 004556A3
GetLastError.KERNEL32 ref: 004556B6
GetLastError.KERNEL32 ref: 004556C0

Memory Dump Source

Source File: 00000001.00000002.2793245300.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2793219234.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793346997.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793378529.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793416768.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2793448951.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_chica-pc-shield-1-75-0-1300-en-win.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 15fc397b82897e753cc9d2ffcfedac1196e644d16077d741085952ba6e0ec603
Instruction ID: f31041694d7e6b08a2ea33ec2b58b28b25921f40701f973673b956735a8b67d8
Opcode Fuzzy Hash: 15fc397b82897e753cc9d2ffcfedac1196e644d16077d741085952ba6e0ec603
Instruction Fuzzy Hash: 42F02B32705F58A78B21B56A889157FB2A8DB81366750012BFC0CD7313C878CC058BBC

Analysis Process: cpcsgui.exePID: 6780, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	2.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2%
Total number of Nodes:	2000
Total number of Limit Nodes:	176

Executed Functions

Function 005B3D10 Relevance: 36.9, APIs: 13, Strings: 8, Instructions: 121
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(8CDAA9E8), ref: 005B3D56
GetVersionExW.KERNEL32(?), ref: 005B3D92
GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo), ref: 005B3DA2
GetProcAddress.KERNEL32(00000000), ref: 005B3DA9
GetNativeSystemInfo.KERNELBASE(?), ref: 005B3DBF
_LicenseIsValid@0.MBAM ref: 005B3E03
_IsTrialActive@0.MBAMNET ref: 005B3E0D
_SchedulerInstall@0.MBAM ref: 005B3E17
_ProtectionInstall@0.MBAM ref: 005B3E1D
_SchedulerUninstall@0.MBAM ref: 005B3E55
_ProtectionUninstall@0.MBAM ref: 005B3E5B
_SchedulerStop@0.MBAM ref: 005B3E75
_ProtectionStop@0.MBAM ref: 005B3E7B

Strings

/uninstall, xrefs: 005B3E43
/starttray, xrefs: 005B3E83
kernel32.dll, xrefs: 005B3D9D
/stop, xrefs: 005B3E63
/install, xrefs: 005B3DF1
GetNativeSystemInfo, xrefs: 005B3D98
/startalways, xrefs: 005B3E95
/silent, xrefs: 005B3DD2

Memory Dump Source

Source File: 0000000C.00000002.2567833069.00000000005B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 005B0000, based on PE: true

Associated: 0000000C.00000002.2567804101.00000000005B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2567917358.0000000000607000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2567985326.000000000061A000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2568018090.0000000000620000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b0000_cpcsgui.jbxd

Similarity

API ID: ProtectionScheduler$Install@0Stop@0Uninstall@0Version$Active@0AddressHandleInfoLicenseModuleNativeProcSystemTrialValid@0
String ID: /install$/silent$/startalways$/starttray$/stop$/uninstall$GetNativeSystemInfo$kernel32.dll
API String ID: 1298140389-106368322
Opcode ID: a62653946a97668bee669645d741b72cb7e1ab70de02f9ec0e9368d70453f271
Instruction ID: 2a9a1d93110458471af60ddd6e5653329d782725d108355ec731bb0f738317cb
Opcode Fuzzy Hash: a62653946a97668bee669645d741b72cb7e1ab70de02f9ec0e9368d70453f271
Instruction Fuzzy Hash: 51411B31A8424A9BD7149B75EC49BDF7FAABF14345F044166F806E2191EB31FB04CAA1

Function 6BB950F0 Relevance: 23.5, APIs: 6, Strings: 7, Instructions: 727COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 6BB9563B
std::_Xinvalid_argument.LIBCPMT ref: 6BB959D1
__CxxThrowException@8.LIBCMT ref: 6BB95A5C
std::_Xinvalid_argument.LIBCPMT ref: 6BB95A7F
__CxxThrowException@8.LIBCMT ref: 6BB95AFC

Strings

string too long, xrefs: 6BB959CC
\, xrefs: 6BB95312
illegal document indicator in scalar, xrefs: 6BB95951
, xrefs: 6BB95B15
illegal tab when looking for indentation, xrefs: 6BB95A86
illegal EOF in scalar, xrefs: 6BB959E6
invalid string position, xrefs: 6BB95A7A

Memory Dump Source

Source File: 0000000C.00000002.2569669714.000000006BB51000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BB50000, based on PE: true

Associated: 0000000C.00000002.2569337232.000000006BB50000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCC3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCD5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570976244.000000006BD35000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571057194.000000006BD3A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571109707.000000006BD42000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571273369.000000006BD48000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571319844.000000006BD4B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6bb50000_cpcsgui.jbxd

Similarity

API ID: Exception@8ThrowXinvalid_argumentstd::_$_memmove
String ID: $\$illegal EOF in scalar$illegal document indicator in scalar$illegal tab when looking for indentation$invalid string position$string too long
API String ID: 647153083-4246587829
Opcode ID: d2832324a3ebbdaa8c22bbbf9d3476a412c07c24db56b3b638f890962d5e1808
Instruction ID: e10090ab4a992352368c548dfbf36472bc2859edf7ff0b7d4707478ff9cb0d9a
Opcode Fuzzy Hash: d2832324a3ebbdaa8c22bbbf9d3476a412c07c24db56b3b638f890962d5e1808
Instruction Fuzzy Hash: 3652F2705483C08FD721EF24E481B9EBBE1BF86309F104A6DEA9957381D738D949CB96

Function 6F88CDF0 Relevance: 21.7, APIs: 6, Strings: 6, Instructions: 730COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 6F88D34A
__CxxThrowException@8.LIBCMT ref: 6F88D6C9
std::_Xinvalid_argument.LIBCPMT ref: 6F88D6D3
__CxxThrowException@8.LIBCMT ref: 6F88D75E
std::_Xinvalid_argument.LIBCPMT ref: 6F88D781
__CxxThrowException@8.LIBCMT ref: 6F88D7FE

Part of subcall function 6F856840: _memmove.LIBCMT ref: 6F856935

Strings

illegal EOF in scalar, xrefs: 6F88D6E8
illegal document indicator in scalar, xrefs: 6F88D653
illegal tab when looking for indentation, xrefs: 6F88D788
, xrefs: 6F88D817
invalid string position, xrefs: 6F88D77C
string too long, xrefs: 6F88D6CE

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Exception@8Throw$Xinvalid_argument_memmovestd::_
String ID: $illegal EOF in scalar$illegal document indicator in scalar$illegal tab when looking for indentation$invalid string position$string too long
API String ID: 2480882615-4201326000
Opcode ID: 5377a6eb2d5c482ef6b55bafef28eb2f40d4c8e8f1e999d73187cc2f6a0db201
Instruction ID: 8b981b0dd0c1ad74a0cfe6cc78e10acb239c142bf1098d8ad3912f7abee6e105
Opcode Fuzzy Hash: 5377a6eb2d5c482ef6b55bafef28eb2f40d4c8e8f1e999d73187cc2f6a0db201
Instruction Fuzzy Hash: 12527471608385AFD724CF28C48079EBBE2AF85318F504E9FE4A95F391D770A945CB92

Function 6F85E570 Relevance: 12.1, APIs: 8, Instructions: 95
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6F85E400: CryptAcquireContextW.ADVAPI32(00000000,00000000,Microsoft Enhanced Cryptographic Provider v1.0,00000001,F0000040,00000001,?,00000000,D0A01E50,00000000,?,00000000,?,?,00000000), ref: 6F85E45E

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,?,?,00000001,?,00000000,D0A01E50,00000000,?,00000000,?,?,00000000), ref: 6F85E591
CryptHashData.ADVAPI32(?,?,?,00000000), ref: 6F85E5B3
CryptDestroyHash.ADVAPI32(?), ref: 6F85E5C2
CryptDeriveKey.ADVAPI32(00000000,00006801,?,00000000,?), ref: 6F85E5E2
CryptEncrypt.ADVAPI32(?,00000000,00000001,00000000,?,00000000,?), ref: 6F85E619
CryptDecrypt.ADVAPI32(?,00000000,00000001,00000000,?,?), ref: 6F85E632
CryptDestroyKey.ADVAPI32(?,?,?), ref: 6F85E63F
CryptDestroyHash.ADVAPI32(?,?,?), ref: 6F85E64A

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Crypt$Hash$Destroy$AcquireContextCreateDataDecryptDeriveEncrypt
String ID:
API String ID: 2252723939-0
Opcode ID: aae6acafb2be6ac7294e9c32fca0eea62747b30f5cf1b7508a8719431f10c316
Instruction ID: 55c1cdf8d38b6dc5099dba6bb774f2b329a2309b83de20f3b75f77b7578d419b
Opcode Fuzzy Hash: aae6acafb2be6ac7294e9c32fca0eea62747b30f5cf1b7508a8719431f10c316
Instruction Fuzzy Hash: EB319C75244B01AFEB10DB24CC59F9B77E9AF89760F108998F5449F280DB70E856CBA1

Function 6BB57020 Relevance: 7.8, APIs: 5, Instructions: 328
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6BB51E90: std::_Xinvalid_argument.LIBCPMT ref: 6BB51EAA

RegOpenKeyExW.KERNELBASE(80000001,?,00000000,00020019,000000FF), ref: 6BB570DB
RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,?,?,00000000,?,?,?,00000000,00000000), ref: 6BB57146
RegCloseKey.KERNELBASE(?,?,?,?,?,?,80000001), ref: 6BB573D7
RegCloseKey.ADVAPI32(000000FF), ref: 6BB57155

Part of subcall function 6BB581A0: std::_Xinvalid_argument.LIBCPMT ref: 6BB5820C

Part of subcall function 6BB58280: std::_Xinvalid_argument.LIBCPMT ref: 6BB582EC

RegEnumValueW.KERNELBASE(?,?,00000000,?,00000000,?,00000000,?,?,?,80000001), ref: 6BB57243

Memory Dump Source

Source File: 0000000C.00000002.2569669714.000000006BB51000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BB50000, based on PE: true

Associated: 0000000C.00000002.2569337232.000000006BB50000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCC3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCD5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570976244.000000006BD35000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571057194.000000006BD3A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571109707.000000006BD42000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571273369.000000006BD48000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571319844.000000006BD4B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6bb50000_cpcsgui.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$Close$EnumInfoOpenQueryValue
String ID:
API String ID: 3111832342-0
Opcode ID: 10cd741607a37c0ca5207d76e68fdaff15484965b5801426df0f0a5ca1bc0566
Instruction ID: ffed6857eaca73a46fc8b1debc22293a1b99c888ccb0e06a07fc38ddc66dcea2
Opcode Fuzzy Hash: 10cd741607a37c0ca5207d76e68fdaff15484965b5801426df0f0a5ca1bc0566
Instruction Fuzzy Hash: 88C149B25083809BD324DF65D881B9FB7E9BF89304F44892DF59A83250EB79A504CB53

Function 6F85B9E0 Relevance: 7.8, APIs: 5, Instructions: 326
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6F853280: std::_Xinvalid_argument.LIBCPMT ref: 6F853298

RegOpenKeyExW.KERNELBASE(?,?,00000000,00020019,D0A01E50), ref: 6F85BA98
RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,00000007,?,00000000,?,?,?,00000000,00000000), ref: 6F85BAFC
RegCloseKey.ADVAPI32(D0A01E50), ref: 6F85BB0B

Part of subcall function 6F857BA0: std::_Xinvalid_argument.LIBCPMT ref: 6F857C0C

Part of subcall function 6F85CC00: std::_Xinvalid_argument.LIBCPMT ref: 6F85CC6C

RegEnumValueW.KERNELBASE(?,?,00000000,?,00000000,?,00000000,?,?,?,00000007), ref: 6F85BBFA

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$CloseEnumInfoOpenQueryValue
String ID:
API String ID: 307547635-0
Opcode ID: 101d73390b32e1ec2066b206bf90aac08468421b7b7680eb6fdfbb7a521b70d2
Instruction ID: 0a973fdfe3b1a05938c6936bcc2d5f40425cab70875a606d576fdf8bc4692021
Opcode Fuzzy Hash: 101d73390b32e1ec2066b206bf90aac08468421b7b7680eb6fdfbb7a521b70d2
Instruction Fuzzy Hash: C9C14BB1508780ABD764CF68C880A9BB7E8BFD9304F048D5EF59A8B251E771A504CB53

Function 6F8625E0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 232
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(D0A01E50,?), ref: 6F862697
FindNextFileW.KERNELBASE(00000000,00000400), ref: 6F86284C
FindClose.KERNELBASE(00000000), ref: 6F86285B

Strings

\, xrefs: 6F86265B

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID: \
API String ID: 3541575487-2967466578
Opcode ID: cf591044454c65bf52b4b52f02c606c221db26f556acf09f6e186f12e39d3dcb
Instruction ID: 6f0b6e125f7e5b9f4359e4a64ab33b86447b5446b1e9dc4c5c381249065a3359
Opcode Fuzzy Hash: cf591044454c65bf52b4b52f02c606c221db26f556acf09f6e186f12e39d3dcb
Instruction Fuzzy Hash: ED918D715087819FDB14DF28C844F9BB7E4BF99314F004EADF8998B290E735A909CB92

Function 6BB592B0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 230
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(7BDC3733,?), ref: 6BB59368
FindNextFileW.KERNELBASE(00000000,00000400), ref: 6BB5951B
FindClose.KERNELBASE(00000000), ref: 6BB5952A

Strings

\, xrefs: 6BB5932B

Memory Dump Source

Source File: 0000000C.00000002.2569669714.000000006BB51000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BB50000, based on PE: true

Associated: 0000000C.00000002.2569337232.000000006BB50000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCC3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCD5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570976244.000000006BD35000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571057194.000000006BD3A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571109707.000000006BD42000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571273369.000000006BD48000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571319844.000000006BD4B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6bb50000_cpcsgui.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID: \
API String ID: 3541575487-2967466578
Opcode ID: 05c8f7988b02077f29e51cd3b6a5d13df109b3720baa510796d8d354e2d31ad6
Instruction ID: d164870d4bf1a649b428353cde27defcbfb649b33fdd76586a17bdcb5d695b61
Opcode Fuzzy Hash: 05c8f7988b02077f29e51cd3b6a5d13df109b3720baa510796d8d354e2d31ad6
Instruction Fuzzy Hash: E4917AB25083819BD320DF24D845B9FB3E5FF99314F400A6CE99987291E739E919CB93

Function 6F85E400 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 6F8907C7: _malloc.LIBCMT ref: 6F8907E1

CryptAcquireContextW.ADVAPI32(00000000,00000000,Microsoft Enhanced Cryptographic Provider v1.0,00000001,F0000040,00000001,?,00000000,D0A01E50,00000000,?,00000000,?,?,00000000), ref: 6F85E45E

Strings

Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 6F85E450

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: AcquireContextCrypt_malloc
String ID: Microsoft Enhanced Cryptographic Provider v1.0
API String ID: 3378577091-1948191093
Opcode ID: 60544623c59eeb7e5decd0d72ff87a3870948182f5aa6b836745b31379ab8534
Instruction ID: 5263a51f60f4cc305005e669331272ff56887304348d3f13c2af7e4ba31efe66
Opcode Fuzzy Hash: 60544623c59eeb7e5decd0d72ff87a3870948182f5aa6b836745b31379ab8534
Instruction Fuzzy Hash: 181102B5509B91DFD714CF08D842B517BE4FB49B20F0009AEE995DB780E37AA614CBC2

Function 6BB6FFD0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 6BB9B5AB: _malloc.LIBCMT ref: 6BB9B5C5

CryptAcquireContextW.ADVAPI32(00000000,00000000,Microsoft Enhanced Cryptographic Provider v1.0,00000001,F0000040,00000001,00000007,00000000,7BDC3733,?,?,7BDC3733,?,00000007,00000000), ref: 6BB7002E

Strings

Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 6BB70020

Memory Dump Source

Source File: 0000000C.00000002.2569669714.000000006BB51000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BB50000, based on PE: true

Associated: 0000000C.00000002.2569337232.000000006BB50000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCC3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCD5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570976244.000000006BD35000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571057194.000000006BD3A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571109707.000000006BD42000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571273369.000000006BD48000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571319844.000000006BD4B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6bb50000_cpcsgui.jbxd

Similarity

API ID: AcquireContextCrypt_malloc
String ID: Microsoft Enhanced Cryptographic Provider v1.0
API String ID: 3378577091-1948191093
Opcode ID: c08e28b37b85d8f7528b87562bba0ea80eb59efd925b88fb6c686c88c1e483a6
Instruction ID: 3207f67a99556abace7b942569edfded73d1e65dd693f8374c493dd8ec531469
Opcode Fuzzy Hash: c08e28b37b85d8f7528b87562bba0ea80eb59efd925b88fb6c686c88c1e483a6
Instruction Fuzzy Hash: 2711E0755087919FE720DF18EA51B42BBE4FB0AB20F40052EE9859B780E37EE940CB81

Function 6F861A90 Relevance: 9.1, APIs: 6, Instructions: 148
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6F8907C7: _malloc.LIBCMT ref: 6F8907E1

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,00000000,000000FF,6F861A7F,?,?,6F861D2A), ref: 6F861B14
GetFileSizeEx.KERNEL32(00000000,?), ref: 6F861B3F
ReadFile.KERNELBASE(00000000,00000000,?,?,00000000), ref: 6F861B8E
CloseHandle.KERNEL32(00000000), ref: 6F861B99
CloseHandle.KERNEL32(00000000), ref: 6F861BD7
CloseHandle.KERNEL32(00000000), ref: 6F861BE7

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: CloseFileHandle$CreateReadSize_malloc
String ID:
API String ID: 2550811386-0
Opcode ID: 0b3af65a90425cf62d7a4bb602420a9445530ee587fdb899f7f471de846535cc
Instruction ID: 6b312cda8cf42963af7286090cb4d55c3e0e737ac61e9c400176acd999c461c9
Opcode Fuzzy Hash: 0b3af65a90425cf62d7a4bb602420a9445530ee587fdb899f7f471de846535cc
Instruction Fuzzy Hash: 8A518170508B449BD314CF29C944B5BB7E8FF89B64F104A9EF4648B291EB74E905CB92

Function 6BB6EDD0 Relevance: 9.1, APIs: 6, Instructions: 148
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6BB9B5AB: _malloc.LIBCMT ref: 6BB9B5C5

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,00000000,000000FF,6BB6EDBF,?,?,6BB6EFCA), ref: 6BB6EE54
GetFileSizeEx.KERNEL32(00000000,?), ref: 6BB6EE7F
ReadFile.KERNELBASE(00000000,00000000,?,?,00000000), ref: 6BB6EECE
CloseHandle.KERNEL32(00000000), ref: 6BB6EED9
CloseHandle.KERNEL32(00000000), ref: 6BB6EF17
CloseHandle.KERNEL32(00000000), ref: 6BB6EF27

Memory Dump Source

Source File: 0000000C.00000002.2569669714.000000006BB51000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BB50000, based on PE: true

Associated: 0000000C.00000002.2569337232.000000006BB50000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCC3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCD5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570976244.000000006BD35000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571057194.000000006BD3A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571109707.000000006BD42000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571273369.000000006BD48000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571319844.000000006BD4B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6bb50000_cpcsgui.jbxd

Similarity

API ID: CloseFileHandle$CreateReadSize_malloc
String ID:
API String ID: 2550811386-0
Opcode ID: a016831f433d8d936a2650afd1233ad58752dd255868154b54c157c714bbac90
Instruction ID: 5e0c4d2fd7a43c5d9a05c088b5ef9b62757aeb8a796657e3056785942f040532
Opcode Fuzzy Hash: a016831f433d8d936a2650afd1233ad58752dd255868154b54c157c714bbac90
Instruction Fuzzy Hash: 9E518A71114281DFE710CF29CC84B5EBBE8FF867A4F114A59F56487290E778ED058B62

Function 005E0620 Relevance: 9.1, APIs: 6, Instructions: 148
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005E7B0D: _malloc.LIBCMT ref: 005E7B27

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,?,000000FF,005E060F,?,?,005E081A), ref: 005E06A4
GetFileSizeEx.KERNEL32(00000000,?), ref: 005E06CF
ReadFile.KERNELBASE(00000000,00000000,?,?,00000000), ref: 005E071E
CloseHandle.KERNEL32(00000000), ref: 005E0729
CloseHandle.KERNEL32(00000000), ref: 005E0767
CloseHandle.KERNEL32(00000000), ref: 005E0777

Memory Dump Source

Source File: 0000000C.00000002.2567833069.00000000005B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 005B0000, based on PE: true

Associated: 0000000C.00000002.2567804101.00000000005B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2567917358.0000000000607000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2567985326.000000000061A000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2568018090.0000000000620000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b0000_cpcsgui.jbxd

Similarity

API ID: CloseFileHandle$CreateReadSize_malloc
String ID:
API String ID: 2550811386-0
Opcode ID: f920690a0e76bc4a1079e2b3de8cf8730e0d3f7937f3cfea71f66b0d72bb626a
Instruction ID: 5b686ecbb0999997326a350604d86840c440665cffc306b4c29b98c9ed5466e3
Opcode Fuzzy Hash: f920690a0e76bc4a1079e2b3de8cf8730e0d3f7937f3cfea71f66b0d72bb626a
Instruction Fuzzy Hash: FE5188701082819BC314DF26D984B2BBBE8FFC8724F145A09F4A5872D0E7B4E945CBA2

Function 005B31F0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::exception::exception.LIBCMT ref: 005B328E

Part of subcall function 005E758D: std::exception::_Copy_str.LIBCMT ref: 005E75A8

__CxxThrowException@8.LIBCMT ref: 005B32A3

Part of subcall function 005E8536: RaiseException.KERNEL32(005B32A8,?,8CDAA9E8,00607460,005B32A8,?,00611CD0,8CDAA9E8,8CDAA9E8), ref: 005E8578

Part of subcall function 005B33C0: std::exception::exception.LIBCMT ref: 005B33F1
Part of subcall function 005B33C0: __CxxThrowException@8.LIBCMT ref: 005B3408

_memmove.LIBCMT ref: 005B32E7

Strings

`t`, xrefs: 005B329C
ExecuteMBAMCommand, xrefs: 005B3206

Memory Dump Source

Source File: 0000000C.00000002.2567833069.00000000005B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 005B0000, based on PE: true

Associated: 0000000C.00000002.2567804101.00000000005B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2567917358.0000000000607000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2567985326.000000000061A000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2568018090.0000000000620000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b0000_cpcsgui.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaise_memmovestd::exception::_
String ID: ExecuteMBAMCommand$`t`
API String ID: 163498487-1378453443
Opcode ID: eb0f077f6690f6520de74c153ea758c7d47690ee8e41129ed0f1216d9a64ecfa
Instruction ID: 7c2649ea2b5a426f99013fedcc319496422009849767393d6300b9e92a76dd4b
Opcode Fuzzy Hash: eb0f077f6690f6520de74c153ea758c7d47690ee8e41129ed0f1216d9a64ecfa
Instruction Fuzzy Hash: 1E419975A04215ABCB04DF69C8455EEFBF5FF44310B15462EE826A7740D730BA14C7A1

Function 6F853280 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6F853298

Part of subcall function 6F88F682: std::exception::exception.LIBCMT ref: 6F88F697
Part of subcall function 6F88F682: __CxxThrowException@8.LIBCMT ref: 6F88F6AC
Part of subcall function 6F88F682: std::exception::exception.LIBCMT ref: 6F88F6BD

std::_Xinvalid_argument.LIBCPMT ref: 6F8532D3

Part of subcall function 6F88F635: std::exception::exception.LIBCMT ref: 6F88F64A
Part of subcall function 6F88F635: __CxxThrowException@8.LIBCMT ref: 6F88F65F
Part of subcall function 6F88F635: std::exception::exception.LIBCMT ref: 6F88F670

_memmove.LIBCMT ref: 6F85333C

Strings

invalid string position, xrefs: 6F853293
string too long, xrefs: 6F8532CE

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_$_memmove
String ID: invalid string position$string too long
API String ID: 1615890066-4289949731
Opcode ID: 43e22e2bd24d48844c582211ae00cc2c128eb39b1ca8472ae48420eb4830c656
Instruction ID: f6f964a000a04715dcf5c8b8cc8158f24b3df58a93b7ed4feab814fbba59dae6
Opcode Fuzzy Hash: 43e22e2bd24d48844c582211ae00cc2c128eb39b1ca8472ae48420eb4830c656
Instruction Fuzzy Hash: B221DC733057149B87249E6CB88246AF3A6EF953623104EAFE556CF250EB31EC21C7A5

Function 005E7B0D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 005E7B27

Part of subcall function 005E9FE7: __FF_MSGBANNER.LIBCMT ref: 005EA000
Part of subcall function 005E9FE7: __NMSG_WRITE.LIBCMT ref: 005EA007
Part of subcall function 005E9FE7: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,005EB2F9,00000000,00000001,00000000,?,005F0E4F,00000018,006119D0,0000000C,005F0EDF), ref: 005EA02C

std::exception::exception.LIBCMT ref: 005E7B5C
std::exception::exception.LIBCMT ref: 005E7B76
__CxxThrowException@8.LIBCMT ref: 005E7B87

Strings

`t`, xrefs: 005E7B3F

Memory Dump Source

Source File: 0000000C.00000002.2567833069.00000000005B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 005B0000, based on PE: true

Associated: 0000000C.00000002.2567804101.00000000005B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2567917358.0000000000607000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2567985326.000000000061A000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2568018090.0000000000620000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b0000_cpcsgui.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID: `t`
API String ID: 615853336-2977419160
Opcode ID: 9c84a354a6534560da1a169e4668125d3a30eb6a80d816a0059a9a9aebceab84
Instruction ID: f10a7e4a0aedd1b4210769f2cdd08d3bd5ebfe7e7e857ec74f4a6437d64436d4
Opcode Fuzzy Hash: 9c84a354a6534560da1a169e4668125d3a30eb6a80d816a0059a9a9aebceab84
Instruction Fuzzy Hash: E4F0F97194428E6ACB0DEF56DC0A9DE3FAAFB84718F04045AF450960D1EB709E409690

Function 6BB51E90 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6BB51EAA

Part of subcall function 6BBB1350: std::exception::exception.LIBCMT ref: 6BBB1365
Part of subcall function 6BBB1350: __CxxThrowException@8.LIBCMT ref: 6BBB137A
Part of subcall function 6BBB1350: std::exception::exception.LIBCMT ref: 6BBB138B

std::_Xinvalid_argument.LIBCPMT ref: 6BB51EE9

Part of subcall function 6BBB1303: std::exception::exception.LIBCMT ref: 6BBB1318
Part of subcall function 6BBB1303: __CxxThrowException@8.LIBCMT ref: 6BBB132D
Part of subcall function 6BBB1303: std::exception::exception.LIBCMT ref: 6BBB133E

Strings

string too long, xrefs: 6BB51EE4
invalid string position, xrefs: 6BB51EA5

Memory Dump Source

Source File: 0000000C.00000002.2569669714.000000006BB51000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BB50000, based on PE: true

Associated: 0000000C.00000002.2569337232.000000006BB50000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCC3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCD5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570976244.000000006BD35000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571057194.000000006BD3A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571109707.000000006BD42000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571273369.000000006BD48000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571319844.000000006BD4B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6bb50000_cpcsgui.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 1823113695-4289949731
Opcode ID: b83905471d7cfb8e7e5ba2d05357f18a6b361286f7a3ee283e9b924f7fcaa49f
Instruction ID: 113a688652ddc430b56f4eec5c2385e8c4eca1215f8649bb029441b3b3ce2bf9
Opcode Fuzzy Hash: b83905471d7cfb8e7e5ba2d05357f18a6b361286f7a3ee283e9b924f7fcaa49f
Instruction Fuzzy Hash: 6D31C2337097649B83209E6CEC8096FF3A9EBD1761714096FF552C7250EB26986087A2

Function 005B2DD0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Xinvalid_argument.LIBCPMT ref: 005B2E30
_memmove.LIBCMT ref: 005B2E85

Strings

string too long, xrefs: 005B2E2B
ExecuteMBAMCommand, xrefs: 005B2E12, 005B2E83

Memory Dump Source

Source File: 0000000C.00000002.2567833069.00000000005B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 005B0000, based on PE: true

Associated: 0000000C.00000002.2567804101.00000000005B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2567917358.0000000000607000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2567985326.000000000061A000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2568018090.0000000000620000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b0000_cpcsgui.jbxd

Similarity

API ID: Xinvalid_argument_memmovestd::_
String ID: ExecuteMBAMCommand$string too long
API String ID: 256744135-492468810
Opcode ID: a656efaa31ebec1affebf57baf8dcaa89dca11d25c88be144b0a83a994a77140
Instruction ID: 0362fb7afe743063b00f3e4eee0ceb71a55d4c76680c5a095fc3bf81c662216d
Opcode Fuzzy Hash: a656efaa31ebec1affebf57baf8dcaa89dca11d25c88be144b0a83a994a77140
Instruction Fuzzy Hash: 8E216F727146048B8A24DE5EE8848BAFBEEFFE5740B10092EE146C7611DB71FC468775

Function 6BB57BB0 Relevance: 6.1, APIs: 4, Instructions: 127
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6BB51E90: std::_Xinvalid_argument.LIBCPMT ref: 6BB51EAA

RegOpenKeyExW.KERNELBASE(?,00000000,00000000,00000001,7BDC3733), ref: 6BB57C48
RegQueryValueExW.KERNELBASE(7BDC3733,?,00000000,00000000,00000007,00000800), ref: 6BB57CA1
RegCloseKey.ADVAPI32(7BDC3733), ref: 6BB57CB0
RegCloseKey.ADVAPI32(7BDC3733), ref: 6BB57CDF

Memory Dump Source

Source File: 0000000C.00000002.2569669714.000000006BB51000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BB50000, based on PE: true

Associated: 0000000C.00000002.2569337232.000000006BB50000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCC3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCD5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570976244.000000006BD35000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571057194.000000006BD3A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571109707.000000006BD42000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571273369.000000006BD48000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571319844.000000006BD4B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6bb50000_cpcsgui.jbxd

Similarity

API ID: Close$OpenQueryValueXinvalid_argumentstd::_
String ID:
API String ID: 4154549875-0
Opcode ID: 496174d1620377e215204dda6d676ad373fb665df9f5a87115a444aadecbd5be
Instruction ID: 0cbe0decc18a404f2f60a638645563ec2f136964084faaa907cd734c568f2afa
Opcode Fuzzy Hash: 496174d1620377e215204dda6d676ad373fb665df9f5a87115a444aadecbd5be
Instruction Fuzzy Hash: F0414CB2609385AFD760DF25D844A6BB7F9FFC9714F404A1EE08587240DB78A504CBA3

Function 6F85C500 Relevance: 6.1, APIs: 4, Instructions: 107registryCOMMON

Download Yara Rule

APIs

Part of subcall function 6F853280: std::_Xinvalid_argument.LIBCPMT ref: 6F853298

RegOpenKeyExW.KERNELBASE(80000002,?,00000000,00000001,D0A01E50), ref: 6F85C597
RegQueryValueExW.KERNELBASE(D0A01E50,?,00000000,00000000,?,00000800), ref: 6F85C5CE
RegCloseKey.KERNELBASE(D0A01E50), ref: 6F85C5DD
RegCloseKey.KERNELBASE(D0A01E50), ref: 6F85C5E5

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Close$OpenQueryValueXinvalid_argumentstd::_
String ID:
API String ID: 4154549875-0
Opcode ID: 257ef09e418dbdb2e90dd99c3f6994e36725d121ae8534df4c3d5550e9fcc3d9
Instruction ID: b0cf4edbc7859ff89c66704479673084f5479613792e9ca2a6feca3892a259f8
Opcode Fuzzy Hash: 257ef09e418dbdb2e90dd99c3f6994e36725d121ae8534df4c3d5550e9fcc3d9
Instruction Fuzzy Hash: A7415B715047419FC764CF29C884A5BB7E8FF8A714F404E5EF4958B250EB30A518CBA2

Function 005BC860 Relevance: 6.1, APIs: 4, Instructions: 107registryCOMMON

Download Yara Rule

APIs

Part of subcall function 005B2B30: std::_Xinvalid_argument.LIBCPMT ref: 005B2B48

RegOpenKeyExW.KERNELBASE(80000002,?,00000000,00000001,8CDAA9E8), ref: 005BC8F7
RegQueryValueExW.KERNELBASE(8CDAA9E8,?,00000000,00000000,?,00000800), ref: 005BC92E
RegCloseKey.ADVAPI32(8CDAA9E8), ref: 005BC93D
RegCloseKey.ADVAPI32(8CDAA9E8), ref: 005BC945

Memory Dump Source

Source File: 0000000C.00000002.2567833069.00000000005B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 005B0000, based on PE: true

Associated: 0000000C.00000002.2567804101.00000000005B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2567917358.0000000000607000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2567985326.000000000061A000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2568018090.0000000000620000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b0000_cpcsgui.jbxd

Similarity

API ID: Close$OpenQueryValueXinvalid_argumentstd::_
String ID:
API String ID: 4154549875-0
Opcode ID: ac5b7026e838d1543e1eff841964984fcb46177bd7bb36212d63c20ff22e44f4
Instruction ID: ac2e10e6c4b582584f89a28503d16ecf57da87454fe0fdcd3fb311cd8b355703
Opcode Fuzzy Hash: ac5b7026e838d1543e1eff841964984fcb46177bd7bb36212d63c20ff22e44f4
Instruction Fuzzy Hash: F4415E715083459FD724CF15D885AABFBE9FFC9710F404A1EF49687250DB30A504CBA6

Function 6F8907C7 Relevance: 6.0, APIs: 4, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6F8907E1

Part of subcall function 6F8932A4: __FF_MSGBANNER.LIBCMT ref: 6F8932BD
Part of subcall function 6F8932A4: __NMSG_WRITE.LIBCMT ref: 6F8932C4
Part of subcall function 6F8932A4: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,6F89450F,00000000,00000001,00000000,?,6F89A441,00000018,6F8BD148,0000000C,6F89A4D1), ref: 6F8932E9

std::exception::exception.LIBCMT ref: 6F890816
std::exception::exception.LIBCMT ref: 6F890830
__CxxThrowException@8.LIBCMT ref: 6F890841

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID:
API String ID: 615853336-0
Opcode ID: 5a74989dd54243d11881c942115c7e680d5540109aa95d691eee130deb6e5abe
Instruction ID: a5a567bcb07e457e48c337d3a549b103643ebd9b9b507caea62f36841d52263e
Opcode Fuzzy Hash: 5a74989dd54243d11881c942115c7e680d5540109aa95d691eee130deb6e5abe
Instruction Fuzzy Hash: 93F0F431401309BBDF08DF7DC844A9E7AA9AF4026CF101CC9E414AE6C4DB719A45CB80

Function 6BB9B5AB Relevance: 6.0, APIs: 4, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6BB9B5C5

Part of subcall function 6BB9C134: __FF_MSGBANNER.LIBCMT ref: 6BB9C14D
Part of subcall function 6BB9C134: __NMSG_WRITE.LIBCMT ref: 6BB9C154
Part of subcall function 6BB9C134: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,6BB9C3B9,6BCC4320,00000001,6BCC4320,?,6BBA12C9,00000018,6BD25808,0000000C,6BBA1359), ref: 6BB9C179

std::exception::exception.LIBCMT ref: 6BB9B5FA
std::exception::exception.LIBCMT ref: 6BB9B614
__CxxThrowException@8.LIBCMT ref: 6BB9B625

Memory Dump Source

Source File: 0000000C.00000002.2569669714.000000006BB51000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BB50000, based on PE: true

Associated: 0000000C.00000002.2569337232.000000006BB50000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCC3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCD5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570976244.000000006BD35000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571057194.000000006BD3A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571109707.000000006BD42000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571273369.000000006BD48000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571319844.000000006BD4B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6bb50000_cpcsgui.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID:
API String ID: 615853336-0
Opcode ID: d8edd0485291db57e0d28f26be94f09949e5442a1b1272ca34574b3d067a3ef4
Instruction ID: 86629680e146003811bb0f6c71ada884e88b2ba18976e6274bdf39546995b45e
Opcode Fuzzy Hash: d8edd0485291db57e0d28f26be94f09949e5442a1b1272ca34574b3d067a3ef4
Instruction Fuzzy Hash: BAF08171804189AAEF18FFA4FC15A9EBAA5EB47758F100179E5109B180DF78DA81CFA1

Function 6F881B30 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 266COMMON

Download Yara Rule

Strings

end of map not found, xrefs: 6F881DC8, 6F881E8E

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID:
String ID: end of map not found
API String ID: 0-1937500125
Opcode ID: 26f7e01ef81645f0c26922e74afdbaf7428394614c470dac7bd4a6f4ab5bb3e8
Instruction ID: 2a11f6b5601c12d7b0199c4f5d775bb43d30c2963342e97c6e3880f2bc57af49
Opcode Fuzzy Hash: 26f7e01ef81645f0c26922e74afdbaf7428394614c470dac7bd4a6f4ab5bb3e8
Instruction Fuzzy Hash: F2B15F71504781AFC724CF68C480A9EB7E5BF85318F104DAEE5AA9F390DB30E945CB92

Function 005E15E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 005E7B0D: _malloc.LIBCMT ref: 005E7B27

std::exception::exception.LIBCMT ref: 005E1699
__CxxThrowException@8.LIBCMT ref: 005E16B0

Strings

`t`, xrefs: 005E16A8

Memory Dump Source

Source File: 0000000C.00000002.2567833069.00000000005B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 005B0000, based on PE: true

Associated: 0000000C.00000002.2567804101.00000000005B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2567917358.0000000000607000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2567985326.000000000061A000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2568018090.0000000000620000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b0000_cpcsgui.jbxd

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID: `t`
API String ID: 4063778783-2977419160
Opcode ID: 084ed4c1ec9cc90a7ad560568f8653b38bf96a45d9922e211ce9513434bd22f0
Instruction ID: 532693b209036ff98c6d7a5b34205eeeb84e2212e7fb8d44b669352ea5871297
Opcode Fuzzy Hash: 084ed4c1ec9cc90a7ad560568f8653b38bf96a45d9922e211ce9513434bd22f0
Instruction Fuzzy Hash: F5213AB18187919BC304DF19C845A5BBFE9FFC8B04F444A1EF48993250E7749608CB96

Function 005E2490 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 005E251C
__CxxThrowException@8.LIBCMT ref: 005E2533

Part of subcall function 005D2060: std::_Xinvalid_argument.LIBCPMT ref: 005D2080
Part of subcall function 005D2060: _memmove.LIBCMT ref: 005D20F3
Part of subcall function 005D2060: _memmove.LIBCMT ref: 005D2118

Strings

`t`, xrefs: 005E252B

Memory Dump Source

Source File: 0000000C.00000002.2567833069.00000000005B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 005B0000, based on PE: true

Associated: 0000000C.00000002.2567804101.00000000005B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2567917358.0000000000607000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2567985326.000000000061A000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2568018090.0000000000620000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b0000_cpcsgui.jbxd

Similarity

API ID: _memmove$Exception@8ThrowXinvalid_argumentstd::_std::exception::exception
String ID: `t`
API String ID: 2097953723-2977419160
Opcode ID: 7d169d653a121ddf31334834eb639f3085e789db4d29981c8a70a66f2658b2b9
Instruction ID: 3509913da1b92bd72316140fd1f773d69651a3d97d468af2cc0d20023daae71b
Opcode Fuzzy Hash: 7d169d653a121ddf31334834eb639f3085e789db4d29981c8a70a66f2658b2b9
Instruction Fuzzy Hash: CC1190752042458BDB18DF0AC480A56BBE9FFD4314F5884A9ED998F38BD731E905CBA2

Function 005B8670 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 005B86AB
__CxxThrowException@8.LIBCMT ref: 005B86C2

Part of subcall function 005E7B0D: _malloc.LIBCMT ref: 005E7B27

Strings

`t`, xrefs: 005B86BA

Memory Dump Source

Source File: 0000000C.00000002.2567833069.00000000005B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 005B0000, based on PE: true

Associated: 0000000C.00000002.2567804101.00000000005B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2567917358.0000000000607000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2567985326.000000000061A000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2568018090.0000000000620000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b0000_cpcsgui.jbxd

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID: `t`
API String ID: 4063778783-2977419160
Opcode ID: 8d61965f914a45f92d9d0b8119291c362cfc4e9dcf9a5714552a4a1b929bd0c1
Instruction ID: 45ea3acd95588fe0ef550ec5d5b4c85b1e524ce251c7b20b36dd9a8b42404f9b
Opcode Fuzzy Hash: 8d61965f914a45f92d9d0b8119291c362cfc4e9dcf9a5714552a4a1b929bd0c1
Instruction Fuzzy Hash: F2E0A07150430256E70CEF6ACD06BAA7FD8AB94340F84482DA484C2160FA38D1488A53

Function 005BAEE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 005BAF0B
__CxxThrowException@8.LIBCMT ref: 005BAF22

Part of subcall function 005E7B0D: _malloc.LIBCMT ref: 005E7B27

Strings

`t`, xrefs: 005BAF1A

Memory Dump Source

Source File: 0000000C.00000002.2567833069.00000000005B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 005B0000, based on PE: true

Associated: 0000000C.00000002.2567804101.00000000005B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2567917358.0000000000607000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2567985326.000000000061A000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2568018090.0000000000620000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b0000_cpcsgui.jbxd

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID: `t`
API String ID: 4063778783-2977419160
Opcode ID: 46bbecd5cc975aae77b6ac5264b8f8771f4b662ff5066b8b73bf20d93b254fac
Instruction ID: 658e4d5ae10f80c69204edb94c66d91fc403d72d5b0ecbe32958dbc7e0e92495
Opcode Fuzzy Hash: 46bbecd5cc975aae77b6ac5264b8f8771f4b662ff5066b8b73bf20d93b254fac
Instruction Fuzzy Hash: 68E0DFB480830366EB28BB258812AEB7ED8FF94350F804A1DF4A981191FB30E1488953

Function 6F879D20 Relevance: 4.6, APIs: 3, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 6F8907C7: _malloc.LIBCMT ref: 6F8907E1

_memmove.LIBCMT ref: 6F879E37

Part of subcall function 6F8907C7: std::exception::exception.LIBCMT ref: 6F890816
Part of subcall function 6F8907C7: std::exception::exception.LIBCMT ref: 6F890830
Part of subcall function 6F8907C7: __CxxThrowException@8.LIBCMT ref: 6F890841

std::exception::exception.LIBCMT ref: 6F879DB1
__CxxThrowException@8.LIBCMT ref: 6F879DC8

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw$_malloc_memmove
String ID:
API String ID: 4266200104-0
Opcode ID: 4a6461ce7ef586f619616d38d8766154517c672b547609714622180d0d524d82
Instruction ID: 0c01c9d36fd423df8b15a999f64a2ee1c935f9b219da3f7cbd0c52311bd83d24
Opcode Fuzzy Hash: 4a6461ce7ef586f619616d38d8766154517c672b547609714622180d0d524d82
Instruction Fuzzy Hash: 31518CB5904745EFC324CF28D880B86BBE4FB09714F044AAEE8968B751E771F914CB92

Function 6F856840 Relevance: 4.6, APIs: 3, Instructions: 113COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 6F8568D9

Part of subcall function 6F890109: std::exception::_Copy_str.LIBCMT ref: 6F890124

__CxxThrowException@8.LIBCMT ref: 6F8568EE

Part of subcall function 6F8924F0: RaiseException.KERNEL32(6F853778,?,D0A01E50,6F8B13C0,6F853778,?,6F8BD3C8,80000002,D0A01E50), ref: 6F892532

Part of subcall function 6F8569B0: std::exception::exception.LIBCMT ref: 6F8569E0
Part of subcall function 6F8569B0: __CxxThrowException@8.LIBCMT ref: 6F8569F7

_memmove.LIBCMT ref: 6F856935

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaise_memmovestd::exception::_
String ID:
API String ID: 163498487-0
Opcode ID: 7461b70a196e9ecfb2b0138495b45ce5e6ae6ce2f13b2c04a2bbd7dbc41929d7
Instruction ID: ef4feb1f557b0e2b3915cefd07f6281505a63e332d97a4198eeeb906e18b1807
Opcode Fuzzy Hash: 7461b70a196e9ecfb2b0138495b45ce5e6ae6ce2f13b2c04a2bbd7dbc41929d7
Instruction Fuzzy Hash: DB41A971E00605ABDB44CF6CC89069EBBF4EB46360F544AAAE8159F780D731A954CBE1

Function 6F8536C0 Relevance: 4.6, APIs: 3, Instructions: 111COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 6F85375E

Part of subcall function 6F890109: std::exception::_Copy_str.LIBCMT ref: 6F890124

__CxxThrowException@8.LIBCMT ref: 6F853773

Part of subcall function 6F8924F0: RaiseException.KERNEL32(6F853778,?,D0A01E50,6F8B13C0,6F853778,?,6F8BD3C8,80000002,D0A01E50), ref: 6F892532

Part of subcall function 6F8538B0: std::exception::exception.LIBCMT ref: 6F8538E1
Part of subcall function 6F8538B0: __CxxThrowException@8.LIBCMT ref: 6F8538F8

_memmove.LIBCMT ref: 6F8537B7

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaise_memmovestd::exception::_
String ID:
API String ID: 163498487-0
Opcode ID: f1cf4fb1566943370da52b6ce947807d7bdcc2e8979c44beca23cb0fdae3c58f
Instruction ID: 92b3e8c2f3d90c4899d206d3825eb016428715b81779f26e8570736452b156ed
Opcode Fuzzy Hash: f1cf4fb1566943370da52b6ce947807d7bdcc2e8979c44beca23cb0fdae3c58f
Instruction Fuzzy Hash: 404176B5E00615EBCB08CF6CC85199EB7F6FB45214B144ABEE8159B780E731BD24CBA1

Function 6F857B10 Relevance: 4.5, APIs: 3, Instructions: 45COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000000,?,6F85140B), ref: 6F857B1C
GetLastError.KERNEL32 ref: 6F857B53
GetLastError.KERNEL32 ref: 6F857B5A

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: ErrorLast$AttributesFile
String ID:
API String ID: 2642427456-0
Opcode ID: 8670eead17c27b264ed888f4ec96fe281b731d30b1db48b4fa4ca6a39e1b2035
Instruction ID: b7c893a248e3dfd02358b296b5a7ae078f2d7a5dc3a14c6f71d426e54eddc0ed
Opcode Fuzzy Hash: 8670eead17c27b264ed888f4ec96fe281b731d30b1db48b4fa4ca6a39e1b2035
Instruction Fuzzy Hash: E2F0443191492C8BDB949A68F4C068DB3F2AF46370B51DDDED1518F590C220BCE687D2

Function 6BB54FC0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6BB55034

Part of subcall function 6BB55110: std::_Xinvalid_argument.LIBCPMT ref: 6BB5512A

Strings

string too long, xrefs: 6BB5502F

Memory Dump Source

Source File: 0000000C.00000002.2569669714.000000006BB51000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BB50000, based on PE: true

Associated: 0000000C.00000002.2569337232.000000006BB50000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCC3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCD5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570976244.000000006BD35000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571057194.000000006BD3A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571109707.000000006BD42000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571273369.000000006BD48000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571319844.000000006BD4B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6bb50000_cpcsgui.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: string too long
API String ID: 909987262-2556327735
Opcode ID: 34af6fd3ce0488d698fac4ae15696df6b92319f147b32e299b28ff99d64f83be
Instruction ID: 4f1a3fcef081c08eb7cf085a229ad64f1792e317e4ebfa8436a8218470d5779b
Opcode Fuzzy Hash: 34af6fd3ce0488d698fac4ae15696df6b92319f147b32e299b28ff99d64f83be
Instruction Fuzzy Hash: 6431E4337106904FD3208E6CD890B5FF7EAEB95652B24492EF291C7240C7A59C6483F7

Function 6F87F140 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6F87F1AF

Part of subcall function 6F88F635: std::exception::exception.LIBCMT ref: 6F88F64A
Part of subcall function 6F88F635: __CxxThrowException@8.LIBCMT ref: 6F88F65F
Part of subcall function 6F88F635: std::exception::exception.LIBCMT ref: 6F88F670

Strings

vector<T> too long, xrefs: 6F87F1AA

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: vector<T> too long
API String ID: 1823113695-3788999226
Opcode ID: d7e749e71e5364681e0068c3cb38c06b362b5c2b80a64383f9065024044cdb2b
Instruction ID: 592860382e11ecc795974613c613b2c2483cbc6276956990cc9e37057b5ad962
Opcode Fuzzy Hash: d7e749e71e5364681e0068c3cb38c06b362b5c2b80a64383f9065024044cdb2b
Instruction Fuzzy Hash: 03214FB19006059FC714CF1DC981B5ABBF9EB58714F10896EE469CB754EB34A900CB90

Function 6BB86AE0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6BB86B4F

Part of subcall function 6BBB1303: std::exception::exception.LIBCMT ref: 6BBB1318
Part of subcall function 6BBB1303: __CxxThrowException@8.LIBCMT ref: 6BBB132D
Part of subcall function 6BBB1303: std::exception::exception.LIBCMT ref: 6BBB133E

Strings

vector<T> too long, xrefs: 6BB86B4A

Memory Dump Source

Source File: 0000000C.00000002.2569669714.000000006BB51000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BB50000, based on PE: true

Associated: 0000000C.00000002.2569337232.000000006BB50000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCC3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCD5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570976244.000000006BD35000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571057194.000000006BD3A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571109707.000000006BD42000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571273369.000000006BD48000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571319844.000000006BD4B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6bb50000_cpcsgui.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: vector<T> too long
API String ID: 1823113695-3788999226
Opcode ID: 37c83af7b1ea9962d73389e86f34013f5a57c8c5905a5b7355f708aa797c401d
Instruction ID: a268c53d818fa7f5494e45491dd570912f7cab70af68ac92f565f6419262cd16
Opcode Fuzzy Hash: 37c83af7b1ea9962d73389e86f34013f5a57c8c5905a5b7355f708aa797c401d
Instruction Fuzzy Hash: 14214DB2A00A059FC714CF6DC991B5ABBF9EF48714F10866EE55DCB750E778A900CBA0

Function 6F85CD90 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6F85CDB9

Part of subcall function 6F88F635: std::exception::exception.LIBCMT ref: 6F88F64A
Part of subcall function 6F88F635: __CxxThrowException@8.LIBCMT ref: 6F88F65F
Part of subcall function 6F88F635: std::exception::exception.LIBCMT ref: 6F88F670

Strings

vector<T> too long, xrefs: 6F85CDB4

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: vector<T> too long
API String ID: 1823113695-3788999226
Opcode ID: 52d4e70fbcbfec814a59d2ec4b7410f7a15f7745abb2647f7706fb53cb478330
Instruction ID: 3fd274f939d713da8f7f0f0985b6c414af0fb2b4f4c973be9d22462ba13cbd94
Opcode Fuzzy Hash: 52d4e70fbcbfec814a59d2ec4b7410f7a15f7745abb2647f7706fb53cb478330
Instruction Fuzzy Hash: C1F0B433F000311B8368887DCD9508ABD576AC532D35E8AB6E958FF386ED31EC2159D0

Function 6BB584C0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6BB584E9

Part of subcall function 6BBB1303: std::exception::exception.LIBCMT ref: 6BBB1318
Part of subcall function 6BBB1303: __CxxThrowException@8.LIBCMT ref: 6BBB132D
Part of subcall function 6BBB1303: std::exception::exception.LIBCMT ref: 6BBB133E

Strings

vector<T> too long, xrefs: 6BB584E4

Memory Dump Source

Source File: 0000000C.00000002.2569669714.000000006BB51000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BB50000, based on PE: true

Associated: 0000000C.00000002.2569337232.000000006BB50000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCC3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCD5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570976244.000000006BD35000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571057194.000000006BD3A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571109707.000000006BD42000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571273369.000000006BD48000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571319844.000000006BD4B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6bb50000_cpcsgui.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: vector<T> too long
API String ID: 1823113695-3788999226
Opcode ID: e7f96d9c7a706b68d126e30672a2adbe0a7fd6e2747c3c839a1f437ce7a5b187
Instruction ID: c8f89d3c9faf087964a0fd44f9e15d0f4e7fe68f4a8b86cae4aa12a43d23169b
Opcode Fuzzy Hash: e7f96d9c7a706b68d126e30672a2adbe0a7fd6e2747c3c839a1f437ce7a5b187
Instruction Fuzzy Hash: ACF0F023F100300BC324893DEC9209EA59B6AC432935EC272EA88EF744FD39ED1141D2

Function 005B8390 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 005B83B9

Part of subcall function 005E6ABC: std::exception::exception.LIBCMT ref: 005E6AD1
Part of subcall function 005E6ABC: __CxxThrowException@8.LIBCMT ref: 005E6AE6
Part of subcall function 005E6ABC: std::exception::exception.LIBCMT ref: 005E6AF7

Strings

vector<T> too long, xrefs: 005B83B4

Memory Dump Source

Source File: 0000000C.00000002.2567833069.00000000005B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 005B0000, based on PE: true

Associated: 0000000C.00000002.2567804101.00000000005B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2567917358.0000000000607000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2567985326.000000000061A000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2568018090.0000000000620000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b0000_cpcsgui.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: vector<T> too long
API String ID: 1823113695-3788999226
Opcode ID: 984ee764b94fff71502f5e700141cf2498c3734fdffaf7c906ab4529d8081c71
Instruction ID: 65e6039315dc54c4db28b0dd24d6ba2f1c370e0881cc11b27495aa0e501ce961
Opcode Fuzzy Hash: 984ee764b94fff71502f5e700141cf2498c3734fdffaf7c906ab4529d8081c71
Instruction Fuzzy Hash: 59F0C237F001310B8318D43D8C844AEBD8AB6D5B5531A9A35E859EB386EC22FC4182D0

Function 6BB8F7B0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6BB8F7D7

Part of subcall function 6BBB1303: std::exception::exception.LIBCMT ref: 6BBB1318
Part of subcall function 6BBB1303: __CxxThrowException@8.LIBCMT ref: 6BBB132D
Part of subcall function 6BBB1303: std::exception::exception.LIBCMT ref: 6BBB133E

Strings

vector<T> too long, xrefs: 6BB8F7D2

Memory Dump Source

Source File: 0000000C.00000002.2569669714.000000006BB51000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BB50000, based on PE: true

Associated: 0000000C.00000002.2569337232.000000006BB50000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCC3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCD5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570976244.000000006BD35000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571057194.000000006BD3A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571109707.000000006BD42000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571273369.000000006BD48000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571319844.000000006BD4B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6bb50000_cpcsgui.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: vector<T> too long
API String ID: 1823113695-3788999226
Opcode ID: 224b506efe771253244cc5c745e1cd7d8d256c122129871eed6ca5b9ba4c5caf
Instruction ID: 2207902efbad156d5b2330fbaade1fd179d6990f92a23965f726ed01fedc1ec3
Opcode Fuzzy Hash: 224b506efe771253244cc5c745e1cd7d8d256c122129871eed6ca5b9ba4c5caf
Instruction Fuzzy Hash: 44F05437F040615F8314953DAD4548FAAD79AD13543AACA71D948DF289E939EC4251D0

Function 6F88BA50 Relevance: 3.2, APIs: 2, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 6F8907C7: _malloc.LIBCMT ref: 6F8907E1

std::exception::exception.LIBCMT ref: 6F88BC49
__CxxThrowException@8.LIBCMT ref: 6F88BC60

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID:
API String ID: 4063778783-0
Opcode ID: 34c8d40de5cbe33d7b6cf894860efdb3407ae702ba66af720459b56dbdcc048e
Instruction ID: 04ee870731447d69130bb88ee4393e204bdff83b78c023eb72c3c7c81f99ec9f
Opcode Fuzzy Hash: 34c8d40de5cbe33d7b6cf894860efdb3407ae702ba66af720459b56dbdcc048e
Instruction Fuzzy Hash: 78519D705087458BD718CF29C88065ABBE0FB8A314F408EBEE5668F295D735E946CF82

Function 6BB93AB0 Relevance: 3.2, APIs: 2, Instructions: 164COMMON

Download Yara Rule

APIs

Part of subcall function 6BB9B5AB: _malloc.LIBCMT ref: 6BB9B5C5

std::exception::exception.LIBCMT ref: 6BB93CA8
__CxxThrowException@8.LIBCMT ref: 6BB93CBF

Memory Dump Source

Source File: 0000000C.00000002.2569669714.000000006BB51000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BB50000, based on PE: true

Associated: 0000000C.00000002.2569337232.000000006BB50000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCC3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCD5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570976244.000000006BD35000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571057194.000000006BD3A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571109707.000000006BD42000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571273369.000000006BD48000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571319844.000000006BD4B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6bb50000_cpcsgui.jbxd

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID:
API String ID: 4063778783-0
Opcode ID: 985cdbef5a18817e4ee6c18f87b2972b56b3d576d0c6af6d7977c46369338a66
Instruction ID: f70a1312f8cb1811352a5391ba1348d455cabfe6504ea9cb98e38751d518ce8c
Opcode Fuzzy Hash: 985cdbef5a18817e4ee6c18f87b2972b56b3d576d0c6af6d7977c46369338a66
Instruction Fuzzy Hash: 4D5190B15087C5CBD720EF28E49065ABBF0FB4A718F408A7EE56AC7250D779C545CB82

Function 6BB52200 Relevance: 3.1, APIs: 2, Instructions: 115COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 6BB522A0

Part of subcall function 6BB9AF37: std::exception::_Copy_str.LIBCMT ref: 6BB9AF52

__CxxThrowException@8.LIBCMT ref: 6BB522B5

Part of subcall function 6BB9CC0F: RaiseException.KERNEL32(6BB522BA,?,7BDC3733,6BCC387C,6BB522BA,?,6BD2AAA8,?,7BDC3733), ref: 6BB9CC51

Part of subcall function 6BB52380: std::exception::exception.LIBCMT ref: 6BB523B6
Part of subcall function 6BB52380: __CxxThrowException@8.LIBCMT ref: 6BB523CD

Memory Dump Source

Source File: 0000000C.00000002.2569669714.000000006BB51000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BB50000, based on PE: true

Associated: 0000000C.00000002.2569337232.000000006BB50000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCC3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCD5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570976244.000000006BD35000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571057194.000000006BD3A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571109707.000000006BD42000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571273369.000000006BD48000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571319844.000000006BD4B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6bb50000_cpcsgui.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_
String ID:
API String ID: 1430062303-0
Opcode ID: cd326bf8eab209146802df72b6005e933ea305c4aa67a448b8df6318313cea2d
Instruction ID: fc37525dbf2c670095e42c7dfce78b148cabf6ba6da708732aebd08b1ec98012
Opcode Fuzzy Hash: cd326bf8eab209146802df72b6005e933ea305c4aa67a448b8df6318313cea2d
Instruction Fuzzy Hash: 0741E876A01549ABCB04DFA8C8916AEF7F5FF49310F10426EE816D7740E739A910CBE2

Function 6BB55370 Relevance: 3.1, APIs: 2, Instructions: 113COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 6BB55409

Part of subcall function 6BB9AF37: std::exception::_Copy_str.LIBCMT ref: 6BB9AF52

__CxxThrowException@8.LIBCMT ref: 6BB5541E

Part of subcall function 6BB9CC0F: RaiseException.KERNEL32(6BB522BA,?,7BDC3733,6BCC387C,6BB522BA,?,6BD2AAA8,?,7BDC3733), ref: 6BB9CC51

Part of subcall function 6BB56030: std::exception::exception.LIBCMT ref: 6BB56060
Part of subcall function 6BB56030: __CxxThrowException@8.LIBCMT ref: 6BB56077

Memory Dump Source

Source File: 0000000C.00000002.2569669714.000000006BB51000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BB50000, based on PE: true

Associated: 0000000C.00000002.2569337232.000000006BB50000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCC3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCD5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570976244.000000006BD35000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571057194.000000006BD3A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571109707.000000006BD42000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571273369.000000006BD48000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571319844.000000006BD4B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6bb50000_cpcsgui.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_
String ID:
API String ID: 1430062303-0
Opcode ID: abafc37c8e26f388ffc77e1c9c7852aa2b45508ed7243246d0f3b90276a93a20
Instruction ID: c1c31c67198fbebe6f8da2ddb794a536a1c6088fe891231821aabfb63fef16a3
Opcode Fuzzy Hash: abafc37c8e26f388ffc77e1c9c7852aa2b45508ed7243246d0f3b90276a93a20
Instruction Fuzzy Hash: F441FAB2D00285ABD704DF78D8917DEBBF5EF05361F104229E91A97380D778A950CBE2

Function 6F858200 Relevance: 3.1, APIs: 2, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 6F8583C0: std::_Xinvalid_argument.LIBCPMT ref: 6F8583DC
Part of subcall function 6F8583C0: _memmove.LIBCMT ref: 6F85844C
Part of subcall function 6F8583C0: _memmove.LIBCMT ref: 6F858471

std::exception::exception.LIBCMT ref: 6F8582C3

Part of subcall function 6F890109: std::exception::_Copy_str.LIBCMT ref: 6F890124

__CxxThrowException@8.LIBCMT ref: 6F8582DA

Part of subcall function 6F8924F0: RaiseException.KERNEL32(6F853778,?,D0A01E50,6F8B13C0,6F853778,?,6F8BD3C8,80000002,D0A01E50), ref: 6F892532

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: _memmove$Copy_strExceptionException@8RaiseThrowXinvalid_argumentstd::_std::exception::_std::exception::exception
String ID:
API String ID: 518014629-0
Opcode ID: 570992f176a529342eb67380c8ed7cf75b771208ba124328eea53a3a235eef75
Instruction ID: 282acb5ee3bf8c166d03fd7eb324e8f622dde25d02a237a81637448b29789ac4
Opcode Fuzzy Hash: 570992f176a529342eb67380c8ed7cf75b771208ba124328eea53a3a235eef75
Instruction Fuzzy Hash: DD2145B5508B51AFC704CF18C480A46BBF4FB88714F008A9EE8998B745E735E955CFA2

Function 6F861FF0 Relevance: 3.0, APIs: 2, Instructions: 50COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.KERNELBASE(?,?,?,?,?,6F861F0D,D0A01E50,?,?,?,?), ref: 6F862003
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?), ref: 6F862030

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: FileInfoVersion$Size
String ID:
API String ID: 2104008232-0
Opcode ID: 5e0bdba6dd19197956e44fab8bd2c13de4ea2d8f0b89d188887d5719e9199be6
Instruction ID: 573addc9b2b7020bdd3f364cb6b305f7ff687c9d385a285ae8448303688cea6a
Opcode Fuzzy Hash: 5e0bdba6dd19197956e44fab8bd2c13de4ea2d8f0b89d188887d5719e9199be6
Instruction Fuzzy Hash: A6F0C273206A10ABDF149A69AC88A8737A8EFC577672005FAF902CE240E724D410C3B3

Function 6BB70D30 Relevance: 3.0, APIs: 2, Instructions: 50COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.KERNELBASE(?,?,?,?,?,6BB70C4D,7BDC3733,?,?,?,?,?), ref: 6BB70D43
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 6BB70D70

Memory Dump Source

Source File: 0000000C.00000002.2569669714.000000006BB51000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BB50000, based on PE: true

Associated: 0000000C.00000002.2569337232.000000006BB50000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCC3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCD5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570976244.000000006BD35000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571057194.000000006BD3A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571109707.000000006BD42000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571273369.000000006BD48000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571319844.000000006BD4B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6bb50000_cpcsgui.jbxd

Similarity

API ID: FileInfoVersion$Size
String ID:
API String ID: 2104008232-0
Opcode ID: c4ce87619928403e69879199be3818451c2544daae355f5f4de34182dc17f578
Instruction ID: 260c7b6c45feb9301bfca9b2aee4b766d9e79a42d2d7ea9d081803b4074bad05
Opcode Fuzzy Hash: c4ce87619928403e69879199be3818451c2544daae355f5f4de34182dc17f578
Instruction Fuzzy Hash: D3F04C727022515BDB306A68BC84E8B7368EBC127771001BBFC06C6100D725E40083B2

Function 6F85CF60 Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 6F85CF99
__CxxThrowException@8.LIBCMT ref: 6F85CFB0

Part of subcall function 6F8907C7: _malloc.LIBCMT ref: 6F8907E1

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID:
API String ID: 4063778783-0
Opcode ID: 91216add9b63ef068710b857ccf77ac4748ad8c0e30aee52fba01b69a9b2559c
Instruction ID: 99423db885f413a39320389f26e410417ff80374c0809891e61c5334f7d7af2b
Opcode Fuzzy Hash: 91216add9b63ef068710b857ccf77ac4748ad8c0e30aee52fba01b69a9b2559c
Instruction Fuzzy Hash: DFE0657550470177F74CAA798C126ABB6E09F8415CF405CADE855CA245F778D2198A43

Function 6BB58690 Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 6BB586C9
__CxxThrowException@8.LIBCMT ref: 6BB586E0

Part of subcall function 6BB9B5AB: _malloc.LIBCMT ref: 6BB9B5C5

Memory Dump Source

Source File: 0000000C.00000002.2569669714.000000006BB51000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BB50000, based on PE: true

Associated: 0000000C.00000002.2569337232.000000006BB50000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCC3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCD5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570976244.000000006BD35000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571057194.000000006BD3A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571109707.000000006BD42000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571273369.000000006BD48000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571319844.000000006BD4B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6bb50000_cpcsgui.jbxd

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID:
API String ID: 4063778783-0
Opcode ID: fdaf93055cddc58fd58c3204e26d2b1b931b5d52f685c2be421d0571596ec803
Instruction ID: 144e6a494e9260f96f58b744bb39e25040823d80c3d5189581bb4f0ee2c34d4c
Opcode Fuzzy Hash: fdaf93055cddc58fd58c3204e26d2b1b931b5d52f685c2be421d0571596ec803
Instruction Fuzzy Hash: 6EE0EDB251424116F708FBB4DD137AF76A0CF8829CF40886DE8A9C2200FB3CC1188A93

Function 6F87F8C0 Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 6F87F8F7
__CxxThrowException@8.LIBCMT ref: 6F87F90E

Part of subcall function 6F8907C7: _malloc.LIBCMT ref: 6F8907E1

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID:
API String ID: 4063778783-0
Opcode ID: 18c776609b3c903100a2d59b5dd3c7e4403efe7884c9a3a6a8240a2a2c050d9b
Instruction ID: b139fb2cf925107ec4241214d4437a4d004daa85cab61e1eccb0abf94687c17d
Opcode Fuzzy Hash: 18c776609b3c903100a2d59b5dd3c7e4403efe7884c9a3a6a8240a2a2c050d9b
Instruction Fuzzy Hash: C6E022751043017AE318EB69CC11BAFB2E0AFA0318F808CECE855CA354FB3CD2098A43

Function 6BB87060 Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 6BB87097
__CxxThrowException@8.LIBCMT ref: 6BB870AE

Part of subcall function 6BB9B5AB: _malloc.LIBCMT ref: 6BB9B5C5

Memory Dump Source

Source File: 0000000C.00000002.2569669714.000000006BB51000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BB50000, based on PE: true

Associated: 0000000C.00000002.2569337232.000000006BB50000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCC3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCD5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570976244.000000006BD35000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571057194.000000006BD3A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571109707.000000006BD42000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571273369.000000006BD48000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571319844.000000006BD4B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6bb50000_cpcsgui.jbxd

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID:
API String ID: 4063778783-0
Opcode ID: 2c9d3e2cd06778711d48735d95a0af776d2ad5bf5f6628ea1af0a3cf6a29a23d
Instruction ID: 690a986e9af3a591bcfea443b30f85caafbac5384923118a93754c428d3087a9
Opcode Fuzzy Hash: 2c9d3e2cd06778711d48735d95a0af776d2ad5bf5f6628ea1af0a3cf6a29a23d
Instruction Fuzzy Hash: AEE02BB15042415FE300FBB1DD127AE72E1DF54398F4488BCD458C2110F7BCC1198663

Function 005EC99C Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 005EC9A4

Part of subcall function 005EC971: GetModuleHandleW.KERNEL32(mscoree.dll,?,005EC9A9,00000000,?,005EA016,000000FF,0000001E,00000001,00000000,00000000,?,005EB2F9,00000000,00000001,00000000), ref: 005EC97B
Part of subcall function 005EC971: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 005EC98B

ExitProcess.KERNEL32 ref: 005EC9AD

Memory Dump Source

Source File: 0000000C.00000002.2567833069.00000000005B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 005B0000, based on PE: true

Associated: 0000000C.00000002.2567804101.00000000005B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2567917358.0000000000607000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2567985326.000000000061A000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2568018090.0000000000620000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b0000_cpcsgui.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: cf34de41a7cdcfe487ebff477d3ba3e4450f27eb88fe4293572db0f6a05ecf53
Instruction ID: b200264f7dec46e5754d10f80bc4b6bfde4da71f9fed16c729b9805e244345e8
Opcode Fuzzy Hash: cf34de41a7cdcfe487ebff477d3ba3e4450f27eb88fe4293572db0f6a05ecf53
Instruction Fuzzy Hash: 11B0923200824CBBCB052F22DC0E85A3F2AFB813A0B544020F80849072DF72FD93DA80

Function 6F8623C0 Relevance: 2.6, APIs: 2, Instructions: 57COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,0000000F,000000FF,00000000,00000000,?,00000000,?,6F8621F9,?,D0A01E50,0000000F,?,?), ref: 6F8623DB
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,0000000F,000000FF,00000000,00000000,0000000F,?,?,?,?,D0A01E50,?,00000000), ref: 6F862412

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: d202a1fcd863798443bbca3e44a158c8f114f6997f23cfc1667982440701c8f1
Instruction ID: 86fc81ead80e644198aa9642fabeaecc2f34e2f163bcaa7ed25839e6e1ec0cb9
Opcode Fuzzy Hash: d202a1fcd863798443bbca3e44a158c8f114f6997f23cfc1667982440701c8f1
Instruction Fuzzy Hash: D8F0F47738671137D620167EAC42F6BB388CB85771F2407B7F625DE5C0EA12E41052A1

Function 6F857A20 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32 ref: 6F857A4B

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: eeed9b2542e2630b22d4c5d3877a7d5414e3fc6e5347299f48ddb769f7a10f0c
Instruction ID: d3c9b017dbcedfc3071c5d421ef22a8e5467cbe5405d2b5883d161556ff19e62
Opcode Fuzzy Hash: eeed9b2542e2630b22d4c5d3877a7d5414e3fc6e5347299f48ddb769f7a10f0c
Instruction Fuzzy Hash: C511E170610704ABD324DF28C806BEBB3E9AF84314F444A59E44ACF2D0E7B4AA4487D2

Function 005ECBF4 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 005ECC00

Part of subcall function 005ECAB4: __lock.LIBCMT ref: 005ECAC2

Memory Dump Source

Source File: 0000000C.00000002.2567833069.00000000005B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 005B0000, based on PE: true

Associated: 0000000C.00000002.2567804101.00000000005B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2567917358.0000000000607000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2567985326.000000000061A000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000C.00000002.2568018090.0000000000620000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5b0000_cpcsgui.jbxd

Similarity

API ID: __lock_doexit
String ID:
API String ID: 368792745-0
Opcode ID: b7f9ddcf0c01e83a82a0f1c6c29853ea6c7db7599a0eb0d3eddd439c3244ce42
Instruction ID: 2abf5c676588a210c706e86e5d16de56b94967b3098b1296718a2c20484e0ec2
Opcode Fuzzy Hash: b7f9ddcf0c01e83a82a0f1c6c29853ea6c7db7599a0eb0d3eddd439c3244ce42
Instruction Fuzzy Hash: F0B0923258024C33DA202542AC07F0A3E1A97C0B60E240021BA0C192A1A9A2A9628089

Function 6BB9C7BB Relevance: 1.5, APIs: 1, Instructions: 6COMMONLIBRARYCODE

Download Yara Rule

APIs

_doexit.LIBCMT ref: 6BB9C7C1

Part of subcall function 6BB9C64F: __lock.LIBCMT ref: 6BB9C65D

Memory Dump Source

Source File: 0000000C.00000002.2569669714.000000006BB51000.00000020.00000001.01000000.00000015.sdmp, Offset: 6BB50000, based on PE: true

Associated: 0000000C.00000002.2569337232.000000006BB50000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCC3000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570467871.000000006BCD5000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2570976244.000000006BD35000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571057194.000000006BD3A000.00000008.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571109707.000000006BD42000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571273369.000000006BD48000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000C.00000002.2571319844.000000006BD4B000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6bb50000_cpcsgui.jbxd

Similarity

API ID: __lock_doexit
String ID:
API String ID: 368792745-0
Opcode ID: 61cc1048c9adf6bbef98f44e7947428adfb5ecee68712f559f8c60e7f46661f4
Instruction ID: 44a784effb527a941d77492570b118a76a8311b4affb96ed49f64a8054185212
Opcode Fuzzy Hash: 61cc1048c9adf6bbef98f44e7947428adfb5ecee68712f559f8c60e7f46661f4
Instruction Fuzzy Hash: 3BA00265BD434425F8A465683C57F5835011751F05FD41060BB082D1C0A5CA52584057

Function 6F86B040 Relevance: 1.3, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,D0A01E50,00000007,00000008), ref: 6F86B0C5

Part of subcall function 6F853210: _memmove.LIBCMT ref: 6F853248

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: CriticalInitializeSection_memmove
String ID:
API String ID: 1595129083-0
Opcode ID: 77b6c3d6d787636dc8640cd82e9b2b1dd172f7101751a81c5c0dbd34de5d4ed5
Instruction ID: 399a3b399293787e37fc3e543ce3e4fb1a56c415af03130b01739af99a1b2abd
Opcode Fuzzy Hash: 77b6c3d6d787636dc8640cd82e9b2b1dd172f7101751a81c5c0dbd34de5d4ed5
Instruction Fuzzy Hash: FE3114B19087889FCB44CF29C90068ABBE4FF89718F404A6EF959C7350E7359804CF96

Non-executed Functions

Function 6F854C50 Relevance: 63.4, APIs: 6, Strings: 30, Instructions: 357timeCOMMON

Download Yara Rule

APIs

_swscanf.LIBCMT ref: 6F854F93
GetLocalTime.KERNEL32(?), ref: 6F854FAE
_swscanf.LIBCMT ref: 6F854FED
_swscanf.LIBCMT ref: 6F85502A
_ScheduleTask@16.MBAM(00000000,00000000,?,?), ref: 6F855052
_UnscheduleTask@16.MBAM(00000000,00000000,?,?), ref: 6F855072

Strings

/realtime, xrefs: 6F854C81
-xml, xrefs: 6F854F12
/every , xrefs: 6F854FCD
/scan -full, xrefs: 6F854E20
/monthly, xrefs: 6F854DA3
/all, xrefs: 6F854D22
%hu/%hu/%hu %hu:%hu:%hu, xrefs: 6F854F8D
-terminate, xrefs: 6F854ECA
/onreboot, xrefs: 6F854DD5
/starting , xrefs: 6F854F48
/wakefromsleep, xrefs: 6F854E82
/update, xrefs: 6F854DEC
/random, xrefs: 6F854E9A
/unschedule, xrefs: 6F854CA3
-remove, xrefs: 6F854EB2
-reboot, xrefs: 6F854EE2
/scan -quick, xrefs: 6F854E06
/silent, xrefs: 6F854E6A
/all -update, xrefs: 6F854CF0
/recover , xrefs: 6F855002
/xml, xrefs: 6F854F2A
/daily, xrefs: 6F854D71
/weekly, xrefs: 6F854D8A
-log, xrefs: 6F854EFA
/once, xrefs: 6F854DBC
/all -scan, xrefs: 6F854CB9
/hourly, xrefs: 6F854D58
/flash, xrefs: 6F854E52
/schedule, xrefs: 6F854C6A
/scan -flash, xrefs: 6F854E3A

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: _swscanf$Task@16$LocalScheduleTimeUnschedule
String ID: -log$ -reboot$ -remove$ -terminate$ -xml$ /all$ /all -scan$ /all -update$ /daily$ /every $ /flash$ /hourly$ /monthly$ /once$ /onreboot$ /random$ /realtime$ /recover $ /scan -flash$ /scan -full$ /scan -quick$ /silent$ /starting $ /update$ /wakefromsleep$ /weekly$ /xml$%hu/%hu/%hu %hu:%hu:%hu$/schedule$/unschedule
API String ID: 2320526193-207438677
Opcode ID: 24f8235c006eb11f531de92368777d49d3e17b9e23910fc7cc2c4c3429f18276
Instruction ID: f58f9cd45e14a76bb28cd95922ecf067271e8e98d7f77aa0b3fe3531fd62edde
Opcode Fuzzy Hash: 24f8235c006eb11f531de92368777d49d3e17b9e23910fc7cc2c4c3429f18276
Instruction Fuzzy Hash: 87A1A4B390530037EB849A7D5C52F9B7298AFD5219F040DBAFD54AD381EB25E13482E6

Function 6F86FAA0 Relevance: 21.3, APIs: 2, Strings: 10, Instructions: 309COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 6F86FC33

Part of subcall function 6F853280: std::_Xinvalid_argument.LIBCPMT ref: 6F853298

ExitProcess.KERNEL32 ref: 6F86FF21

Strings

/uninstall, xrefs: 6F86FE36
exitpm, xrefs: 6F86FC3C
arguments, xrefs: 6F86FE56
exit, xrefs: 6F86FF03
command, xrefs: 6F86FCC4
messaging\actions\, xrefs: 6F86FAEB
path, xrefs: 6F86FD9A
open, xrefs: 6F86FC2D
link, xrefs: 6F86FC0A
ExecuteMBAMCommand, xrefs: 6F86FC9E

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: ExecuteExitProcessShellXinvalid_argumentstd::_
String ID: /uninstall$ExecuteMBAMCommand$arguments$command$exit$exitpm$link$messaging\actions\$open$path
API String ID: 1620226084-2726402617
Opcode ID: 2fd8f6ca965a6cfa01a3beda4ad0d33c644db4a6dffea496c18fd306418ed73c
Instruction ID: 073c8dba1b1441c15f936bcd662678476a5c9d62a40b9d63c711122072248a66
Opcode Fuzzy Hash: 2fd8f6ca965a6cfa01a3beda4ad0d33c644db4a6dffea496c18fd306418ed73c
Instruction Fuzzy Hash: 61D149B1909780EBD720CF69C540B9BB7E5AF99704F404D5DE5898B381EB35A8048B93

Function 6F856A20 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 166filetimeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,0000001C,0000000C,Function_000031A0,?), ref: 6F856ABE
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 6F856B22
GetCurrentProcess.KERNEL32(00020008,?), ref: 6F856B3B
OpenProcessToken.ADVAPI32(00000000), ref: 6F856B42
GetTokenInformation.ADVAPI32(?,00000012(TokenIntegrityLevel),?,00000004,?), ref: 6F856B5F
CloseHandle.KERNEL32(?), ref: 6F856B6E
CloseHandle.KERNEL32(?), ref: 6F856B99
__aulldiv.LIBCMT ref: 6F856BE8

Strings

\rules.ref, xrefs: 6F856A47

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: CloseFileHandleProcessTimeToken$CreateCurrentInformationOpenSystem__aulldiv
String ID: \rules.ref
API String ID: 47722894-2077845452
Opcode ID: c82c33641473e8637d9810e1fd5311ae8af96630351b0d21c6a32c9b5c95a5a0
Instruction ID: 9d2d1d3d6e6cbaf3e26e7f3d174b5f9b03b3f7d8099331ecbbd1734b9ee04f96
Opcode Fuzzy Hash: c82c33641473e8637d9810e1fd5311ae8af96630351b0d21c6a32c9b5c95a5a0
Instruction Fuzzy Hash: AD51C571608300ABDB54DB78D885A9FB3E5EB85765F000DAEF5498B190DB30E958CB93

Function 6F85FAE0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(000F01FF,D0A01E50,?,?,?,6F873D6F,D0A01E50,?,D0A01E50,75090460,750A49C0), ref: 6F85FAF7
OpenProcessToken.ADVAPI32(00000000,?,?,?,6F873D6F,D0A01E50,?,D0A01E50,75090460,750A49C0), ref: 6F85FAFE
LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 6F85FB14
CloseHandle.KERNEL32(?,?,?,?,6F873D6F,D0A01E50,?,D0A01E50,75090460,750A49C0), ref: 6F85FB22
AdjustTokenPrivileges.ADVAPI32 ref: 6F85FB6B
CloseHandle.KERNEL32 ref: 6F85FB79
CloseHandle.KERNEL32 ref: 6F85FB94

Strings

SeDebugPrivilege, xrefs: 6F85FB0D

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: CloseHandle$ProcessToken$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 1280518032-2896544425
Opcode ID: e9cd4ea85900086a96d0db6e1a18036786e1cf93c7a9c4a5a0b4773403824a86
Instruction ID: 1d3686ea81bc25efd11b106741c27476b8e841cc54163c7b3aa3332b4fcfb02b
Opcode Fuzzy Hash: e9cd4ea85900086a96d0db6e1a18036786e1cf93c7a9c4a5a0b4773403824a86
Instruction Fuzzy Hash: DB114AB0608700AFCB08DF75C85AB5BB7E5BF88704F804D8CF09A8A280E774E555DB96

Function 6F869C00 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 366encryptionCOMMON

Download Yara Rule

APIs

CryptGenRandom.ADVAPI32(00000000,00000100,?,D0A01E50,?,?), ref: 6F869C6A

Strings

\salt, xrefs: 6F869D55
\password, xrefs: 6F869EE7
passwords\, xrefs: 6F869D3C, 6F869ECE, 6F86A05D
\algorithm, xrefs: 6F86A076
local, xrefs: 6F869D21, 6F869EB8, 6F86A043
whirlpool, xrefs: 6F86A01C

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: CryptRandom
String ID: \algorithm$\password$\salt$local$passwords\$whirlpool
API String ID: 2662593985-3942015599
Opcode ID: 71cf23d321490212fad8545bf3238020ce86ea2cee9720794ece29c14c89a863
Instruction ID: 0d7d5208fa02a1bcb1a7474de3a4e56351b32bfaaa36096d6ac4d52dc125c489
Opcode Fuzzy Hash: 71cf23d321490212fad8545bf3238020ce86ea2cee9720794ece29c14c89a863
Instruction Fuzzy Hash: 2EF115B09083819BD364CF69C480B9BF7E5AFD9708F004D6EE5998B391DBB49505CB93

Function 6F872930 Relevance: 9.1, APIs: 6, Instructions: 87servicesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 6F88EA00: GetVersionExW.KERNEL32(?,00000000,?,6F87117A), ref: 6F88EA09
Part of subcall function 6F88EA00: GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo,?,6F87117A), ref: 6F88EA1F
Part of subcall function 6F88EA00: GetProcAddress.KERNEL32(00000000), ref: 6F88EA28
Part of subcall function 6F88EA00: GetModuleHandleW.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,?,6F87117A), ref: 6F88EA46
Part of subcall function 6F88EA00: GetProcAddress.KERNEL32(00000000), ref: 6F88EA49
Part of subcall function 6F88EA00: GetModuleHandleW.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,?,6F87117A), ref: 6F88EA5B
Part of subcall function 6F88EA00: GetProcAddress.KERNEL32(00000000), ref: 6F88EA5E
Part of subcall function 6F88EA00: OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,?,6F87117A), ref: 6F88EAA0

ControlService.ADVAPI32(?,00000001,?,00000000), ref: 6F8729C7
DeleteService.ADVAPI32(?), ref: 6F8729DD
CloseServiceHandle.ADVAPI32(?), ref: 6F8729F4
Sleep.KERNEL32(00000064), ref: 6F872A03
CloseServiceHandle.ADVAPI32(?,00000000), ref: 6F872A15
CloseServiceHandle.ADVAPI32(?,00000000), ref: 6F872A2E

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Handle$Service$AddressCloseModuleProc$ControlDeleteManagerOpenSleepVersion
String ID:
API String ID: 3650110176-0
Opcode ID: e1c79e4a17f850faaae484880b83b8538640e0c9d827eefb46271a4aff7d7c85
Instruction ID: 3d9651262cdd47eda4ddb9c55a13a84e7e0844e89631e973af12519c2efbae35
Opcode Fuzzy Hash: e1c79e4a17f850faaae484880b83b8538640e0c9d827eefb46271a4aff7d7c85
Instruction Fuzzy Hash: 10314371618781ABDB30CB68C945BDBB3E8AB49714F004D5DE499DB280DF35E514CF92

Function 6F85E670 Relevance: 9.1, APIs: 6, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 6F85E400: CryptAcquireContextW.ADVAPI32(00000000,00000000,Microsoft Enhanced Cryptographic Provider v1.0,00000001,F0000040,00000001,?,00000000,D0A01E50,00000000,?,00000000,?,?,00000000), ref: 6F85E45E

CryptCreateHash.ADVAPI32(00000000,?,00000000,00000000,?,00000000,?), ref: 6F85E68A
CryptHashData.ADVAPI32(?,?,?,00000000,?,00000000,?), ref: 6F85E6A4
CryptDestroyHash.ADVAPI32(00000000,?,?,?,00000000,?,00000000,?), ref: 6F85E6B2
CryptGetHashParam.ADVAPI32(?,00000002,?,00000000,00000000,?,?,?,00000000,?,00000000,?), ref: 6F85E6D9
CryptDestroyHash.ADVAPI32(?,?,?,?,00000000,?,00000000,?), ref: 6F85E6E7
CryptDestroyHash.ADVAPI32(00000000,?,?,?,00000000,?,00000000,?), ref: 6F85E6F7

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Crypt$Hash$Destroy$AcquireContextCreateDataParam
String ID:
API String ID: 1709778380-0
Opcode ID: edb61ba26f8bb8ad6e272a29880ce2422f35d637e11145da50467091bafa4cdf
Instruction ID: 91a116a4bf47fa5ac5114aa55cd5b8c3c8f10f97fe74540b5018dd500d4f9bdc
Opcode Fuzzy Hash: edb61ba26f8bb8ad6e272a29880ce2422f35d637e11145da50467091bafa4cdf
Instruction Fuzzy Hash: EE112AB4608701AFEB14EF60DC49F5A77E8AB89750F804888B594CB280E634E419CBA2

Function 6F852420 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 206COMMON

Download Yara Rule

APIs

Part of subcall function 6F85B0B0: GetCommandLineW.KERNEL32 ref: 6F85B109

_PasswordMatches@4.MBAM(?,/setpassword), ref: 6F852522
_PasswordSet@4.MBAM(?,/setpassword), ref: 6F85258A
_PasswordMatches@4.MBAM(?,/clearpassword,/setpassword), ref: 6F85267C

Strings

/clearpassword, xrefs: 6F8525E0
/setpassword, xrefs: 6F85244F

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Password$Matches@4$CommandLineSet@4
String ID: /clearpassword$/setpassword
API String ID: 4275981024-1545071088
Opcode ID: a65d05133b19e24efef828afedf1abe509de34bcb2a4b9c9cf71c8d53653515c
Instruction ID: ad5c3c0f02488462ba5e0128ccd655aeab96ebb7cf5184785d81e92609b9db34
Opcode Fuzzy Hash: a65d05133b19e24efef828afedf1abe509de34bcb2a4b9c9cf71c8d53653515c
Instruction Fuzzy Hash: DF714AB2908344DBD784DF29C94095BB6E5BFC5308F040EAEF5959B290EB39E919CB43

Function 6F89ADCC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00000000,00000002,?,?,6F89B409,?,6F89144D,?,000000BC,?,00000001,00000000,00000000), ref: 6F89AE0B
GetLocaleInfoW.KERNEL32(?,20001004,00000000,00000002,?,?,6F89B409,?,6F89144D,?,000000BC,?,00000001,00000000,00000000), ref: 6F89AE34
GetACP.KERNEL32(?,?,6F89B409,?,6F89144D,?,000000BC,?,00000001,00000000), ref: 6F89AE48

Strings

OCP, xrefs: 6F89ADEC
ACP, xrefs: 6F89ADDB

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 87aaf2d327816f7d5f663c43b23f979b690cac302f93ae67fc047bd553b90c94
Instruction ID: 5271af24d26fc9b143d54e4a9d840f7f9f6852677b22f6ab31ce1537494c53f5
Opcode Fuzzy Hash: 87aaf2d327816f7d5f663c43b23f979b690cac302f93ae67fc047bd553b90c94
Instruction Fuzzy Hash: 9901D431E05A0ABAEB15AAADD805B8F77E8EF01369F1048D9E501ED180EB30EA51C254

Function 6F890061 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6F894822
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6F894837
UnhandledExceptionFilter.KERNEL32(6F8B1E38), ref: 6F894842
GetCurrentProcess.KERNEL32(C0000409), ref: 6F89485E
TerminateProcess.KERNEL32(00000000), ref: 6F894865

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 16deaff9ed1c76e7c5c21276604c61b3dbe4a7361b9f2d9cbe9f474145297fb8
Instruction ID: a9da9954a7f9e649c9d508802e172cec78ede6b2aa49c9d22c575de991c44445
Opcode Fuzzy Hash: 16deaff9ed1c76e7c5c21276604c61b3dbe4a7361b9f2d9cbe9f474145297fb8
Instruction Fuzzy Hash: BF21CCB8A02A08DFDF01DF2AC449A843FE4FB4A768F4055DAE4198B748E77054A5CF95

Function 6F88DAB0 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 457COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6F88DD9F
std::_Xinvalid_argument.LIBCPMT ref: 6F88DDA9

Part of subcall function 6F856840: _memmove.LIBCMT ref: 6F856935

Strings

invalid unicode: , xrefs: 6F88DD32
string too long, xrefs: 6F88DDA4

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: invalid unicode: $string too long
API String ID: 3247205923-254660679
Opcode ID: 1859f9ea552a2c10282a6742c927cfd7d0d6184e5d9b517493547ca7f1c96ae7
Instruction ID: d014daf1a34c8e2b1cb2f55db25339fd15ef3b34c962c3085e1c826825404b11
Opcode Fuzzy Hash: 1859f9ea552a2c10282a6742c927cfd7d0d6184e5d9b517493547ca7f1c96ae7
Instruction Fuzzy Hash: 8E1228B29083809BD771CB68C840BCFB7E6ABD9704F044D6EE59E5B281DB71A544CB93

Function 6F86E690 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

_swscanf.LIBCMT ref: 6F86E77B

Strings

%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x, xrefs: 6F86E775
0123456789ABCDEFGHJKLMNPQRTUVWXY, xrefs: 6F86E7E2
%wc%wc%wc%wc-%wc%wc%wc%wc-%wc%wc%wc%wc-%wc%wc%wc%wc, xrefs: 6F86E910

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: _swscanf
String ID: %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x$%wc%wc%wc%wc-%wc%wc%wc%wc-%wc%wc%wc%wc-%wc%wc%wc%wc$0123456789ABCDEFGHJKLMNPQRTUVWXY
API String ID: 2748852333-3380361984
Opcode ID: b61a93f5056f63c78898777a87b8678bdbcb59751eac0420a918992ad25341c1
Instruction ID: e465f10e826f61202eb01ae45465b6690878d455f8a576a5c82ecdaa8905b133
Opcode Fuzzy Hash: b61a93f5056f63c78898777a87b8678bdbcb59751eac0420a918992ad25341c1
Instruction Fuzzy Hash: F891BFB260C7409AC325CF69D840AABB7E7AFC8700F088D5EF5D58A250D774E558CB67

Function 6F852ED0 Relevance: 6.2, APIs: 4, Instructions: 214encryptionCOMMON

Download Yara Rule

APIs

CryptGenRandom.ADVAPI32(00000000,00000004,?,?,?), ref: 6F852F45
_wcstoul.LIBCMT ref: 6F852FD3
CryptGenRandom.ADVAPI32(00000000,00000004,?), ref: 6F853003
CryptGenRandom.ADVAPI32(00000000,00000004,?), ref: 6F8530A2

Part of subcall function 6F85E400: CryptAcquireContextW.ADVAPI32(00000000,00000000,Microsoft Enhanced Cryptographic Provider v1.0,00000001,F0000040,00000001,?,00000000,D0A01E50,00000000,?,00000000,?,?,00000000), ref: 6F85E45E

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Crypt$Random$AcquireContext_wcstoul
String ID:
API String ID: 1279355896-0
Opcode ID: d010a710b8dac1ab994c88ba2fe581b7f70955f7c9664a85b0ed2d002bceacbe
Instruction ID: f19ffd4411478121dd8e2ff7af2e5ca14bfae443737be6b145bce5efd8d71fca
Opcode Fuzzy Hash: d010a710b8dac1ab994c88ba2fe581b7f70955f7c9664a85b0ed2d002bceacbe
Instruction Fuzzy Hash: DE61E772A087019BCB54CF2CDD8165BB7E2AB84714F040D6EF9959F240DB35EC598B93

Function 6F88EBA0 Relevance: 6.1, APIs: 4, Instructions: 135serviceCOMMON

Download Yara Rule

APIs

CloseServiceHandle.ADVAPI32(?,D0A01E50,00000000,00000000,00000007), ref: 6F88EC0D
CreateServiceW.ADVAPI32(00000000,?,00000000,000F01FF,?,?,00000001,00000000,?,00000000,?,00000000,00000000), ref: 6F88ECBF
GetLastError.KERNEL32 ref: 6F88ECCF
OpenServiceW.ADVAPI32(00000000,?,000F01FF), ref: 6F88ECF0

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Service$CloseCreateErrorHandleLastOpen
String ID:
API String ID: 4007200304-0
Opcode ID: 4143a58251a9473749441f313e7747abfdf3eaf8157f58c8edc5d35c05bb05e9
Instruction ID: b5fecaea120721de71a49d229a909962d360114c665ac3da49966898fee587eb
Opcode Fuzzy Hash: 4143a58251a9473749441f313e7747abfdf3eaf8157f58c8edc5d35c05bb05e9
Instruction Fuzzy Hash: 2B518A70A04B41EBD704CF68C884B9AB7E6BF89715F104E6EF5669B380D770E844CB92

Function 6F85C7E0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 229COMMON

Download Yara Rule

Strings

%llu, xrefs: 6F85C891

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: __vswprintf_c_l
String ID: %llu
API String ID: 4171875762-507646796
Opcode ID: b79c6a12d7bb2fed87ebe30b1d50812bb44b46a160c3fef7b66bd5f71b3fa3d0
Instruction ID: f18a182de237f98a922fe5d6f9ad96e95203bbd72a00e5ba47c5f89f2982072b
Opcode Fuzzy Hash: b79c6a12d7bb2fed87ebe30b1d50812bb44b46a160c3fef7b66bd5f71b3fa3d0
Instruction Fuzzy Hash: 4C8190B1608340AFCB54CF78D881A5BB7E5AF86318F004E5EF8959B281D774E819CB93

Function 6F888C70 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 207COMMON

Download Yara Rule

APIs

Part of subcall function 6F864430: std::exception::exception.LIBCMT ref: 6F864498

__CxxThrowException@8.LIBCMT ref: 6F888D25

Part of subcall function 6F8924F0: RaiseException.KERNEL32(6F853778,?,D0A01E50,6F8B13C0,6F853778,?,6F8BD3C8,80000002,D0A01E50), ref: 6F892532

__CxxThrowException@8.LIBCMT ref: 6F888ED1

Strings

illegal flow end, xrefs: 6F888CB9, 6F888E76

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaisestd::exception::exception
String ID: illegal flow end
API String ID: 994420026-2303308288
Opcode ID: 15f0446bb6b4507addce45af13acdb047056a2aba41f3b75a4a001a87a261208
Instruction ID: 87eb5607c4b25b762f410d06711bb8fea658562be352a95cfcacae955b79ae40
Opcode Fuzzy Hash: 15f0446bb6b4507addce45af13acdb047056a2aba41f3b75a4a001a87a261208
Instruction Fuzzy Hash: 079106716087459FC324DF29C480B9AF7E1FF89704F404EAEE5A98B751DB70A904CB82

Function 6F852FB9 Relevance: 4.6, APIs: 3, Instructions: 103encryptionCOMMON

Download Yara Rule

APIs

_wcstoul.LIBCMT ref: 6F852FD3
CryptGenRandom.ADVAPI32(00000000,00000004,?), ref: 6F853003
CryptGenRandom.ADVAPI32(00000000,00000004,?), ref: 6F8530A2

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: CryptRandom$_wcstoul
String ID:
API String ID: 865278744-0
Opcode ID: a6886d2fb049f8ba12cbedc61e526ce82a393cc5a97648080d4db762c86d6088
Instruction ID: 85b3dcd68a8b7df6a5550f73aa5bd85bed4915198e8a11a4538c19fde0f85b17
Opcode Fuzzy Hash: a6886d2fb049f8ba12cbedc61e526ce82a393cc5a97648080d4db762c86d6088
Instruction Fuzzy Hash: AB31FC71A047019BCB54DF38DD8175AB3E2AB80314F000DBDE5959F240E735EC6D8693

Function 6F872F00 Relevance: 4.6, APIs: 3, Instructions: 74serviceCOMMON

Download Yara Rule

APIs

Part of subcall function 6F88EA00: GetVersionExW.KERNEL32(?,00000000,?,6F87117A), ref: 6F88EA09
Part of subcall function 6F88EA00: GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo,?,6F87117A), ref: 6F88EA1F
Part of subcall function 6F88EA00: GetProcAddress.KERNEL32(00000000), ref: 6F88EA28
Part of subcall function 6F88EA00: GetModuleHandleW.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,?,6F87117A), ref: 6F88EA46
Part of subcall function 6F88EA00: GetProcAddress.KERNEL32(00000000), ref: 6F88EA49
Part of subcall function 6F88EA00: GetModuleHandleW.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,?,6F87117A), ref: 6F88EA5B
Part of subcall function 6F88EA00: GetProcAddress.KERNEL32(00000000), ref: 6F88EA5E
Part of subcall function 6F88EA00: OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,?,6F87117A), ref: 6F88EAA0

ChangeServiceConfigW.ADVAPI32(?,000000FF,00000004,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6F872FA3
CloseServiceHandle.ADVAPI32(?), ref: 6F872FB5
CloseServiceHandle.ADVAPI32(?,00000000), ref: 6F872FCE

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Handle$AddressModuleProcService$Close$ChangeConfigManagerOpenVersion
String ID:
API String ID: 4162453160-0
Opcode ID: f8287a4ebead65567865fbc35adf436dba60a6adc4d795e5f87ed92900e67fad
Instruction ID: 79bd5803e37ef6c080453e2f6a248d77e238cb3d90f03d0b2c861a60b32c8154
Opcode Fuzzy Hash: f8287a4ebead65567865fbc35adf436dba60a6adc4d795e5f87ed92900e67fad
Instruction Fuzzy Hash: CB21217161C781ABDB30CB68CC45BDB77E8AB4A724F400E5DE5A99B2C0DF35A444CB92

Function 6F85BF10 Relevance: 56.4, APIs: 26, Strings: 6, Instructions: 448registryCOMMON

Download Yara Rule

APIs

Part of subcall function 6F853280: std::_Xinvalid_argument.LIBCPMT ref: 6F853298

RegCreateKeyExW.ADVAPI32(80000002,?,00000000,00000000,00000000,00000003,00000000,?,00000000,00000000,D0A01E50,80000002,?), ref: 6F85BF8F
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,00000000), ref: 6F85BFF3
std::exception::exception.LIBCMT ref: 6F85C040
GetLastError.KERNEL32(?,RegQueryValueEx,0000000F), ref: 6F85C04F
__CxxThrowException@8.LIBCMT ref: 6F85C067
_swscanf.LIBCMT ref: 6F85C089
std::exception::exception.LIBCMT ref: 6F85C0C5
GetLastError.KERNEL32(?,swscanf), ref: 6F85C0D4
__CxxThrowException@8.LIBCMT ref: 6F85C0EC
RegSetValueExW.ADVAPI32(?,?,00000000,00000004,?,00000004), ref: 6F85C10B
__CxxThrowException@8.LIBCMT ref: 6F85C140
_swscanf.LIBCMT ref: 6F85C162
__CxxThrowException@8.LIBCMT ref: 6F85C196
RegSetValueExW.ADVAPI32(?,?,00000000,0000000B,?,00000008), ref: 6F85C1B7
__CxxThrowException@8.LIBCMT ref: 6F85C1EC
WideCharToMultiByte.KERNEL32(00000000,00000000,00000001,?,00000000,?,00000000,00000000), ref: 6F85C21C
__CxxThrowException@8.LIBCMT ref: 6F85C256
RegCloseKey.ADVAPI32(?), ref: 6F85C2C1
RegSetValueExW.ADVAPI32(?,?,00000000,00000007,?,6F8A8450), ref: 6F85C3B1
__CxxThrowException@8.LIBCMT ref: 6F85C3E2
__CxxThrowException@8.LIBCMT ref: 6F85C425
RegSetValueExW.ADVAPI32(?,?,00000000,?,00000001,?), ref: 6F85C44D
__CxxThrowException@8.LIBCMT ref: 6F85C2AB

Part of subcall function 6F8924F0: RaiseException.KERNEL32(6F853778,?,D0A01E50,6F8B13C0,6F853778,?,6F8BD3C8,80000002,D0A01E50), ref: 6F892532

RegSetValueExW.ADVAPI32(?,?,00000000,00000003,00000000,?), ref: 6F85C271

Part of subcall function 6F85FBB0: std::exception::exception.LIBCMT ref: 6F85FBC3
Part of subcall function 6F85FBB0: GetLastError.KERNEL32(?,?,6F85C47A,RegSetValueEx), ref: 6F85FBCE

__CxxThrowException@8.LIBCMT ref: 6F85C482
RegCloseKey.ADVAPI32(?,?,6F8BD420,RegSetValueEx), ref: 6F85C48B

Strings

swscanf, xrefs: 6F85C096, 6F85C16F
WideCharToMultiByte, xrefs: 6F85C22F
Invalid value type, xrefs: 6F85C3FE
RegSetValueEx, xrefs: 6F85C119, 6F85C1C5, 6F85C284, 6F85C3BB, 6F85C45B
%llu, xrefs: 6F85C15C
RegQueryValueEx, xrefs: 6F85BFFF

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Exception@8Throw$Value$ErrorLaststd::exception::exception$Close_swscanf$ByteCharCreateExceptionMultiQueryRaiseWideXinvalid_argumentstd::_
String ID: %llu$Invalid value type$RegQueryValueEx$RegSetValueEx$WideCharToMultiByte$swscanf
API String ID: 2334525903-1655690740
Opcode ID: dea3fa9e77e77e9ea4b31193246577d44db2e5cbd7cf402381404dc6dabca7c4
Instruction ID: 4748334bb965143822b5e090cc040f1870dbb9e8cb201b157101a156610d5348
Opcode Fuzzy Hash: dea3fa9e77e77e9ea4b31193246577d44db2e5cbd7cf402381404dc6dabca7c4
Instruction Fuzzy Hash: BEF18D70901208EBDF54CFB8C981FDEB7B5AF42708F2049A9E505AF281D770AA55CFA1

Function 6F8ADA70 Relevance: 38.7, APIs: 2, Strings: 20, Instructions: 218COMMON

Download Yara Rule

APIs

Part of subcall function 6F8907C7: _malloc.LIBCMT ref: 6F8907E1

std::exception::exception.LIBCMT ref: 6F8ADACD
__CxxThrowException@8.LIBCMT ref: 6F8ADAE4

Strings

SCALAR, xrefs: 6F8ADDFE
BLOCK_ENTRY, xrefs: 6F8ADC1E
FLOW_MAP_COMPACT, xrefs: 6F8ADCE6
ANCHOR, xrefs: 6F8ADD86
FLOW_MAP_END, xrefs: 6F8ADCBE
DOC_END, xrefs: 6F8ADB58
VALUE, xrefs: 6F8ADD5E
DOC_START, xrefs: 6F8ADB30
FLOW_MAP_START, xrefs: 6F8ADC74
BLOCK_SEQ_END, xrefs: 6F8ADBCE
KEY, xrefs: 6F8ADD36
BLOCK_MAP_START, xrefs: 6F8ADBA6
DIRECTIVE, xrefs: 6F8ADB14
ALIAS, xrefs: 6F8ADDAE
TAG, xrefs: 6F8ADDDC
FLOW_SEQ_END, xrefs: 6F8ADC96
FLOW_SEQ_START, xrefs: 6F8ADC46
BLOCK_MAP_END, xrefs: 6F8ADBF6
FLOW_ENTRY, xrefs: 6F8ADD0E
BLOCK_SEQ_START, xrefs: 6F8ADB7F

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID: ALIAS$ANCHOR$BLOCK_ENTRY$BLOCK_MAP_END$BLOCK_MAP_START$BLOCK_SEQ_END$BLOCK_SEQ_START$DIRECTIVE$DOC_END$DOC_START$FLOW_ENTRY$FLOW_MAP_COMPACT$FLOW_MAP_END$FLOW_MAP_START$FLOW_SEQ_END$FLOW_SEQ_START$KEY$SCALAR$TAG$VALUE
API String ID: 4063778783-3171149512
Opcode ID: 6d4794487a2b4f7c67336381bfe59d38953321e4dd7cb54692d02fe8e99a3ad9
Instruction ID: 525805cb9d9ddd1b0d836710d4682891d4272264b4504e9e62c9a5f30a5e128c
Opcode Fuzzy Hash: 6d4794487a2b4f7c67336381bfe59d38953321e4dd7cb54692d02fe8e99a3ad9
Instruction Fuzzy Hash: 5E91AB70549B82AADB11CF2DE84071E7EE0A757A20F8409DEE6545F385DB788528CBE3

Function 6F8980FD Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 109libraryloadermemoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,6F890ABC,6F8BCE30,00000008,6F890C50,?,?,?,6F8BCE50,0000000C,6F890D0B,?), ref: 6F898105
__mtterm.LIBCMT ref: 6F898111

Part of subcall function 6F897DDC: TlsFree.KERNEL32(0000000D,6F890B7F,6F890B65,6F8BCE30,00000008,6F890C50,?,?,?,6F8BCE50,0000000C,6F890D0B,?), ref: 6F897E07
Part of subcall function 6F897DDC: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,6F890B7F,6F890B65,6F8BCE30,00000008,6F890C50,?,?,?,6F8BCE50,0000000C,6F890D0B,?), ref: 6F89A3A3
Part of subcall function 6F897DDC: _free.LIBCMT ref: 6F89A3A6
Part of subcall function 6F897DDC: DeleteCriticalSection.KERNEL32(0000000D,?,?,6F890B7F,6F890B65,6F8BCE30,00000008,6F890C50,?,?,?,6F8BCE50,0000000C,6F890D0B,?), ref: 6F89A3CD

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 6F898127
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 6F898134
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 6F898141
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 6F89814E
TlsAlloc.KERNEL32(?,?,6F890ABC,6F8BCE30,00000008,6F890C50,?,?,?,6F8BCE50,0000000C,6F890D0B,?), ref: 6F89819E
TlsSetValue.KERNEL32(00000000,?,?,6F890ABC,6F8BCE30,00000008,6F890C50,?,?,?,6F8BCE50,0000000C,6F890D0B,?), ref: 6F8981B9
__init_pointers.LIBCMT ref: 6F8981C3
__calloc_crt.LIBCMT ref: 6F898231
GetCurrentThreadId.KERNEL32 ref: 6F89825D

Strings

KERNEL32.DLL, xrefs: 6F898100
FlsAlloc, xrefs: 6F898121
FlsSetValue, xrefs: 6F898136
FlsFree, xrefs: 6F898143
FlsGetValue, xrefs: 6F898129

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 4163708885-3819984048
Opcode ID: 7b63ffa3c36df9636a15acffbb5eaac54998f83af02ad8d5c9cc00d21edc2ad9
Instruction ID: 43f695c1c0ba103f75236cf6734a21809205187bf62fa6417012737e717db306
Opcode Fuzzy Hash: 7b63ffa3c36df9636a15acffbb5eaac54998f83af02ad8d5c9cc00d21edc2ad9
Instruction Fuzzy Hash: B6314F32908E11AEDF149B7D8C05B5A3FA9EB46379F5009EBE4149F698DB309021CFD0

Function 6F85EB50 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 130COMMON

Download Yara Rule

APIs

_swscanf.LIBCMT ref: 6F85EB81
_swscanf.LIBCMT ref: 6F85EBA7
_swscanf.LIBCMT ref: 6F85EBCC
_swscanf.LIBCMT ref: 6F85EBF0
_swscanf.LIBCMT ref: 6F85EC1A
_swscanf.LIBCMT ref: 6F85EC3C
_swscanf.LIBCMT ref: 6F85EC61
_swscanf.LIBCMT ref: 6F85EC7C

Strings

%u.%u.%u, xrefs: 6F85EBA1
v%u.%u.%u.%u, xrefs: 6F85EC14
v%u.%u.%u, xrefs: 6F85EC36
v%u.%u, xrefs: 6F85EC5B
%u.%u.%u.%u, xrefs: 6F85EB7B
v%u, xrefs: 6F85EC76
%u.%u, xrefs: 6F85EBC6

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: _swscanf
String ID: %u.%u$%u.%u.%u$%u.%u.%u.%u$v%u$v%u.%u$v%u.%u.%u$v%u.%u.%u.%u
API String ID: 2748852333-538441230
Opcode ID: 1b68fe7b4336e74dedb86f3a6d8e039426fd643d67e8068c395d1354b35e924c
Instruction ID: c385c48589b3e626e8820948d840d510818bef6c78b5c24b62b2d3c84c3266fa
Opcode Fuzzy Hash: 1b68fe7b4336e74dedb86f3a6d8e039426fd643d67e8068c395d1354b35e924c
Instruction Fuzzy Hash: 533181F1910605EBDB708E2DCC88D57BBA9EE512557100C9AF01ADE240E331F9B0CBA2

Function 6F88EA00 Relevance: 21.0, APIs: 8, Strings: 4, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?,00000000,?,6F87117A), ref: 6F88EA09
GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo,?,6F87117A), ref: 6F88EA1F
GetProcAddress.KERNEL32(00000000), ref: 6F88EA28
GetModuleHandleW.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,?,6F87117A), ref: 6F88EA46
GetProcAddress.KERNEL32(00000000), ref: 6F88EA49
GetModuleHandleW.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,?,6F87117A), ref: 6F88EA5B
GetProcAddress.KERNEL32(00000000), ref: 6F88EA5E
OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,?,6F87117A), ref: 6F88EAA0

Strings

Wow64RevertWow64FsRedirection, xrefs: 6F88EA4B
Wow64DisableWow64FsRedirection, xrefs: 6F88EA3C
GetNativeSystemInfo, xrefs: 6F88EA15
kernel32.dll, xrefs: 6F88EA1A, 6F88EA41, 6F88EA50

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: AddressHandleModuleProc$ManagerOpenVersion
String ID: GetNativeSystemInfo$Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 4247078701-1191386364
Opcode ID: 8db05d4f7994bf2fcc0ee676bebbbed0580a09bea30089cc92925af596674a5b
Instruction ID: afdee2688e66c6b8eca9e3f6c962aad257d0fde30a552aa281de813a5fd889f1
Opcode Fuzzy Hash: 8db05d4f7994bf2fcc0ee676bebbbed0580a09bea30089cc92925af596674a5b
Instruction Fuzzy Hash: 2D112D70500B45ABDB209FB58C89BDBB7E8AF9A355F00485DE15ADF350DB74A401CB94

Function 6F874A00 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 212COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6F874ABE

Part of subcall function 6F8924F0: RaiseException.KERNEL32(6F853778,?,D0A01E50,6F8B13C0,6F853778,?,6F8BD3C8,80000002,D0A01E50), ref: 6F892532

__CxxThrowException@8.LIBCMT ref: 6F874B2B
__CxxThrowException@8.LIBCMT ref: 6F874BE5

Part of subcall function 6F864430: std::exception::exception.LIBCMT ref: 6F864498

__CxxThrowException@8.LIBCMT ref: 6F874CA1
std::exception::exception.LIBCMT ref: 6F874CDE

Part of subcall function 6F8901B5: std::exception::operator=.LIBCMT ref: 6F8901CE

Part of subcall function 6F856620: std::_Xinvalid_argument.LIBCPMT ref: 6F85663A

Strings

YAML major version too large, xrefs: 6F874BA2
repeated YAML directive, xrefs: 6F874ACC
bad YAML version: , xrefs: 6F874C2A
YAML directives must have exactly one argument, xrefs: 6F874A63

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Exception@8Throw$std::exception::exception$ExceptionRaiseXinvalid_argumentstd::_std::exception::operator=
String ID: YAML directives must have exactly one argument$YAML major version too large$bad YAML version: $repeated YAML directive
API String ID: 1017350598-727870030
Opcode ID: 49f3af913b29cf5aad10503f1b9854ba09efc055c81a60d35e0c094f5bba1cd2
Instruction ID: 9fb2533ed0d6792aaf493cc407e4f0c1b387b8adda9d23394effc4f56b3e9ea4
Opcode Fuzzy Hash: 49f3af913b29cf5aad10503f1b9854ba09efc055c81a60d35e0c094f5bba1cd2
Instruction Fuzzy Hash: D4818CB1508381ABC338DF58D850BDBB7E4BBC9714F404E9DE5999B380DB35A408CBA2

Function 6F870DD0 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 192windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,?,00000000,00000003), ref: 6F870F18

Strings

warning, xrefs: 6F870EB5
error, xrefs: 6F870ED0
cancel, xrefs: 6F870F98
yes, xrefs: 6F870FCA
okcancel, xrefs: 6F870E41
yesnocancel, xrefs: 6F870E7B
yesno, xrefs: 6F870E5E
information, xrefs: 6F870E9A

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Message
String ID: cancel$error$information$okcancel$warning$yes$yesno$yesnocancel
API String ID: 2030045667-3513478497
Opcode ID: 2999c9216387c05ff2ce8fee282a76731ffc9bfa2aec93773e713231893b1f3b
Instruction ID: 84a8cbc6103e6e726ae4fdd76d171dd1d5bbc78ff69fbf38aa62dc84c74a3989
Opcode Fuzzy Hash: 2999c9216387c05ff2ce8fee282a76731ffc9bfa2aec93773e713231893b1f3b
Instruction Fuzzy Hash: 5E613872A083409BD714CF28C581B1FB7E5AB85718F401EADF9859F380DB76E8458B82

Function 6F853C60 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 155COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6F853C98
std::_Xinvalid_argument.LIBCPMT ref: 6F853CB9
_memmove.LIBCMT ref: 6F853D2B
_memmove.LIBCMT ref: 6F853D65
std::_Xinvalid_argument.LIBCPMT ref: 6F853DD0

Strings

invalid string position, xrefs: 6F853DCB
string too long, xrefs: 6F853C93, 6F853CB4

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: invalid string position$string too long
API String ID: 2168136238-4289949731
Opcode ID: 55096aff34424a9baecdf1deb1cb51bcfb90c3f68c67782780b7921bc2861514
Instruction ID: 9ec22c5cd483ec6305b8b54b2e3b885cd6782d8d9cdcf0ec977cff4808c38df7
Opcode Fuzzy Hash: 55096aff34424a9baecdf1deb1cb51bcfb90c3f68c67782780b7921bc2861514
Instruction Fuzzy Hash: 8F416F713046059BC365CEACD98185AB3B7BFD57047208EAEE4528F264EB30ED658B61

Function 6F873F70 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 101servicesleepCOMMON

Download Yara Rule

APIs

DeleteService.ADVAPI32(?), ref: 6F873FED
CloseServiceHandle.ADVAPI32(?), ref: 6F873FFA
Sleep.KERNEL32(00000064), ref: 6F874008
DeleteService.ADVAPI32(?,00000000), ref: 6F87404C
CloseServiceHandle.ADVAPI32(?), ref: 6F874059
Sleep.KERNEL32(00000064), ref: 6F874067

Strings

Notification Area, xrefs: 6F8740A1
User Promoted Notification Area, xrefs: 6F8740AE

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Service$CloseDeleteHandleSleep
String ID: Notification Area$User Promoted Notification Area
API String ID: 4165916433-1815018085
Opcode ID: 9720eaaf820c842ba9c147e8c6ced77c6705aa340a8663f54c86d69237880dfb
Instruction ID: b6ec5642b7d12a796a8a651d9ea960df215a7eca592f23e34667b470026cb226
Opcode Fuzzy Hash: 9720eaaf820c842ba9c147e8c6ced77c6705aa340a8663f54c86d69237880dfb
Instruction Fuzzy Hash: 313170B1504B80EBDB20DB68CC85B9BB3E8BB85715F400D5DF0669B380DB75E4548B63

Function 6F88E6A0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6F88E6BF
std::_Xinvalid_argument.LIBCPMT ref: 6F88E6DA
_memmove.LIBCMT ref: 6F88E736
_memmove.LIBCMT ref: 6F88E75A

Strings

string too long, xrefs: 6F88E6BA, 6F88E6D5

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Xinvalid_argument_memmovestd::_
String ID: string too long
API String ID: 256744135-2556327735
Opcode ID: 244298182fcb3b429dc9dac276ec490f71a446d123014131cd5dd4a26481cf6b
Instruction ID: 89029814d1f8ee741b30caa6533637bcb29bb80257ae9d6ef820e4732f4eb1c3
Opcode Fuzzy Hash: 244298182fcb3b429dc9dac276ec490f71a446d123014131cd5dd4a26481cf6b
Instruction Fuzzy Hash: 0F31A4357047049BD734AEECE980A1AB7E6DB82714B600FDEE4B28F6D1DB20EC408756

Function 6F8740E0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 114libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 6F87412D
GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo), ref: 6F87413D
GetProcAddress.KERNEL32(00000000), ref: 6F874144

Strings

GetNativeSystemInfo, xrefs: 6F874133
x64, xrefs: 6F874189
x86, xrefs: 6F8741C6
kernel32.dll, xrefs: 6F874138

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: AddressHandleModuleProcVersion
String ID: GetNativeSystemInfo$kernel32.dll$x64$x86
API String ID: 3310240892-405694257
Opcode ID: 766b661248ceede3116966a697fafdf04049e77020ee632e6a695cb60a9a90fe
Instruction ID: c15cc828d1b4da39d64b09bb2faf863b7c93a4ae25233781ee6841ea2ca8c7cb
Opcode Fuzzy Hash: 766b661248ceede3116966a697fafdf04049e77020ee632e6a695cb60a9a90fe
Instruction Fuzzy Hash: 86419171518740DBC720DB68C881B8FB7E4BBD6314F000DAEF5558A290EA31E555CB93

Function 6F878E80 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6F878EAB
std::_Lockit::_Lockit.LIBCPMT ref: 6F878ED1
std::bad_exception::bad_exception.LIBCMT ref: 6F878F55
__CxxThrowException@8.LIBCMT ref: 6F878F64
std::_Lockit::_Lockit.LIBCPMT ref: 6F878F79
std::locale::facet::_Facet_Register.LIBCPMT ref: 6F878F94

Strings

bad cast, xrefs: 6F878F4C

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2427920155-3145022300
Opcode ID: 259fa5f81d15762fc8c303881f25d1dca73599fefc2b9b183a6db469a5a62d09
Instruction ID: 1289d1c3ec34a1d38ff0c89a2d7b21934361df6a684867f02cc7f7dfe340c837
Opcode Fuzzy Hash: 259fa5f81d15762fc8c303881f25d1dca73599fefc2b9b183a6db469a5a62d09
Instruction Fuzzy Hash: 4C31BA71508750AFD728DF28D884B4E73E1AF55728F204EDDE8669F2C0DB30A949CB92

Function 6F868C60 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6F868C8B
std::_Lockit::_Lockit.LIBCPMT ref: 6F868CB1
std::bad_exception::bad_exception.LIBCMT ref: 6F868D35
__CxxThrowException@8.LIBCMT ref: 6F868D44
std::_Lockit::_Lockit.LIBCPMT ref: 6F868D59
std::locale::facet::_Facet_Register.LIBCPMT ref: 6F868D74

Strings

bad cast, xrefs: 6F868D2C

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2427920155-3145022300
Opcode ID: 37053a6b6732b720d1c643443313f77c1bcefad20114b7d3befea352cd1371f5
Instruction ID: 9dc805f8be1856415b8695c2ca8514e1a7381661a9e8d6407ce20a66c98bb301
Opcode Fuzzy Hash: 37053a6b6732b720d1c643443313f77c1bcefad20114b7d3befea352cd1371f5
Instruction Fuzzy Hash: DE31A0315087109FC714DF28C894B5A77A0BF66728F000EDDE8A59F2D1DB34A948CBA2

Function 6F868B10 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6F868B3B
std::_Lockit::_Lockit.LIBCPMT ref: 6F868B61
std::bad_exception::bad_exception.LIBCMT ref: 6F868BE5
__CxxThrowException@8.LIBCMT ref: 6F868BF4
std::_Lockit::_Lockit.LIBCPMT ref: 6F868C09
std::locale::facet::_Facet_Register.LIBCPMT ref: 6F868C24

Strings

bad cast, xrefs: 6F868BDC

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2427920155-3145022300
Opcode ID: d21291eaeb0e9e5daea425708921be6201bfd5652bdad250d828b02865d46235
Instruction ID: 51041a21cf7198394ef9d9bfd044a9a3c27b5b82cd9167a8c44c08a862fd32a6
Opcode Fuzzy Hash: d21291eaeb0e9e5daea425708921be6201bfd5652bdad250d828b02865d46235
Instruction Fuzzy Hash: A7319271508711DFC708CF28D890B4A73E4AF5A724F004EDDE8AA9F2D0DB34A909CB92

Function 6F868400 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6F86842B
std::_Lockit::_Lockit.LIBCPMT ref: 6F868451
std::bad_exception::bad_exception.LIBCMT ref: 6F8684D5
__CxxThrowException@8.LIBCMT ref: 6F8684E4
std::_Lockit::_Lockit.LIBCPMT ref: 6F8684F9
std::locale::facet::_Facet_Register.LIBCPMT ref: 6F868514

Strings

bad cast, xrefs: 6F8684CC

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2427920155-3145022300
Opcode ID: 4f73caa5dc60a5e7623c9a3504516354e6fab091ab300bbe77b8fe36d3b985d0
Instruction ID: fdcebc38cf5b78ea7803cc3f47f0c2a651806b90d45b69fc381b02d4709f1310
Opcode Fuzzy Hash: 4f73caa5dc60a5e7623c9a3504516354e6fab091ab300bbe77b8fe36d3b985d0
Instruction Fuzzy Hash: E8319C315087119FC718DF28D880B9A77A4BF56338F000EDDE8A69F2D4DB34A944CB92

Function 6F853A40 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 91COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6F853A57

Part of subcall function 6F88F682: std::exception::exception.LIBCMT ref: 6F88F697
Part of subcall function 6F88F682: __CxxThrowException@8.LIBCMT ref: 6F88F6AC
Part of subcall function 6F88F682: std::exception::exception.LIBCMT ref: 6F88F6BD

std::_Xinvalid_argument.LIBCPMT ref: 6F853A75
std::_Xinvalid_argument.LIBCPMT ref: 6F853A93
_memmove.LIBCMT ref: 6F853AFC

Strings

\ChicaLogic\ChicaPC-Shield, xrefs: 6F853A44
invalid string position, xrefs: 6F853A52
string too long, xrefs: 6F853A70, 6F853A8E

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$std::exception::exception$Exception@8Throw_memmove
String ID: \ChicaLogic\ChicaPC-Shield$invalid string position$string too long
API String ID: 443534600-3045764314
Opcode ID: ea2eb71b618c1df8c8bc1e2bebf572968d33775b44880b3b21284b0d3f67390d
Instruction ID: 7a8c79a570be196acd902ff6b5026fec7d061364156cfd5872fa8b8ca856f16f
Opcode Fuzzy Hash: ea2eb71b618c1df8c8bc1e2bebf572968d33775b44880b3b21284b0d3f67390d
Instruction Fuzzy Hash: 312164323047019B8765DEACD89281AB3E7BFD57153214EAEE092CF650D731ED25C762

Function 6F873D30 Relevance: 12.2, APIs: 8, Instructions: 171sleepfilesynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6F85FAE0: GetCurrentProcess.KERNEL32(000F01FF,D0A01E50,?,?,?,6F873D6F,D0A01E50,?,D0A01E50,75090460,750A49C0), ref: 6F85FAF7
Part of subcall function 6F85FAE0: OpenProcessToken.ADVAPI32(00000000,?,?,?,6F873D6F,D0A01E50,?,D0A01E50,75090460,750A49C0), ref: 6F85FAFE
Part of subcall function 6F85FAE0: LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 6F85FB14
Part of subcall function 6F85FAE0: CloseHandle.KERNEL32(?,?,?,?,6F873D6F,D0A01E50,?,D0A01E50,75090460,750A49C0), ref: 6F85FB22

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 6F873DA2
CloseHandle.KERNEL32(00000000), ref: 6F873DD2
DeviceIoControl.KERNEL32(00000000,00222404,00000000,00000000,?,00000004,?,00000000), ref: 6F873DFF
CloseHandle.KERNEL32(00000000), ref: 6F873E19
OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 6F873E71
WaitForSingleObject.KERNEL32(00000000,000493E0), ref: 6F873EB1
CloseHandle.KERNEL32(00000000), ref: 6F873EBA
Sleep.KERNEL32(0000012C), ref: 6F873ED0

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: CloseHandle$Process$Open$ControlCreateCurrentDeviceFileLookupObjectPrivilegeSingleSleepTokenValueWait
String ID:
API String ID: 1709624590-0
Opcode ID: 672d3f9d3cac3ff7d705288630a75db1b70e2bf3f921026bdfdb7a3abd2719ef
Instruction ID: 25ce5097582e23c8833699ffaff2760cf50a4f3580df7dc9a8bb979f74f039e3
Opcode Fuzzy Hash: 672d3f9d3cac3ff7d705288630a75db1b70e2bf3f921026bdfdb7a3abd2719ef
Instruction Fuzzy Hash: 13517C72508700AFD610DB68C846B9FBBE9AF85758F000E9EF5A59B290DB31D944CF93

Function 6F87E070 Relevance: 12.2, APIs: 8, Instructions: 158COMMON

Download Yara Rule

APIs

Part of subcall function 6F8907C7: _malloc.LIBCMT ref: 6F8907E1

std::exception::exception.LIBCMT ref: 6F87E1B5
__CxxThrowException@8.LIBCMT ref: 6F87E1CC
std::exception::exception.LIBCMT ref: 6F87E1DE
__CxxThrowException@8.LIBCMT ref: 6F87E1F5
std::exception::exception.LIBCMT ref: 6F87E207
__CxxThrowException@8.LIBCMT ref: 6F87E21E
std::exception::exception.LIBCMT ref: 6F87E230
__CxxThrowException@8.LIBCMT ref: 6F87E247

Part of subcall function 6F8907C7: std::exception::exception.LIBCMT ref: 6F890816
Part of subcall function 6F8907C7: std::exception::exception.LIBCMT ref: 6F890830
Part of subcall function 6F8907C7: __CxxThrowException@8.LIBCMT ref: 6F890841

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw$_malloc
String ID:
API String ID: 2621100827-0
Opcode ID: a78cb8072aee68e0eeca8cae56d9f7b6d69b11862531feaed0ca8672d588a222
Instruction ID: 6de7cb93c2b14884a4c47349dc38a9cd1b07fd941a4c82e5ae6101cb536e1b79
Opcode Fuzzy Hash: a78cb8072aee68e0eeca8cae56d9f7b6d69b11862531feaed0ca8672d588a222
Instruction Fuzzy Hash: B6510AB1505701AFC308CF6AC880A4AFBF5BF98304F509D6EE19A9B750D774A218CF92

Function 6F8544F0 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 317timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 6F85470A
__swprintf.LIBCMT ref: 6F85472D
_swscanf.LIBCMT ref: 6F8547C0

Strings

0, 0, xrefs: 6F85480C
%u, , xrefs: 6F8547BA
%u, %u, %u, %u, %u | , xrefs: 6F854727

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Time$FileSystem__swprintf_swscanf
String ID: %u, $%u, %u, %u, %u, %u | $0, 0
API String ID: 2298001682-3198786647
Opcode ID: 501c67105508a59e4d6bf6f25fdb0076dfd7ec8338a5e099bd3efda807d0c7df
Instruction ID: bc2e76db9b56e8d5ae9b2d3501e4672ae6accdcd27937ff57121867cfb85e14f
Opcode Fuzzy Hash: 501c67105508a59e4d6bf6f25fdb0076dfd7ec8338a5e099bd3efda807d0c7df
Instruction Fuzzy Hash: 0EA1CE316083419BE798CA2888617AB73F5BFC0315F814DAEEC659F190EB20E9748792

Function 6F8759C0 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 252COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6F875A62
std::_Xinvalid_argument.LIBCPMT ref: 6F875B0A
std::_Xinvalid_argument.LIBCPMT ref: 6F875B1C
__Stoulx.LIBCPMT ref: 6F875C58
std::_Lockit::_Lockit.LIBCPMT ref: 6F875C7B

Part of subcall function 6F864230: std::_Lockit::_Lockit.LIBCPMT ref: 6F86423F

Part of subcall function 6F868C60: std::_Lockit::_Lockit.LIBCPMT ref: 6F868C8B
Part of subcall function 6F868C60: std::_Lockit::_Lockit.LIBCPMT ref: 6F868CB1

Strings

string too long, xrefs: 6F875B05, 6F875B17

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: std::_$LockitLockit::_$Xinvalid_argument$Stoulx
String ID: string too long
API String ID: 533899799-2556327735
Opcode ID: f5d669aee1f04a1ae6751e6cb9c0c64731e4edeb7d0308091ad928e42fc21b11
Instruction ID: 4bce866d02d72f6f0e48b20eca895c477a76e1241b1adac9cbf9dfc3d260f121
Opcode Fuzzy Hash: f5d669aee1f04a1ae6751e6cb9c0c64731e4edeb7d0308091ad928e42fc21b11
Instruction Fuzzy Hash: 0CA14B715087409FD324CF28C880B9FB7E5BF86718F504E9DE9A99F290DB31A945CB92

Function 6F858D00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6F858D20

Part of subcall function 6F88F635: std::exception::exception.LIBCMT ref: 6F88F64A
Part of subcall function 6F88F635: __CxxThrowException@8.LIBCMT ref: 6F88F65F
Part of subcall function 6F88F635: std::exception::exception.LIBCMT ref: 6F88F670

_memmove.LIBCMT ref: 6F858D93
_memmove.LIBCMT ref: 6F858DB8
_memmove.LIBCMT ref: 6F858DF5
_memmove.LIBCMT ref: 6F858E12

Strings

deque<T> too long, xrefs: 6F858D1B

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: _memmove$std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: deque<T> too long
API String ID: 4034224661-309773918
Opcode ID: bbd2b26def7127046aa29e63951ece678f86281612d12fcca13a3383c0d9a51a
Instruction ID: 57664514baff4d4749528914f91219c67ca022ce1df09b4df54b04458093823e
Opcode Fuzzy Hash: bbd2b26def7127046aa29e63951ece678f86281612d12fcca13a3383c0d9a51a
Instruction Fuzzy Hash: 1A41F672A043049BD748CF6CCC8066BB7E6EFD0214F198EADE8198B348EB34EC158791

Function 6F880A60 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6F880A80

Part of subcall function 6F88F635: std::exception::exception.LIBCMT ref: 6F88F64A
Part of subcall function 6F88F635: __CxxThrowException@8.LIBCMT ref: 6F88F65F
Part of subcall function 6F88F635: std::exception::exception.LIBCMT ref: 6F88F670

_memmove.LIBCMT ref: 6F880AF3
_memmove.LIBCMT ref: 6F880B18
_memmove.LIBCMT ref: 6F880B55
_memmove.LIBCMT ref: 6F880B72

Strings

deque<T> too long, xrefs: 6F880A7B

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: _memmove$std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: deque<T> too long
API String ID: 4034224661-309773918
Opcode ID: 046d88aab8dfc557781720ddc5c041cba6a08a227e57a51d8169f6d28c66c94a
Instruction ID: 4242896834a89cb5541a93c48fa2b800aa003d11a17eb673f8a5f7cbabc8f4cf
Opcode Fuzzy Hash: 046d88aab8dfc557781720ddc5c041cba6a08a227e57a51d8169f6d28c66c94a
Instruction Fuzzy Hash: 9241FB72A043055FD718CF6CCD8166BB7E6EFC0214F19CA6DE8298B345EA34EC058791

Function 6F8583C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6F8583DC

Part of subcall function 6F88F635: std::exception::exception.LIBCMT ref: 6F88F64A
Part of subcall function 6F88F635: __CxxThrowException@8.LIBCMT ref: 6F88F65F
Part of subcall function 6F88F635: std::exception::exception.LIBCMT ref: 6F88F670

_memmove.LIBCMT ref: 6F85844C
_memmove.LIBCMT ref: 6F858471
_memmove.LIBCMT ref: 6F8584AE
_memmove.LIBCMT ref: 6F8584CB

Strings

deque<T> too long, xrefs: 6F8583D7

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: _memmove$std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: deque<T> too long
API String ID: 4034224661-309773918
Opcode ID: 81f7007284196684ea450c76adfdf25bd117a9e8d77bed722d83aa5737288d94
Instruction ID: afaf209075a2d1a3bbaa511b852a4aa2c5b6d54b6bf75360026b31d8afe38d62
Opcode Fuzzy Hash: 81f7007284196684ea450c76adfdf25bd117a9e8d77bed722d83aa5737288d94
Instruction Fuzzy Hash: 2041D4B1A042159BD718CF2CCC8066BB7E6EBC0214F098A6DE8199F349EB38E8158791

Function 6F85E980 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6F85E9A6

Part of subcall function 6F88F635: std::exception::exception.LIBCMT ref: 6F88F64A
Part of subcall function 6F88F635: __CxxThrowException@8.LIBCMT ref: 6F88F65F
Part of subcall function 6F88F635: std::exception::exception.LIBCMT ref: 6F88F670

_memmove.LIBCMT ref: 6F85E9FC
_memmove.LIBCMT ref: 6F85EA0A
_memmove.LIBCMT ref: 6F85EA1D
_memmove.LIBCMT ref: 6F85EA5E

Strings

vector<T> too long, xrefs: 6F85E9A1

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: _memmove$std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: vector<T> too long
API String ID: 4034224661-3788999226
Opcode ID: e35d05746db366c46ea07bd459ab43c668af2f6c4fcefc7f86ec942535f3dd1e
Instruction ID: 18182b9327623353d6a527ab33e03cdabb610cc927ab05769b27f2160248e484
Opcode Fuzzy Hash: e35d05746db366c46ea07bd459ab43c668af2f6c4fcefc7f86ec942535f3dd1e
Instruction Fuzzy Hash: DD31C3B16043046FC718CE7CCD9582BB7EAEFD4214F148E6DE4968B384EA34F8158761

Function 6F866F80 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6F866F94

Part of subcall function 6F88F682: std::exception::exception.LIBCMT ref: 6F88F697
Part of subcall function 6F88F682: __CxxThrowException@8.LIBCMT ref: 6F88F6AC
Part of subcall function 6F88F682: std::exception::exception.LIBCMT ref: 6F88F6BD

std::_Xinvalid_argument.LIBCPMT ref: 6F866FA7
std::_Xinvalid_argument.LIBCPMT ref: 6F866FC2
_memmove.LIBCMT ref: 6F867025

Strings

invalid string position, xrefs: 6F866F8F
string too long, xrefs: 6F866FA2, 6F866FBD

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position$string too long
API String ID: 443534600-4289949731
Opcode ID: b7a347b500fc7d64ba326b935e431866e964c439ebdd1aa2d04217781bc7b559
Instruction ID: 03fdf0943046759f6230ae580f1a6f3242d875dd2771b33e8b1aa5b264377f7d
Opcode Fuzzy Hash: b7a347b500fc7d64ba326b935e431866e964c439ebdd1aa2d04217781bc7b559
Instruction Fuzzy Hash: 8D212B313043559BD6159E6C9CD0A6EBBAABF92324B240E9EE055CF7C1CB61A854C3B2

Function 6F868270 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6F868287

Part of subcall function 6F88F682: std::exception::exception.LIBCMT ref: 6F88F697
Part of subcall function 6F88F682: __CxxThrowException@8.LIBCMT ref: 6F88F6AC
Part of subcall function 6F88F682: std::exception::exception.LIBCMT ref: 6F88F6BD

std::_Xinvalid_argument.LIBCPMT ref: 6F8682A5
std::_Xinvalid_argument.LIBCPMT ref: 6F8682C0
_memmove.LIBCMT ref: 6F86831F

Strings

invalid string position, xrefs: 6F868282
string too long, xrefs: 6F8682A0, 6F8682BB

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position$string too long
API String ID: 443534600-4289949731
Opcode ID: 4b1ed71322db09ab438fc4ad314c54858797b2cb318ef634a58d05bd43651f51
Instruction ID: 2f973290b1c83cbc4fa774e846cba98f9b20183542c626792818770f928620d1
Opcode Fuzzy Hash: 4b1ed71322db09ab438fc4ad314c54858797b2cb318ef634a58d05bd43651f51
Instruction Fuzzy Hash: 0621C7313087019BD328CE6CD990A1AB7E5AFA6719F200E9EE096CF391D771D844C751

Function 6F864130 Relevance: 10.6, APIs: 7, Instructions: 68COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6F864156

Part of subcall function 6F8924F0: RaiseException.KERNEL32(6F853778,?,D0A01E50,6F8B13C0,6F853778,?,6F8BD3C8,80000002,D0A01E50), ref: 6F892532

std::exception::exception.LIBCMT ref: 6F86417D
__CxxThrowException@8.LIBCMT ref: 6F86419C
std::exception::exception.LIBCMT ref: 6F8641BE
__CxxThrowException@8.LIBCMT ref: 6F8641DD
std::exception::exception.LIBCMT ref: 6F8641FA
__CxxThrowException@8.LIBCMT ref: 6F864219

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Exception@8Throw$std::exception::exception$ExceptionRaise
String ID:
API String ID: 4237746311-0
Opcode ID: 36111ec5cd4129108ccd1ed9fdbf5c8ea498549d7d8d1476895a30251e1946b0
Instruction ID: bd85950dc330635ece4e2aa0265e5f2368453e0bc921a7624d5611a0303a6228
Opcode Fuzzy Hash: 36111ec5cd4129108ccd1ed9fdbf5c8ea498549d7d8d1476895a30251e1946b0
Instruction Fuzzy Hash: 63217FB64183006BC304DF5CC411BDEB7E8BFD8658F544E9EF9999A290EB349508CBA7

Function 6F8A2453 Relevance: 10.6, APIs: 7, Instructions: 63threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 6F8A2478
__calloc_crt.LIBCMT ref: 6F8A2484
__getptd.LIBCMT ref: 6F8A2491
CreateThread.KERNEL32(?,?,6F8A23EE,00000000,?,?), ref: 6F8A24C8
GetLastError.KERNEL32(?,?,?,?,6F85449C,00000000,00000000,6F871BC0,?,00000000,00000000), ref: 6F8A24D2
_free.LIBCMT ref: 6F8A24DB
__dosmaperr.LIBCMT ref: 6F8A24E6

Part of subcall function 6F89257E: __getptd_noexit.LIBCMT ref: 6F89257E

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__dosmaperr__getptd__getptd_noexit_free
String ID:
API String ID: 155776804-0
Opcode ID: 0f4246b6cf63e1a623c80cb6257c8504122ebd9723164081cf8b0cfa000c16f7
Instruction ID: 8d27800e31886b7f09f7e49814ff80e4ef359bb9883325e77e0f2941b06f4803
Opcode Fuzzy Hash: 0f4246b6cf63e1a623c80cb6257c8504122ebd9723164081cf8b0cfa000c16f7
Instruction Fuzzy Hash: 3711A532205B06BFA7249FEEDC40A9B77E8EF453747104DA9F914DE190EB7AD81186A0

Function 6F897E19 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,6F8BD0D8,00000008,6F897F21,00000000,00000000,?,6F8537D0,?,D0A01E50,?), ref: 6F897E2A
__lock.LIBCMT ref: 6F897E5E

Part of subcall function 6F89A4B6: __mtinitlocknum.LIBCMT ref: 6F89A4CC
Part of subcall function 6F89A4B6: __amsg_exit.LIBCMT ref: 6F89A4D8
Part of subcall function 6F89A4B6: EnterCriticalSection.KERNEL32(00000000,00000000,?,6F897E63,0000000D), ref: 6F89A4E0

InterlockedIncrement.KERNEL32(?), ref: 6F897E6B
__lock.LIBCMT ref: 6F897E7F
___addlocaleref.LIBCMT ref: 6F897E9D

Strings

KERNEL32.DLL, xrefs: 6F897E25

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: 80691b858385db1d80a7aa9573626c1833d118418af57a2eea54f05938ff7e42
Instruction ID: 4e09ed476b991aabccc43d95ebf7be97cf64f8b45cb31ab645a1c3744d5b0392
Opcode Fuzzy Hash: 80691b858385db1d80a7aa9573626c1833d118418af57a2eea54f05938ff7e42
Instruction Fuzzy Hash: 64011B76804B01EADB209F6DD80574DBBE0AF51325F108D8ED596AF3D0CB74AA45CB51

Function 6F8A23EE Relevance: 10.5, APIs: 7, Instructions: 34threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 6F8A23F4

Part of subcall function 6F897D8B: TlsGetValue.KERNEL32(6F851114,6F897EE4,?,6F8537D0,?,D0A01E50,?), ref: 6F897D94
Part of subcall function 6F897D8B: TlsSetValue.KERNEL32(00000000,?,6F8537D0,?,D0A01E50,?), ref: 6F897DB5

___fls_getvalue@4.LIBCMT ref: 6F8A23FF

Part of subcall function 6F897D6B: TlsGetValue.KERNEL32(?,?,6F8A2404,00000000), ref: 6F897D79

___fls_setvalue@8.LIBCMT ref: 6F8A2412
GetLastError.KERNEL32(00000000,?,00000000), ref: 6F8A241B
ExitThread.KERNEL32 ref: 6F8A2422
GetCurrentThreadId.KERNEL32 ref: 6F8A2428
__freefls@4.LIBCMT ref: 6F8A2448

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Value$Thread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 259663610-0
Opcode ID: 516375dd7a88f909cbe699c55eed26e0f35cf1054cfc9ab552c63fdebef4c36f
Instruction ID: 597fc0baaae96ed694930b03fef9056222f9ae809a981c8402195271a94b9100
Opcode Fuzzy Hash: 516375dd7a88f909cbe699c55eed26e0f35cf1054cfc9ab552c63fdebef4c36f
Instruction Fuzzy Hash: DDF09074401B44BBD7089F7EC90889E7BA9EF853183208AD4E8048F358EB39D802CBA0

Function 6F880100 Relevance: 9.2, APIs: 6, Instructions: 178COMMON

Download Yara Rule

APIs

Part of subcall function 6F8907C7: _malloc.LIBCMT ref: 6F8907E1

std::exception::exception.LIBCMT ref: 6F880276
__CxxThrowException@8.LIBCMT ref: 6F88028D

Part of subcall function 6F879D20: _memmove.LIBCMT ref: 6F879E37

Part of subcall function 6F87F800: std::_Xinvalid_argument.LIBCPMT ref: 6F87F819

std::exception::exception.LIBCMT ref: 6F88029F
__CxxThrowException@8.LIBCMT ref: 6F8802B6
std::exception::exception.LIBCMT ref: 6F8802C8
__CxxThrowException@8.LIBCMT ref: 6F8802DF

Part of subcall function 6F8907C7: std::exception::exception.LIBCMT ref: 6F890816
Part of subcall function 6F8907C7: std::exception::exception.LIBCMT ref: 6F890830
Part of subcall function 6F8907C7: __CxxThrowException@8.LIBCMT ref: 6F890841

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw$Xinvalid_argument_malloc_memmovestd::_
String ID:
API String ID: 410196489-0
Opcode ID: c76e05438c9cd725971b6b2b21193c1d769c990ae66c48914a0b8da5e9d181f9
Instruction ID: 07c413072d75dfbe25f83efc4278cd7a36a159b012417c1c1a4b32bc8441c021
Opcode Fuzzy Hash: c76e05438c9cd725971b6b2b21193c1d769c990ae66c48914a0b8da5e9d181f9
Instruction Fuzzy Hash: B36148B1505B41EFC318CF29C88098AFBE0BF89314F509DAEE19A8B750D775E549CB92

Function 6F89CA3C Relevance: 9.1, APIs: 6, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,0000009C,00000000,00000000,00000003,00000001,00000000,?,?,?,6F89CB51,?,00000001,?), ref: 6F89CA86
_malloc.LIBCMT ref: 6F89CABB
_memset.LIBCMT ref: 6F89CADB
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,?,0000009C,?,00000001,0000009C,?,00000008,6F89144D,0000009C), ref: 6F89CAF0
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 6F89CAFE
__freea.LIBCMT ref: 6F89CB08

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: ByteCharMultiWide$StringType__freea_malloc_memset
String ID:
API String ID: 525495869-0
Opcode ID: 2b3b91f777adbcc0702aceac5fb7ddf24b7065d49908dd2333ebf6bbe8e836e7
Instruction ID: 440680de6259c9ff3de13628cab4d2b7af2b0739d23a79645f37fea9e11064d9
Opcode Fuzzy Hash: 2b3b91f777adbcc0702aceac5fb7ddf24b7065d49908dd2333ebf6bbe8e836e7
Instruction Fuzzy Hash: 273130B160020AAFEF00CF69EC81DAE7BE9EB45354F1148A6F9159A191E731DD60DB60

Function 6F89A70C Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6F89A718

Part of subcall function 6F897F46: __getptd_noexit.LIBCMT ref: 6F897F49
Part of subcall function 6F897F46: __amsg_exit.LIBCMT ref: 6F897F56

__amsg_exit.LIBCMT ref: 6F89A738
__lock.LIBCMT ref: 6F89A748
InterlockedDecrement.KERNEL32(?), ref: 6F89A765
_free.LIBCMT ref: 6F89A778
InterlockedIncrement.KERNEL32(010F1668), ref: 6F89A790

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: be6354c58d4d4bf800ad865a1bd6bd5dd737dce8c9b33046179ff1e46ff32766
Instruction ID: 3ccfe8bcf355e1c86b17dfc56de50a2c036a53e4cb853fc3e159b7fbea2d9981
Opcode Fuzzy Hash: be6354c58d4d4bf800ad865a1bd6bd5dd737dce8c9b33046179ff1e46ff32766
Instruction Fuzzy Hash: F201AD32D01B11FBCB059FAC85867ADB3B1AF06B29F1049C6E854AF280CB34A851CBD1

Function 6F855C30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 273fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6F85F460: CharUpperW.USER32(?), ref: 6F85F4F8
Part of subcall function 6F85F460: CharUpperW.USER32(D0A01E50), ref: 6F85F509

Part of subcall function 6F85BF10: RegCreateKeyExW.ADVAPI32(80000002,?,00000000,00000000,00000000,00000003,00000000,?,00000000,00000000,D0A01E50,80000002,?), ref: 6F85BF8F

DeleteFileW.KERNEL32(?,?,?,00000004), ref: 6F855F78

Strings

Nu4w.rHXhIL4Q579vMJODuE+i0b6uu+I.Gpq*gf3R/QsiGp5Mw8MSfjeh-)DUgpOjJMNlrXcnU)sCONs1)w+.IM9+ozMI5qe-2bPa7BsqHHevbe,5XSHJ-AA6v3+YUfS8SvaawIFNO/Q2U-xMOAsaB, xrefs: 6F855CE3
vars, xrefs: 6F855D47, 6F855E05
SchedulerQueue, xrefs: 6F855DD6
\settings.dat, xrefs: 6F855C7C

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: CharUpper$CreateDeleteFile
String ID: Nu4w.rHXhIL4Q579vMJODuE+i0b6uu+I.Gpq*gf3R/QsiGp5Mw8MSfjeh-)DUgpOjJMNlrXcnU)sCONs1)w+.IM9+ozMI5qe-2bPa7BsqHHevbe,5XSHJ-AA6v3+YUfS8SvaawIFNO/Q2U-xMOAsaB$SchedulerQueue$\settings.dat$vars
API String ID: 1627135577-1198711701
Opcode ID: 3cd35a0516a973b944ed8cd2056bd05a494126c3879e4aff1d0205e4c13ced4a
Instruction ID: 48743148127b26c23e23d41e24299182e6226c5d47d1f0794b39f8e3994d1b10
Opcode Fuzzy Hash: 3cd35a0516a973b944ed8cd2056bd05a494126c3879e4aff1d0205e4c13ced4a
Instruction Fuzzy Hash: 0DB14BB1908380DBD760CF68C441B9FB7E5BF99308F404D6EE5899B281DB759458CB53

Function 6F87BF50 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 222COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6F87C06A
_memmove.LIBCMT ref: 6F87C077
_memset.LIBCMT ref: 6F87C120
_memmove.LIBCMT ref: 6F87C12D

Strings

unexpected key token, xrefs: 6F87C00A

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: _memmove_memset
String ID: unexpected key token
API String ID: 3555123492-251841271
Opcode ID: cbb5e67cd1d4644af22a2b23c1207f8e69a6ebb50eba44d95d8ab27641974750
Instruction ID: a7eeb95ad48ce4762f27d8f4231bbd3a565aa46723c09af60d72ed45472fc825
Opcode Fuzzy Hash: cbb5e67cd1d4644af22a2b23c1207f8e69a6ebb50eba44d95d8ab27641974750
Instruction Fuzzy Hash: E2819071504242EFC728DF28C490A5AF3A5FF45314F508AAAE8588F752EB30F994CBE1

Function 6F87C1F0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 210COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6F87C348
_memmove.LIBCMT ref: 6F87C355
_memset.LIBCMT ref: 6F87C3BF
_memmove.LIBCMT ref: 6F87C3CC

Strings

unexpected value token, xrefs: 6F87C2A9

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: _memmove_memset
String ID: unexpected value token
API String ID: 3555123492-4033629345
Opcode ID: de4e69f144e2694266da4262570f793e214a048348798a8b9ac96c41fce681ea
Instruction ID: 776b9fdd93d27e14b88484c6182ed8a9e8a5fe4ddc04ceac2c09c894c9d77b38
Opcode Fuzzy Hash: de4e69f144e2694266da4262570f793e214a048348798a8b9ac96c41fce681ea
Instruction Fuzzy Hash: AE81ADB1504346AFC328CF19C880E6AF7A5FF4A314F508AADE8558F752EB31B954CB91

Function 6F853B30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 129COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6F853BA6
std::_Xinvalid_argument.LIBCPMT ref: 6F853BC4
_memmove.LIBCMT ref: 6F853C1F

Part of subcall function 6F853A40: std::_Xinvalid_argument.LIBCPMT ref: 6F853A57
Part of subcall function 6F853A40: std::_Xinvalid_argument.LIBCPMT ref: 6F853A75
Part of subcall function 6F853A40: std::_Xinvalid_argument.LIBCPMT ref: 6F853A93
Part of subcall function 6F853A40: _memmove.LIBCMT ref: 6F853AFC

Strings

\ChicaLogic\ChicaPC-Shield, xrefs: 6F853B71, 6F853B86, 6F853C1D
string too long, xrefs: 6F853BA1, 6F853BBF

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: \ChicaLogic\ChicaPC-Shield$string too long
API String ID: 2168136238-1084033844
Opcode ID: d8d9e7d73a1cdb335797b32533fac9e7bb63018f049098f499ead01b8c0f0079
Instruction ID: a224ead779e87b07a16cbb8b150c5e48f51c9e9d9cdb7547e3456045a6ae1801
Opcode Fuzzy Hash: d8d9e7d73a1cdb335797b32533fac9e7bb63018f049098f499ead01b8c0f0079
Instruction Fuzzy Hash: 7231DA723057159B4364CEACE89186AF3EBEF957113100EBFE592CF650DB71AC2483A5

Function 6F8548D0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 125timeCOMMON

Download Yara Rule

APIs

Part of subcall function 6F8550B0: RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,00020019,?,D0A01E50,?,?,?,?), ref: 6F855112

SystemTimeToFileTime.KERNEL32(?,?), ref: 6F854933
__swprintf.LIBCMT ref: 6F854965
SHDeleteValueW.SHLWAPI(80000002,00000000,SchedulerQueue), ref: 6F8549F3

Part of subcall function 6F8552D0: RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,0002001B,?,?,?,?,?,?,?,6F854864,?,00000000,?,?), ref: 6F85530A
Part of subcall function 6F8552D0: RegSetValueExW.ADVAPI32(?,SchedulerQueue,00000000,00000007,?,?,?,?,6F854864,?,00000000,?,?,?), ref: 6F855349
Part of subcall function 6F8552D0: RegCloseKey.ADVAPI32(?,?,?,6F854864,?,00000000,?,?,?), ref: 6F855358

Strings

%u, %u, %u, %u, %u | , xrefs: 6F85495F
SchedulerQueue, xrefs: 6F8549E8

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: OpenTimeValue$CloseDeleteFileSystem__swprintf
String ID: %u, %u, %u, %u, %u | $SchedulerQueue
API String ID: 3953210692-271011824
Opcode ID: eab033b3dc5a5e7734c52a4b30ce9c918c9e67385ff570998710863a1a504d06
Instruction ID: de333377a0d3a391483fc5901c7c5548ac131cd784a2791947e8863640674f0c
Opcode Fuzzy Hash: eab033b3dc5a5e7734c52a4b30ce9c918c9e67385ff570998710863a1a504d06
Instruction Fuzzy Hash: B6417071508300ABD754CF68C891A9FB3E5EFC4314F504D9EF59A9B290E730A969CB93

Function 6F856620 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6F85663A

Part of subcall function 6F88F682: std::exception::exception.LIBCMT ref: 6F88F697
Part of subcall function 6F88F682: __CxxThrowException@8.LIBCMT ref: 6F88F6AC
Part of subcall function 6F88F682: std::exception::exception.LIBCMT ref: 6F88F6BD

std::_Xinvalid_argument.LIBCPMT ref: 6F856676

Part of subcall function 6F88F635: std::exception::exception.LIBCMT ref: 6F88F64A
Part of subcall function 6F88F635: __CxxThrowException@8.LIBCMT ref: 6F88F65F
Part of subcall function 6F88F635: std::exception::exception.LIBCMT ref: 6F88F670

_memmove.LIBCMT ref: 6F8566D7

Strings

invalid string position, xrefs: 6F856635
string too long, xrefs: 6F856671

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_$_memmove
String ID: invalid string position$string too long
API String ID: 1615890066-4289949731
Opcode ID: 5caa8d6e89e8a22c5a75c41d3dd0de397fbc444ccf158c96a227327e36e53ec2
Instruction ID: 5fea2ec7b0c7e0f2dcca6269bf2ec1d90390b2e11f047e922a597e6e21a1800c
Opcode Fuzzy Hash: 5caa8d6e89e8a22c5a75c41d3dd0de397fbc444ccf158c96a227327e36e53ec2
Instruction Fuzzy Hash: 5521B9333046149BD3609E5CAC90A5AF7E9DF92665F200EAFF551CF390DB7298608BA1

Function 6F893A39 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 6F893A4C

Part of subcall function 6F8939A7: ___BuildCatchObjectHelper.LIBCMT ref: 6F8939DD

_UnwindNestedFrames.LIBCMT ref: 6F893A63
___FrameUnwindToState.LIBCMT ref: 6F893A71

Strings

csm, xrefs: 6F893A3B
csm, xrefs: 6F893A48, 6F893A5D, 6F893A70, 6F893A8E, 6F893A9E

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm$csm
API String ID: 2163707966-3733052814
Opcode ID: 781db7614acfea28c332aed71eb207493b0bb3aa81d73770282c5f9290fd4cc2
Instruction ID: 3c2e40404bc8951f40c00c5293e1330a6c467d88b7c6d23cba7391612e820cd5
Opcode Fuzzy Hash: 781db7614acfea28c332aed71eb207493b0bb3aa81d73770282c5f9290fd4cc2
Instruction Fuzzy Hash: 9801F671000609BBEF029F59CC46EDA7FAAFF09358F004854BD1C591A0D736EAB2DBA5

Function 6F89DDC4 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6F89DDD2

Part of subcall function 6F8932A4: __FF_MSGBANNER.LIBCMT ref: 6F8932BD
Part of subcall function 6F8932A4: __NMSG_WRITE.LIBCMT ref: 6F8932C4
Part of subcall function 6F8932A4: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,6F89450F,00000000,00000001,00000000,?,6F89A441,00000018,6F8BD148,0000000C,6F89A4D1), ref: 6F8932E9

_free.LIBCMT ref: 6F89DDE5

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 33b3a2815e56feae0c8a95806a822c2e254088ccf4b7864c04f6c9bedf27b5a6
Instruction ID: 626ca2e28378e1dde0427262b298abea34dfafbea1b5b02a739419a469bad8b6
Opcode Fuzzy Hash: 33b3a2815e56feae0c8a95806a822c2e254088ccf4b7864c04f6c9bedf27b5a6
Instruction Fuzzy Hash: B411C437844715BBCB151F7CEC1464E3BAAAF513B1B104DE5E884DE190DF34D450C698

Function 6F863D50 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 6F863D7F

Part of subcall function 6F88FA1C: _setlocale.LIBCMT ref: 6F88FA2E

_free.LIBCMT ref: 6F863D91

Part of subcall function 6F8922D5: RtlFreeHeap.NTDLL(00000000,00000000,?,6F8537D0,?,D0A01E50,?), ref: 6F8922EB

_free.LIBCMT ref: 6F863DA4
_free.LIBCMT ref: 6F863DB7
_free.LIBCMT ref: 6F863DCA

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: _free$FreeHeapLocinfo::_Locinfo_dtor_setlocalestd::_
String ID:
API String ID: 1034197179-0
Opcode ID: 9ff84c63339050a6bf6b74d7cc14fc3781b53a9433a63f58d0e97405fe752866
Instruction ID: 6d91ef6730fb7f22f12376657f9c388702bc87ecef4b27ce8035cd14e99ac7bd
Opcode Fuzzy Hash: 9ff84c63339050a6bf6b74d7cc14fc3781b53a9433a63f58d0e97405fe752866
Instruction Fuzzy Hash: 0A1191F1900B40AFD610CF9CD841A47F7E9AF94630F144E6AE466CBB80D775E9148B92

Function 6F89A2C3 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6F89A2CF

Part of subcall function 6F897F46: __getptd_noexit.LIBCMT ref: 6F897F49
Part of subcall function 6F897F46: __amsg_exit.LIBCMT ref: 6F897F56

__getptd.LIBCMT ref: 6F89A2E6
__amsg_exit.LIBCMT ref: 6F89A2F4
__lock.LIBCMT ref: 6F89A304
__updatetlocinfoEx_nolock.LIBCMT ref: 6F89A318

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 0812b1ec3c051300ca2a571b97bb493a8c45cbf8d819f1cf623dea22585ff12a
Instruction ID: 94e900031732878f4cd134b56e9cf630d7a2bda834ea8f78c5818f83220f773b
Opcode Fuzzy Hash: 0812b1ec3c051300ca2a571b97bb493a8c45cbf8d819f1cf623dea22585ff12a
Instruction Fuzzy Hash: F0F09A32D05B10FBDB24ABBC8505B5DB3E0AF01729F1049CDE406AE2C0CF24A940AA56

Function 6F8A23E2 Relevance: 7.5, APIs: 5, Instructions: 24threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6F895BFF: _doexit.LIBCMT ref: 6F895C0B

___set_flsgetvalue.LIBCMT ref: 6F8A23F4

Part of subcall function 6F897D8B: TlsGetValue.KERNEL32(6F851114,6F897EE4,?,6F8537D0,?,D0A01E50,?), ref: 6F897D94
Part of subcall function 6F897D8B: TlsSetValue.KERNEL32(00000000,?,6F8537D0,?,D0A01E50,?), ref: 6F897DB5

___fls_getvalue@4.LIBCMT ref: 6F8A23FF

Part of subcall function 6F897D6B: TlsGetValue.KERNEL32(?,?,6F8A2404,00000000), ref: 6F897D79

___fls_setvalue@8.LIBCMT ref: 6F8A2412
GetLastError.KERNEL32(00000000,?,00000000), ref: 6F8A241B
ExitThread.KERNEL32 ref: 6F8A2422
GetCurrentThreadId.KERNEL32 ref: 6F8A2428
__freefls@4.LIBCMT ref: 6F8A2448

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Value$Thread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
String ID:
API String ID: 2403457894-0
Opcode ID: 9e66c13b078bbd8cdd57aa6f2eaeb19447434076eb068798ff101b56445b1841
Instruction ID: a9ffa584b0522419899d728df38d63c81bd575cedd1b0217c11546489e57f028
Opcode Fuzzy Hash: 9e66c13b078bbd8cdd57aa6f2eaeb19447434076eb068798ff101b56445b1841
Instruction Fuzzy Hash: B5E0B635801B45779F116BFE89088EF7A6C9E81359B101ED0BA159F188EB29A92286E1

Function 6F866AE0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 183COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 6F866CA7

Strings

%, xrefs: 6F866C2D
+, xrefs: 6F866C3B
$, xrefs: 6F866B38

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: swprintf
String ID: $$%$+
API String ID: 233258989-3202472541
Opcode ID: 69ba10b2b2bd3f06de24e4761c8aed0dc87c3039c206adaab6bc8f392c8f395b
Instruction ID: bea63719a72983b8778b08ffbdd7e30517cd6123cdba27d599841d235287665e
Opcode Fuzzy Hash: 69ba10b2b2bd3f06de24e4761c8aed0dc87c3039c206adaab6bc8f392c8f395b
Instruction Fuzzy Hash: 27516872E09784AAD7059E58C5807CB7BF8FF87750F109ED9E8809F2A1E775984487C2

Function 6F866CF0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 177COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 6F866EA5

Strings

$, xrefs: 6F866D48
+, xrefs: 6F866E39
%, xrefs: 6F866E2B

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: swprintf
String ID: $$%$+
API String ID: 233258989-3202472541
Opcode ID: 9f5930cdcfc9e808017936ecc979beece001f8cfe30ce8c6482e7c3e2f49bafd
Instruction ID: 6369aa7811e43e8e7df54f5d29d26fcc29a012063d901a95b048a15dac2c1944
Opcode Fuzzy Hash: 9f5930cdcfc9e808017936ecc979beece001f8cfe30ce8c6482e7c3e2f49bafd
Instruction Fuzzy Hash: D4516C72A09384AAD7059E18C68078B7BF5AF47750F205EE9F9808F2D1E736D84587C2

Function 6F854A70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

_swscanf.LIBCMT ref: 6F854B90

Strings

%u, %u, %u, %u, %u | , xrefs: 6F854B8A

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: _swscanf
String ID: %u, %u, %u, %u, %u |
API String ID: 2748852333-2091373509
Opcode ID: 57aca9dd6a1e7aca1915420d35b887c4156427a5ec29c44912d9fd17fb8a66d7
Instruction ID: 7936319a2a0437d0e942feffc62ad0d85df88a5e775109f53c49a22f6f299ba6
Opcode Fuzzy Hash: 57aca9dd6a1e7aca1915420d35b887c4156427a5ec29c44912d9fd17fb8a66d7
Instruction Fuzzy Hash: A141E672A066009BC704CB68D46675BB3A4FBC9324F454DEAE45ACF280E771D928CB93

Function 6F867EF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6F867F61
std::_Xinvalid_argument.LIBCPMT ref: 6F867F7C
_memmove.LIBCMT ref: 6F867FCF

Part of subcall function 6F868270: std::_Xinvalid_argument.LIBCPMT ref: 6F868287
Part of subcall function 6F868270: std::_Xinvalid_argument.LIBCPMT ref: 6F8682A5
Part of subcall function 6F868270: std::_Xinvalid_argument.LIBCPMT ref: 6F8682C0
Part of subcall function 6F868270: _memmove.LIBCMT ref: 6F86831F

Strings

string too long, xrefs: 6F867F5C, 6F867F77

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: string too long
API String ID: 2168136238-2556327735
Opcode ID: 42144f9e1c755838d9eb3a3265667afbbbae1ac7f917cc6e77a714f769e116fa
Instruction ID: a5d76ce1f5deb664da9397e0ee582d3509ceaf5264b70a5c80357553ac5c155b
Opcode Fuzzy Hash: 42144f9e1c755838d9eb3a3265667afbbbae1ac7f917cc6e77a714f769e116fa
Instruction Fuzzy Hash: 7231C2723006149BD3248EACA880E6EF3E9DF91725B204EAFF5518F780CF61AC4083E5

Function 6F886100 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 108COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6F8861E2
_memmove.LIBCMT ref: 6F8861EF

Strings

\U00000000, xrefs: 6F88610E
u, xrefs: 6F88615E

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: _memmove_memset
String ID: \U00000000$u
API String ID: 3555123492-2159923790
Opcode ID: 286dc856a400a613b9172057ca7da156b8056352e6d8220d145ca6c06720d30e
Instruction ID: 36303702249d83a7270069791e506f3a9a5ba0ae9be09dd5a3301853c4630eb6
Opcode Fuzzy Hash: 286dc856a400a613b9172057ca7da156b8056352e6d8220d145ca6c06720d30e
Instruction Fuzzy Hash: 6F41E1346087429FD314CF28C44066BBBE1AF8A314F548DADE8E58B352E775E909CB92

Function 6F874D40 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6F874DE7

Part of subcall function 6F8924F0: RaiseException.KERNEL32(6F853778,?,D0A01E50,6F8B13C0,6F853778,?,6F8BD3C8,80000002,D0A01E50), ref: 6F892532

__CxxThrowException@8.LIBCMT ref: 6F874E61

Part of subcall function 6F864430: std::exception::exception.LIBCMT ref: 6F864498

Strings

repeated TAG directive, xrefs: 6F874E11
TAG directives must have exactly two arguments, xrefs: 6F874DA1

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaisestd::exception::exception
String ID: TAG directives must have exactly two arguments$repeated TAG directive
API String ID: 994420026-120206097
Opcode ID: 9e7e498e0920d14aa144f82dc1ae48a18e19ae3810f39bc6a87e64b1d5bf1537
Instruction ID: 6e3aa7c24d882529ffa80e0fb72bdf9ec0689de10aea9385a4091f14aee83835
Opcode Fuzzy Hash: 9e7e498e0920d14aa144f82dc1ae48a18e19ae3810f39bc6a87e64b1d5bf1537
Instruction Fuzzy Hash: 76416D71609341AFD728DF59C881B9BBBE4FBC9714F404D5DE4898B781DB34A808CB52

Function 6F868000 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6F868016

Part of subcall function 6F88F635: std::exception::exception.LIBCMT ref: 6F88F64A
Part of subcall function 6F88F635: __CxxThrowException@8.LIBCMT ref: 6F88F65F
Part of subcall function 6F88F635: std::exception::exception.LIBCMT ref: 6F88F670

std::_Xinvalid_argument.LIBCPMT ref: 6F868031

Strings

string too long, xrefs: 6F868011, 6F86802C

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw
String ID: string too long
API String ID: 963545896-2556327735
Opcode ID: a9768fb2600df84e938433ffee815d89a7bef5906d12320e5e18ce924d0246e2
Instruction ID: c45fb6b3e1ed1b7c7907c04bbfa63ae656e41081a6cb22621a7d5beebb2e9a14
Opcode Fuzzy Hash: a9768fb2600df84e938433ffee815d89a7bef5906d12320e5e18ce924d0246e2
Instruction Fuzzy Hash: 0421A73120C7458BC7359E6C9450A2ABBE9AFA7610F100E9EE4E58F7D1C7B2A8448763

Function 6F862060 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

VerQueryValueW.VERSION(00000000), ref: 6F862099
VerQueryValueW.VERSION(00000000,?,?,?,?,?,?,?,00000000), ref: 6F8620EB

Strings

\VarFileInfo\Translation, xrefs: 6F862085
\StringFileInfo\%04x%04x\%ws, xrefs: 6F8620C8

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: QueryValue
String ID: \StringFileInfo\%04x%04x\%ws$\VarFileInfo\Translation
API String ID: 3660427363-4289871972
Opcode ID: 924fba4db58bb5abbf13bd449e8e4ffba1c2c6e36d8f1a10bbc1a1910bab3f79
Instruction ID: 9394482e22d350f498313c968bcbc0109ad82ae9b6071d3888fd496bde64de09
Opcode Fuzzy Hash: 924fba4db58bb5abbf13bd449e8e4ffba1c2c6e36d8f1a10bbc1a1910bab3f79
Instruction Fuzzy Hash: 5B214F711083019BD728CF28D851BA7B3F9FF88704F444EADF58ACB640E779A54987A2

Function 6F855B30 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

OpenEventW.KERNEL32(00000002,00000000,00000000), ref: 6F855BA0
SetEvent.KERNEL32(00000000), ref: 6F855BFB
CloseHandle.KERNEL32(00000000), ref: 6F855C02

Strings

UpdateConfig, xrefs: 6F855B6B

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Event$CloseHandleOpen
String ID: UpdateConfig
API String ID: 1560313832-558628780
Opcode ID: 36d3c72b9b1d12d258755e026bd453feb7eebba28f89d8242f66bc046b6966ec
Instruction ID: ea9d00c981966ca86e2e5176176461b577a7b7af0821b819a68817bc9c491b31
Opcode Fuzzy Hash: 36d3c72b9b1d12d258755e026bd453feb7eebba28f89d8242f66bc046b6966ec
Instruction Fuzzy Hash: 4E2148B1908780EBD700CB28C845A5FBBE5FF89328F404E6DF4998B290D779A554CB97

Function 6F877B00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6F877B0A

Part of subcall function 6F88F635: std::exception::exception.LIBCMT ref: 6F88F64A
Part of subcall function 6F88F635: __CxxThrowException@8.LIBCMT ref: 6F88F65F
Part of subcall function 6F88F635: std::exception::exception.LIBCMT ref: 6F88F670

std::_Xinvalid_argument.LIBCPMT ref: 6F877B19

Strings

string too long, xrefs: 6F877B05, 6F877B14

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw
String ID: string too long
API String ID: 963545896-2556327735
Opcode ID: d632d46413f5c0c9c69ca468aee2fc773465790de393119e70d92bd7567917ff
Instruction ID: 3b5529d0f3be891b18533acc54b2999aa4716a4798e6a5c7d3cc6999edf4771e
Opcode Fuzzy Hash: d632d46413f5c0c9c69ca468aee2fc773465790de393119e70d92bd7567917ff
Instruction Fuzzy Hash: EE1151307047409BD7358F2C9950B1E77F5EF96614F150ECAE0A18F391DB75A840C7A2

Function 6F85C660 Relevance: 6.1, APIs: 4, Instructions: 113registryCOMMON

Download Yara Rule

APIs

Part of subcall function 6F853280: std::_Xinvalid_argument.LIBCPMT ref: 6F853298

RegOpenKeyExW.ADVAPI32(?,6F85610F,00000000,00000001,D0A01E50,00000000,D0A01E50,00000000), ref: 6F85C6FD
RegQueryValueExW.ADVAPI32(?,?,00000000,6F85610F,?,00001000), ref: 6F85C755
RegCloseKey.ADVAPI32(D0A01E50), ref: 6F85C764
RegCloseKey.ADVAPI32(D0A01E50), ref: 6F85C786

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Close$OpenQueryValueXinvalid_argumentstd::_
String ID:
API String ID: 4154549875-0
Opcode ID: 6d992424c73e7bdbf1b9b83b8f6357786f85196d0d8d14699e9b238e885ae9da
Instruction ID: ad1b9c8d448d9d2f66b6c50d41f4dd252b95687f1ae9a5c1150d497bd75c6411
Opcode Fuzzy Hash: 6d992424c73e7bdbf1b9b83b8f6357786f85196d0d8d14699e9b238e885ae9da
Instruction Fuzzy Hash: FC416071508780EBC764CF28C880EABB7E8FFC9754F000E5EF5958A240D774A958CB62

Function 6F879A60 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

Part of subcall function 6F8907C7: _malloc.LIBCMT ref: 6F8907E1

Part of subcall function 6F8907C7: std::exception::exception.LIBCMT ref: 6F890816
Part of subcall function 6F8907C7: std::exception::exception.LIBCMT ref: 6F890830
Part of subcall function 6F8907C7: __CxxThrowException@8.LIBCMT ref: 6F890841

std::exception::exception.LIBCMT ref: 6F879AF3
__CxxThrowException@8.LIBCMT ref: 6F879B0A
std::exception::exception.LIBCMT ref: 6F879BA0
__CxxThrowException@8.LIBCMT ref: 6F879BB7

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw$_malloc
String ID:
API String ID: 2621100827-0
Opcode ID: 6acf9cce9eaf2a2c21186133519e441d52bd016f9ed1f54a47759a5d8ab33273
Instruction ID: 88ae48c910830d09817a1e648ff15a453e737f3daea0ffba86cc332c2f08a972
Opcode Fuzzy Hash: 6acf9cce9eaf2a2c21186133519e441d52bd016f9ed1f54a47759a5d8ab33273
Instruction Fuzzy Hash: C14109B5504B41AFC314CF2DC580A46FBE0BB48704F444EAEE59A8BB41D775E549CF92

Function 6F880C10 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6F8907C7: _malloc.LIBCMT ref: 6F8907E1

Part of subcall function 6F8907C7: std::exception::exception.LIBCMT ref: 6F890816
Part of subcall function 6F8907C7: std::exception::exception.LIBCMT ref: 6F890830
Part of subcall function 6F8907C7: __CxxThrowException@8.LIBCMT ref: 6F890841

std::exception::exception.LIBCMT ref: 6F880C97
__CxxThrowException@8.LIBCMT ref: 6F880CAE
std::exception::exception.LIBCMT ref: 6F880D17
__CxxThrowException@8.LIBCMT ref: 6F880D2E

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw$_malloc
String ID:
API String ID: 2621100827-0
Opcode ID: 135d849e074103d39bdd2460b951357ed01f568df528a785ade21ef3e732bbe7
Instruction ID: 7ea206f86cca4893875558402fa7f4800e47ea45220eb1226d2b6d6f412cc0ed
Opcode Fuzzy Hash: 135d849e074103d39bdd2460b951357ed01f568df528a785ade21ef3e732bbe7
Instruction Fuzzy Hash: 9F3148B5505745AFC344CF29C440A46FBE0FF88714F508E9EE4998B751E735A548CF92

Function 6F89E53A Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 6F89E56E
__isleadbyte_l.LIBCMT ref: 6F89E5A1
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?,?,?), ref: 6F89E5D2
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?,?,?), ref: 6F89E640

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 564b0b3480decd3ae92e8ad848325dcc1170470e81a0a1e23270a0f5288809aa
Instruction ID: fc9e02f6fd24cfc05a86244400097f06580f3c484531bb495dc69a44d5f7a5a7
Opcode Fuzzy Hash: 564b0b3480decd3ae92e8ad848325dcc1170470e81a0a1e23270a0f5288809aa
Instruction Fuzzy Hash: 24319D31A04296EFDB15DF6CCC949AA3FA5BF01311F1089EAF4659F190E730E940CB61

Function 6F863CA0 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6F863CCE
std::exception::exception.LIBCMT ref: 6F863D09

Part of subcall function 6F890109: std::exception::_Copy_str.LIBCMT ref: 6F890124

__CxxThrowException@8.LIBCMT ref: 6F863D20

Part of subcall function 6F8924F0: RaiseException.KERNEL32(6F853778,?,D0A01E50,6F8B13C0,6F853778,?,6F8BD3C8,80000002,D0A01E50), ref: 6F892532

std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 6F863D27

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: std::_$Copy_strExceptionException@8Locinfo::_Locinfo_ctorLockitLockit::_RaiseThrowstd::exception::_std::exception::exception
String ID:
API String ID: 73090415-0
Opcode ID: 534ab10fa0d4101dfe5b0dd7af80797d7efaa50312cc9c4e32344d8bc08c9b00
Instruction ID: 7112371d3f2318ad03947405acaccc419c6a7040fdaeba15848d85cd2f926f0b
Opcode Fuzzy Hash: 534ab10fa0d4101dfe5b0dd7af80797d7efaa50312cc9c4e32344d8bc08c9b00
Instruction Fuzzy Hash: B111A7B1408B819FC310CF1DC480A5BFBE4FB99614F804E9EE49997741D734A50CCBA6

Function 6F8A3AC4 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 6F8A3AEA

Part of subcall function 6F8A3916: __fltout2.LIBCMT ref: 6F8A3941

__cftog_l.LIBCMT ref: 6F8A3B10
__cftoe_l.LIBCMT ref: 6F8A3B42

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: 373fc7e2da5eef2c91e45b542c41d5f5ac3c6d3398ecb1f2c92c2291dcf3f008
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: F011393204424ABBCF025E94DC12CEE3F27FB19354B488995FAA859131D737D9B2AB81

Function 6F861D90 Relevance: 6.0, APIs: 4, Instructions: 41fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,00000010,?,6F8639FA,00000000,?), ref: 6F861DB6
WriteFile.KERNEL32(00000000,0000006C,D0A01E50,?,00000000), ref: 6F861DD5
CloseHandle.KERNEL32(00000000), ref: 6F861DE0
CloseHandle.KERNEL32(00000000), ref: 6F861DEB

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: CloseFileHandle$CreateWrite
String ID:
API String ID: 3602564925-0
Opcode ID: 37d0536e0bee9b8e1912657e62cc3ce42117695de8d8c4c0b96a1b82fffeaf1b
Instruction ID: 16ba2f42530954b672e9c88dadaf7976d4e728fa494ebb0c65e65e09d4dcc5bf
Opcode Fuzzy Hash: 37d0536e0bee9b8e1912657e62cc3ce42117695de8d8c4c0b96a1b82fffeaf1b
Instruction Fuzzy Hash: DAF0F671241B207FDA149B64CC09F9B73A8AF4AB71F204989F651DF1C0D760681187E5

Function 6F881EE0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6F882113

Part of subcall function 6F864430: std::exception::exception.LIBCMT ref: 6F864498

__CxxThrowException@8.LIBCMT ref: 6F8821BE

Part of subcall function 6F8924F0: RaiseException.KERNEL32(6F853778,?,D0A01E50,6F8B13C0,6F853778,?,6F8BD3C8,80000002,D0A01E50), ref: 6F892532

Strings

end of map flow not found, xrefs: 6F8820BA, 6F88216E

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaisestd::exception::exception
String ID: end of map flow not found
API String ID: 994420026-2863301259
Opcode ID: d73193bec8bcb2c8492af04e637ec4e5ddda9a43911f7016c5e42f78a4b447e7
Instruction ID: 897c2f27ee77ada53ae056e5d3e1ff4a7899dd3f7e27ba9bda561951e44a657d
Opcode Fuzzy Hash: d73193bec8bcb2c8492af04e637ec4e5ddda9a43911f7016c5e42f78a4b447e7
Instruction Fuzzy Hash: D6915871504742EFC724DF28C480A5EB7E6BF85718F204DAEE1659F2A0DB35E845CB91

Function 6F88E2A0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 172COMMON

Download Yara Rule

APIs

Part of subcall function 6F88DAB0: __CxxThrowException@8.LIBCMT ref: 6F88DD9F
Part of subcall function 6F88DAB0: std::_Xinvalid_argument.LIBCPMT ref: 6F88DDA9

Part of subcall function 6F864430: std::exception::exception.LIBCMT ref: 6F864498

__CxxThrowException@8.LIBCMT ref: 6F88E513

Part of subcall function 6F8924F0: RaiseException.KERNEL32(6F853778,?,D0A01E50,6F8B13C0,6F853778,?,6F8BD3C8,80000002,D0A01E50), ref: 6F892532

Strings

', xrefs: 6F88E2F5
unknown escape character: , xrefs: 6F88E486

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaiseXinvalid_argumentstd::_std::exception::exception
String ID: '$unknown escape character:
API String ID: 551578320-37139733
Opcode ID: e716b3caec15073789c4b1cfe9de90d7a487b1db7c9bb34ed185f6c633770b87
Instruction ID: 86d71f2a544bf6a9b3b54aaf26eb1c0777e8fe136c4b50cd301e70e4253760ee
Opcode Fuzzy Hash: e716b3caec15073789c4b1cfe9de90d7a487b1db7c9bb34ed185f6c633770b87
Instruction Fuzzy Hash: 4C51B07094D784EAC230DF68C940B9ABBE0AB87704F000EDEE4A95E381D774AD048B97

Function 6F85DB60 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

Part of subcall function 6F85E670: CryptCreateHash.ADVAPI32(00000000,?,00000000,00000000,?,00000000,?), ref: 6F85E68A
Part of subcall function 6F85E670: CryptHashData.ADVAPI32(?,?,?,00000000,?,00000000,?), ref: 6F85E6A4
Part of subcall function 6F85E670: CryptDestroyHash.ADVAPI32(00000000,?,?,?,00000000,?,00000000,?), ref: 6F85E6B2

_memmove.LIBCMT ref: 6F85DC89

Strings

, xrefs: 6F85DC9A
%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x, xrefs: 6F85DC3F

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: CryptHash$CreateDataDestroy_memmove
String ID: $%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x
API String ID: 2995263313-2265235149
Opcode ID: b93cb6b1dbe3d8db8e7d66fc2a43ef12833417b548fb3cf896c48e61e19eb130
Instruction ID: f3ef254007ee3e952ee369fc28226932a10c041ef7067fd1a165698e11f9940a
Opcode Fuzzy Hash: b93cb6b1dbe3d8db8e7d66fc2a43ef12833417b548fb3cf896c48e61e19eb130
Instruction Fuzzy Hash: 5C418FB251C390ABC365CB698810A2BFBF9AFCA705F044D9EF5D58A281D3789504CB63

Function 6F875EA0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

Part of subcall function 6F864230: std::_Lockit::_Lockit.LIBCPMT ref: 6F86423F

std::_Lockit::_Lockit.LIBCPMT ref: 6F875F34
__Stoulx.LIBCPMT ref: 6F875F92

Strings

-, xrefs: 6F875FC6

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: LockitLockit::_std::_$Stoulx
String ID: -
API String ID: 3418229591-2547889144
Opcode ID: 98deddee91300af9c33a0acb252582e3da573cd1bd849a769c4a78287ac1c1bb
Instruction ID: 8abc9d83aabf9df1a616ee9418e7e872424ff4f88cda2769357a06f5d5505fbb
Opcode Fuzzy Hash: 98deddee91300af9c33a0acb252582e3da573cd1bd849a769c4a78287ac1c1bb
Instruction Fuzzy Hash: 7F4105716087459FC724CF28C580A5AB7E4FB89724F504E9EF9A59B390EB30E904CB92

Function 6F875D30 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

Part of subcall function 6F864230: std::_Lockit::_Lockit.LIBCPMT ref: 6F86423F

std::_Lockit::_Lockit.LIBCPMT ref: 6F875DC4
__Stoulx.LIBCPMT ref: 6F875E22

Strings

-, xrefs: 6F875E59

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: LockitLockit::_std::_$Stoulx
String ID: -
API String ID: 3418229591-2547889144
Opcode ID: 4d789e5832970c6b416abe58deae4fd9e4907c3427452c16ec71a51a5924f7aa
Instruction ID: 17c1a052d743dd959027443b252e5e70348bbd3afe928c72f909f940032dc429
Opcode Fuzzy Hash: 4d789e5832970c6b416abe58deae4fd9e4907c3427452c16ec71a51a5924f7aa
Instruction Fuzzy Hash: 334149765087409FC324CF28C580A6EB7E5FF89714F504E6EF8A59B390EB31A904CB92

Function 6F856530 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6F8565A4
_memmove.LIBCMT ref: 6F8565F3

Part of subcall function 6F856620: std::_Xinvalid_argument.LIBCPMT ref: 6F85663A

Strings

string too long, xrefs: 6F85659F

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: string too long
API String ID: 2168136238-2556327735
Opcode ID: 933005990041f7081b97bae9ebc774fb8e4c10d7abbd4b0f8cbc548ce22c7e12
Instruction ID: 7950292f90a9bd4123c583878ebb04da71db69b2a37a5ae01cfa1ffec56c7231
Opcode Fuzzy Hash: 933005990041f7081b97bae9ebc774fb8e4c10d7abbd4b0f8cbc548ce22c7e12
Instruction Fuzzy Hash: 8F31A4323507109BD3648E5CD890A5AF7EAEF97651B204DAFE191CF284C760EC6487A2

Function 6F856710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6F856722

Part of subcall function 6F88F635: std::exception::exception.LIBCMT ref: 6F88F64A
Part of subcall function 6F88F635: __CxxThrowException@8.LIBCMT ref: 6F88F65F
Part of subcall function 6F88F635: std::exception::exception.LIBCMT ref: 6F88F670

_memmove.LIBCMT ref: 6F85676A

Strings

string too long, xrefs: 6F85671D

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: string too long
API String ID: 1785806476-2556327735
Opcode ID: afc9cd6f342f2f2e2ab815c3c0595bd5cbf738453f8e30b2c8e4c8450ff7cd8b
Instruction ID: 57d58f4f63fe26426797582d9e4a2fb717fe514531fa20329866668fe463bd8a
Opcode Fuzzy Hash: afc9cd6f342f2f2e2ab815c3c0595bd5cbf738453f8e30b2c8e4c8450ff7cd8b
Instruction Fuzzy Hash: 8B113D721447049BE7B49D7CA890A3FB7E8AF52310F100F9FD097CA5C1EB61F4688251

Function 6F852950 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 6F852998
__snwprintf.LIBCMT ref: 6F8529B9

Strings

%ws, xrefs: 6F852991, 6F8529B2

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: __snwprintf
String ID: %ws
API String ID: 2391506597-1756730030
Opcode ID: 5ad4c30e4b346627513ac80a49ef10141dc3324a5a38ab3062372a43dde37d04
Instruction ID: 84105937a457d715b10cd039b1f6da84dde8a447b22888d5ed418a62967ee0f3
Opcode Fuzzy Hash: 5ad4c30e4b346627513ac80a49ef10141dc3324a5a38ab3062372a43dde37d04
Instruction Fuzzy Hash: 4B116DB1908304ABD700DF28C885D6BB3E8EB88324F445D6EF8858B350E735E950CBA7

Function 6F8567C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6F8567D3

Part of subcall function 6F88F682: std::exception::exception.LIBCMT ref: 6F88F697
Part of subcall function 6F88F682: __CxxThrowException@8.LIBCMT ref: 6F88F6AC
Part of subcall function 6F88F682: std::exception::exception.LIBCMT ref: 6F88F6BD

_memmove.LIBCMT ref: 6F85680E

Strings

invalid string position, xrefs: 6F8567CE

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: invalid string position
API String ID: 1785806476-1799206989
Opcode ID: a770ca0914eeda7acc6f8657e910fe7b57855f3e859edc2c0b88799814e9360c
Instruction ID: ef1241c83864bdd579c747d3b5b516bf3a214a8acf8775acf4da4dc81b3ad03b
Opcode Fuzzy Hash: a770ca0914eeda7acc6f8657e910fe7b57855f3e859edc2c0b88799814e9360c
Instruction Fuzzy Hash: 6F01CC317043118BD264CE6CD890A1AB3EAABD6210B244EAED091CF745D7B0EC9283A1

Function 6F871FC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6F871FCD

Part of subcall function 6F88F635: std::exception::exception.LIBCMT ref: 6F88F64A
Part of subcall function 6F88F635: __CxxThrowException@8.LIBCMT ref: 6F88F65F
Part of subcall function 6F88F635: std::exception::exception.LIBCMT ref: 6F88F670

_memmove.LIBCMT ref: 6F872006

Strings

vector<T> too long, xrefs: 6F871FC8

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: vector<T> too long
API String ID: 1785806476-3788999226
Opcode ID: 83b39aeb044098ca91c08956527be6eb0a84585c9a03e813533053f8b6d15293
Instruction ID: cef8d59a322cd9e7128b92cad2b58ec2c09ae69ec5c35158aa61e9fd92ffca0b
Opcode Fuzzy Hash: 83b39aeb044098ca91c08956527be6eb0a84585c9a03e813533053f8b6d15293
Instruction Fuzzy Hash: 8001A271B00A015BCF14DF6CD9A596A33F4F6423287040AEDE452C7380EB34B866CED1

Function 6F861E00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6F861E0F

Part of subcall function 6F88F635: std::exception::exception.LIBCMT ref: 6F88F64A
Part of subcall function 6F88F635: __CxxThrowException@8.LIBCMT ref: 6F88F65F
Part of subcall function 6F88F635: std::exception::exception.LIBCMT ref: 6F88F670

_memmove.LIBCMT ref: 6F861E32

Strings

vector<T> too long, xrefs: 6F861E0A

Memory Dump Source

Source File: 0000000C.00000002.2571435985.000000006F851000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6F850000, based on PE: true

Associated: 0000000C.00000002.2571402531.000000006F850000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571547852.000000006F8B1000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571607645.000000006F8C6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2571648475.000000006F8CC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f850000_cpcsgui.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: vector<T> too long
API String ID: 1785806476-3788999226
Opcode ID: fc407bfb27ccce393c9a7b1809fde36ebc64cb705d98666fc5a987f5b80a8839
Instruction ID: e2eaec1bca173ddfb708afedd9f0ab57deb9d81d938c5960c83e37e36d910c4c
Opcode Fuzzy Hash: fc407bfb27ccce393c9a7b1809fde36ebc64cb705d98666fc5a987f5b80a8839
Instruction Fuzzy Hash: DDF0AFB1600B066FD210DF6DD98082BF7E9EF906147104E2DE5A6CB785DB30F8108B60

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use hidden users to hide the presence of user accounts they create or modify. Administrators may want to hide users when there are many user accounts on a given system or if they want to hide their administrative or other management accounts from other users.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, User Account: User Account Creation, User Account: User Account Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Module: Module Load, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report chica-pc-shield-1-75-0-1300-en-win.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Cryptography

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\7z.dll (copy)

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\Languages\danish.lng (copy)

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\Languages\dutch.lng (copy)

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\Languages\english.lng (copy)

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\Languages\finnish.lng (copy)

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\Languages\french.lng (copy)

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\Languages\german.lng (copy)

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\Languages\is-0HFFJ.tmp

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\Languages\is-3614V.tmp

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\Languages\is-36Q7V.tmp

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\Languages\is-5A794.tmp

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\Languages\is-5RTRO.tmp

C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\Languages\is-DLO1P.tmp

Windows Analysis Report
chica-pc-shield-1-75-0-1300-en-win.exe

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre